# Audiobookshelf changelog > A self-hosted audiobook and podcast server with apps for every device. - Vendor: advplyr - Category: Media - Official site: https://www.audiobookshelf.org - Tracked by: What's New (https://whatsnew.fyi/product/audiobookshelf) - Harvested from: GitHub (advplyr/audiobookshelf) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v2.36.0 - Date: 2026-07-27 - Version: v2.36.0 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.36.0 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.36.0 - **added** — Logout all devices button on account page - **added** — Auth sessions table on account page with ability to logout of individual sessions - **fixed** — Weak protocol validation for OIDC post-login callback URL - **fixed** — User delete endpoint allowing for root account deletion - **fixed** — API and websocket authentication allowing refresh tokens - **fixed** — Bulk library item download endpoint not checking access on individual items - **fixed** — Manual podcast episode match not setting the enclosure url - **changed** — Changing user password invalidates all auth sessions - **changed** — Extend refresh token grace period to 10 minutes and allow REFRESH_TOKEN_GRACE_PERIOD env variable override - **added** — API: New GET endpoints /api/me/progress, /api/me/bookmarks, /api/me/bookmarks/:libraryItemId - **changed** — API: Add all minified fields to expanded library item JSON - **changed** — API: Server settings now include timeZone for server timezone - **changed** — API: /logout endpoint now supports ?allDevices=1 query param to delete all other sessions and rotate current - **added** — API: New endpoint GET /api/me/sessions to get all auth sessions - **added** — API: New endpoint DELETE /api/me/sessions/:id to delete an auth session - **added** — New socket event authors_num_books_updated is emitted during a scan when author book count changes - **added** — Socket event author_added is now emitted during scans - **changed** — Update outdated help links for new docs site ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Added - Logout all devices button on account page (in #5395) - Auth sessions table on account page w/ ability to logout of individual sessions (in #5400) ###### Fixed - Weak protocol validation for OIDC post-login callback URL by @mikiher in #5386 - User delete endpoint allowing for root account deletion by @mikiher in #5370 - API and websocket authentication allowing refresh tokens by @mikiher in #5387 - Bulk library item download endpoint not checking access on individual items by @mikiher in #5388 - Manual podcast episode match not setting the enclosure url #5317 by @mikiher in #5318 ###### Updated - Changing user password invalidates all auth sessions (in #5393) - Extend refresh token grace period to 10 minutes and allow `REFRESH_TOKEN_GRACE_PERIOD` env variable override #5281 by @DanielAshley in #5376 - API: New GET endpoints `/api/me/progress`, `/api/me/bookmarks`, `/api/me/bookmarks/:libraryItemId` by @Vito0912 in #5363 - API: Add all minified fields to expanded library item JSON by @mikiher in #5341 - API: Server settings now include `timeZone` for server timezone (for giving accurate cron job next schedule date) - API: `/logout` endpoint now supports `?allDevices=1` query param to delete all other sessions and rotate current (in #5395) - API: New endpoint GET `/api/me/sessions` to get all auth sessions (in #5400 and #5405) - API: New endpoint DELETE `/api/me/sessions/:id` to delete an auth session (in #5405) - New socket event `authors_num_books_updated` is emitted during a scan when author book count changes by @mikiher in #5354 - Socket event `author_added` is now emitted during scans by @mikiher in #5354 - UI/UX: Update outdated help links for new docs site by @francisrath in #5336 - More strings translated - Chinese (Simplified Han script) by @FiendFEARing - Danish by @MikkelOlesen @hhjuhl - Greek by @no1ta - Icelandic by @axelbjornsson - Portuguese (Brazil) by @AgenteGabrielofc - Tamil by @TamilNeram ###### Internal - Read AllowedDevOrigins from dev.js into ALLOWED_DEV_ORIGINS env var by @mikiher in #5291 - Setup internal-api file upload passthrough for next.js by @mikiher in #5325 - Readme update about frontend rewrite by @nichwall in #5407 ##### New Contributors * @DanielAshley made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5376 * @francisrath made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5336 **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.35.1...v2.36.0 ### v2.35.1 - Date: 2026-05-28 - Version: v2.35.1 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.35.1 