# Audiobookshelf v2.36.0

- Product: Audiobookshelf (https://whatsnew.fyi/product/audiobookshelf)
- Vendor: advplyr
- Date: 2026-07-27
- Version: v2.36.0