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.35.1 - **fixed** — Duplicate refresh tokens across sessions can cause unexpected logout - **fixed** — Server crash when renaming an author to another author when they are both on the same book - **fixed** — Server crash when invalid metadata.json is scanned - **fixed** — Sequelize user queries to use direct case-insensitive username/email matching ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Fixed - Duplicate refresh tokens across sessions can cause unexpected logout #5253 by @nichwall in #5255 - Server crash when renaming an author to another author when they are both on the same book #5247 by @nichwall in #5256 - Server crash when invalid `metadata.json` is scanned in #5268 - Sequelize user queries to use direct case-insensitive username/email matching **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.35.0...v2.35.1 ### v2.35.0 - Date: 2026-05-17 - Version: v2.35.0 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.35.0 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.35.0 - **added** — Access token refresh grace period to reduce frequent re-login requirements - **fixed** — Listening sessions from Android app showing device name as Abs iOS - **fixed** — RSS feeds serving m4b files with incorrect Content-Type - **changed** — Book and podcast descriptions from audio files are sanitized - **changed** — cancel_scan and set_log_listener socket events validate account type and log level ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Added - Access token refresh grace period (fixes frequently needing to re-login) #4630 by @nichwall in #5004 ###### Fixed - Listening sessions from Android app showing device name as `Abs iOS` - RSS feeds serving m4b files with incorrect Content-Type #5041 by @brandonfhall in #5221 ###### Changed - Book & podcast descriptions from audio files are sanitized - `cancel_scan` and `set_log_listener` socket events validate account type and log level - More strings translated - Belarusian by @pavel-miniutka - Polish by @TheMatrixan ##### New Contributors * @brandonfhall made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5221 **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.34.0...v2.35.0 ### v2.34.0 - Date: 2026-04-27 - Version: v2.34.0 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.34.0 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.34.0 - **added** — Japanese language and Japan as podcast search region - **added** — Autocomplete attributes on login and setup fields for password manager support - **fixed** — Recent episodes not updating from cache when media progress changes - **fixed** — Error logging when a podcast's auto-download schedule has an invalid cron expression - **changed** — Public media item shares use start time passed in query parameter for existing sessions - **changed** — Podcast episode downloads use SSRF filtering on the HTTP request - **changed** — Podcast create and update validate the auto-download schedule cron expression and sanitize the HTML description - **changed** — Playlists, collections, and library item batch API routes enforce library and per-item access - **changed** — More strings translated in Belarusian, Hungarian, and Japanese ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Added - Japanese language and Japan as podcast search region by @na3shkw in #5211 - Autocomplete attributes on login and setup fields for password manager support by @meek2100 in #5089 ###### Fixed - Recent episodes not updating from cache when media progress changes in #5159 - Error logging when a podcast's auto-download schedule has an invalid cron expression ###### Changed - Public media item shares: use start time passed in query parameter for existing sessions by @pjkottke in #5163 - Podcast episode downloads use SSRF filtering on the HTTP request (matches other external requests) - Podcast create and update validate the auto-download schedule cron expression and sanitizes the HTML description - Playlists, collections, and library item batch API routes enforce library and per-item access - More strings translated - Belarusian by @pavel-miniutka - Hungarian by @ugyes - Japanese by @na3shkw ###### Internal - ApiCacheManager test coverage for recent-episodes cache invalidation ##### New Contributors * @pjkottke made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5163 * @meek2100 made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5089 * @na3shkw made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5211 **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.33.2...v2.34.0 ### v2.33.2 - Date: 2026-04-19 - Version: v2.33.2 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.33.2 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.33.2 - **fixed** — Matroska audiobooks (.mka) with the Opus codec failing to play in web client - **fixed** — Share player not using libraries cover aspect ratio setting - **fixed** — Backup uploads leaving temporary files behind when the uploaded file failed validation - **fixed** — Path traversal check on the filesystem path-exists endpoint not handling all edge cases - **changed** — Bulk download endpoint now ensures all requested items belong to the library being requested - **changed** — Backup load and upload now validate the backup details entry exists and is within a reasonable size limit - **changed** — Podcast create endpoint validates that the podcast path is inside the selected library folder - **changed** — Author and library item cover image endpoints now clamp width/height query params to a maximum of 4096 - **changed** — Podcast episode subtitles parsed from RSS feeds are now sanitized for HTML - **changed** — author_updated and author_added socket events are now emitted when updating authors in the book details edit modal - **changed** — item_removed socket event payload now includes libraryId so clients can ignore events for other libraries ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Fixed - Matroska audiobooks (`.mka`) with the Opus codec failing to play in web client by @rktjmp in #5115 - UI/UX: Share player not using libraries cover aspect ratio setting - Backup uploads leaving temporary files behind when the uploaded file failed validation - Path traversal check on the filesystem path-exists endpoint not handling all edge cases ###### Changed - Bulk download endpoint now ensures all requested items belong to the library being requested - Backup load and upload now validate the backup `details` entry exists and is within a reasonable size limit - Podcast create endpoint validates that the podcast path is inside the selected library folder - Author and library item cover image endpoints now clamp width/height query params to a maximum of 4096 - Podcast episode subtitles parsed from RSS feeds are now sanitized for HTML - `author_updated`/`author_added` socket events emitted when updating authors in the book details edit modal by @mikiher in #5158 - `item_removed` socket event payload now includes `libraryId` so clients can ignore events for other libraries by @mikiher in #5160 - More strings translated - Belarusian by @pavel-miniutka - Bulgarian by @lembata - German by @JBlond @LaurinSorgend - Italian by @tizio04 - Russian by @Hopelite @vmakeev - Spanish by @cyphra ##### New Contributors * @rktjmp made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5115 **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.33.1...v2.33.2 ### v2.33.1 - Date: 2026-03-19 - Version: v2.33.1 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.33.1 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.33.1 - **fixed** — API Keys not respecting user enabled/disabled flag - **changed** — Podcast episode update endpoint sanitizes HTML for subtitle - **changed** — Playlist and collection create/update endpoints strip HTML tags from name ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Fixed - API Keys not respecting user enabled/disabled flag ###### Changed - Podcast episode update endpoint sanitizes HTML for subtitle - Playlist & collection create/update endpoints strip HTML tags from name - More strings translated - Belarusian by @pavel-miniutka - German by @fabianjuelich - Spanish by @cyphra **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.33.0...v2.33.1 ### v2.33.0 - Date: 2026-03-12 - Version: v2.33.0 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.33.0 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.33.0 - **added** — Slovak language option - **added** — Belarusian language option - **added** — Database indexes for discover query performance - **security** — Fix IDOR vulnerabilities in listening sessions, media progress, and bookmark endpoints - **fixed** — Server crash filtering by decade with collapsed series - **fixed** — Server crash on /me/progress/:libraryItemId/:episodeId? when episodeId is not passed in for a podcast library item - **fixed** — Updating author name merging with same name authors in a different library - **fixed** — Home page check current user from socket event when updating hide from continue listening - **fixed** — Match tab click to use current value incorrect title attribute - **fixed** — Aria-label for jump backward button - **changed** — Improved personalized shelves performance by parallelizing shelf queries and reducing search payload size - **changed** — Improved API cache invalidation for high-churn models such as sessions and media progress - **changed** — Improved subtitle parsing to account for bare colon in title - **changed** — Sanitize session DeviceInfo clientDeviceInfo fields - **changed** — Sanitize server settings authLoginCustomMessage on save and load - **changed** — Display localized and styled text for selected filter ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Added - Slovak language option by @belpe in #5077 - Belarusian language option by @pavel-miniutka in #5071 - Database indexes for discover query performance by @kevingatera in #5073 ###### Fixed - IDOR vulnerabilities in listening sessions, media progress, and bookmark endpoints #5062 by @mandreko in #5063 - Server crash filtering by decade with collapsed series - Server crash on `/me/progress/:libraryItemId/:episodeId?` when episodeId is not passed in for a podcast library item #5058 - Updating author name merging with same name authors in a different library #4628 - Home page check current user from socket event when updating hide from continue listening - UI/UX: Match tab "click to use current value" incorrect title attribute - UI/UX: Aria-label for jump backward button by @KiwiHour in #4973 ###### Changed - Improved personalized shelves performance by parallelizing shelf queries and reducing search payload size by @kevingatera in #5073 - Improved API cache invalidation for high-churn models (sessions, media progress) by @kevingatera in #5073 - Improved subtitle parsing to account for bare colon in title by @kctdfh in #5036 - Sanitize session DeviceInfo `clientDeviceInfo` fields - Sanitize server settings `authLoginCustomMessage` on save and load - Fix OpenAPI spec description by @openam in #5042 - UI/UX: Display localized/styled text for selected filter by @sir-wilhelm in #4952 - More strings translated - Belarusian by @pavel-miniutka - Catalan by @enboig - Chinese (Simplified Han script) by @FiendFEARing - Czech by @Plazec - Danish by @xxzp3 - French by @dapitch666 - German by @ShaikaJar @Maxklos @B0rax - Greek by @lambolighting - Hebrew by @enosh - Hungarian by @Kabika82 @ugyes - Japanese by @litoma - Lithuanian by @mantas3 - Norwegian Bokmål by @Torstein-Eide @soteland - Polish by @Jarsey45 - Portuguese (Brazil) by @lribeiro - Romanian by @hac3ru - Slovak by @goozi12345 @pecer - Slovenian by @thehijacker - Swedish by @Cotignac @karlbe ##### New Contributors * @KiwiHour made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4973 * @openam made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5042 * @belpe made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5077 * @pavel-miniutka made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5071 * @kctdfh made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5036 * @mandreko made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5063 * @kevingatera made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5073 **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.32.1...v2.33.0 ### v2.32.1 - Date: 2025-12-23 - Version: v2.32.1 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.32.1 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.32.1 - **fixed** — Server crash matching with Audible provider ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Fixed - Server crash matching with Audible provider #4931 ###### Updated - More strings translated - Finnish by @pHamala - Polish by @MarcinKlejna - Russian by @renesat - Swedish by @bittin **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.32.0...v2.32.1 ### v2.32.0 - Date: 2025-12-21 - Version: v2.32.0 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.32.0 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.32.0 - **fixed** — Bulk matching books with multiple of the same new author now applies author to all books instead of only one - **fixed** — Debian package upgrades failing due to user "audiobookshelf" already exists - **fixed** — Multi-select inputs allowing duplicate new items - **fixed** — Audible and custom metadata providers allowing duplicate genres and tags - **changed** — API metadata match results now return tags as an array of strings instead of a comma separated string - **changed** — Playlists are sorted alphabetically in playlist modal ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Fixed - Bulk matching books with multiple of the same new author only applies author to one book by @TN-SKYC in #4766 - Debian package upgrades failing due to user "audiobookshelf" already exists #1617 by @Yetangitu in #4740 - Multi-select inputs allowing duplicate new items by @votex001 in #4649 - Audible & custom metadata providers allowing duplicate genres & tags #4634 (in #4927) ###### Updated - API: Metadata match results return tags as an array of strings instead of a comma separated string (in #4927) - Playlists are sorted alphabetically in playlist modal by @sir-wilhelm in #4906 - More strings translated - Arabic by @kfctatertot - Bulgarian by @lembata - Chinese (Simplified Han script) by @FiendFEARing - Finnish by @Napitauki @pHamala - German by @JBlond - Greek by @lambolighting - Hebrew by @mnavon - Italian by @66Bunz - Korean by @zardkim - Polish by @ahetek - Portuguese (Brazil) by @ljaksys - Slovenian by @thehijacker - Spanish by @kfctatertot @xlbrto ##### New Contributors * @TN-SKYC made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4766 * @votex001 made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4649 **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.31.0...v2.32.0 ### v2.31.0 - Date: 2025-12-01 - Version: v2.31.0 - Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.31.0 - Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.31.0 - **added** — Turkish and Korean language options - **fixed** — Chapter editor play button is still shown next to chapters with invalid start times - **fixed** — Switching users does not refresh available libraries - **fixed** — Admin users unable to close sessions for other users - **fixed** — Custom metadata providers not showing in library edit modal - **fixed** — HLS transcoding fails for AC3/EAC3 codecs - **fixed** — Next/prev buttons not shown on item edit modal when opened using Files or Match context menu item - **changed** — Increase default access token expiration to 1 hour and refresh token expiration to 30 days - **changed** — Enable OIDC auth auto redirect via query parameter ?autoLaunch=1 on login page - **changed** — Improve podcast RSS feed parser to handle feeds not wrapping html in CDATA - **changed** — Update Days in a row stat to not require today - **changed** — Improve error handling for file system ensureDir - **changed** — Rephrase library watcher setting to Automatically watch - **changed** — Uploader shows progress indicator - **added** — New GET /search/providers endpoint to fetch all metadata providers ###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details. ###### Added - Turkish & Korean language option ###### Fixed - Chapter editor: Play button is still shown next to chapters with invalid start times #4691 - Switching users does not refresh available libraries #4694 - Admin users unable to close sessions for other users #4746 - Custom metadata providers not showing in library edit modal #3820 by @mikiher in #4750 - HLS transcoding fails for AC3/EAC3 codecs #4798 by @Vito0912 in #4808 - UI/UX: Next/prev buttons not shown on item edit modal when opened using "Files" or "Match" context menu item #4718 ###### Changed - Increase default access & refresh token expirations. Refresh now 30 days & Access now 1 hour by @Vito0912 in #4756 - Enable OIDC auth auto redirect via query parameter `?autoLaunch=1` on login page by @Yetangitu in #4737 - Improve podcast RSS feed parser to handle feeds not wrapping html in `CDATA` #4757 - Update "Days in a row" stat to not require today by @jamerst in #4770 - Improved error handling for file system ensureDir by @mikiher in #4881 - UI/UX: Rephrase library watcher setting to "Automatically watch ..." #4095 by @mikiher in #4815 - UI/UX: Uploader shows progress indicator #895 by @Vito0912 in #4702 - API: New GET `/search/providers` endpoint to fetch all metadata providers by @mikiher in #4750 - More strings translated - Catalan by @celigabon - Chinese (Simplified Han script) by @FiendFEARing - Croatian by @biuklija @milotype - Czech by @Plazec @zendiik - Danish by @Andersborrits - Estonian by @alehandro112 - Finnish by @pHamala @phewi - French by @dapitch666 - German by @Blubberland @schoenfeldj @Vito0912 @B0rax - Hungarian by @ljaksys @ugyes - Italian by @burghy86 - Korean by @zardkim - Lithuanian by @waipit - Polish by @pryszczoskor - Portuguese (Brazil) by @pmangro @nlqog @ljaksys - Romanian by @dinuzauri - Russian by @renesat - Slovenian by @thehijacker - Swedish by @3nm1 @Cotignac - Ukrainian by @maksim2005UKR ##### New Contributors * @Yetangitu made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4737 * @jamerst made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4770 **Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.30.0...v2.31.0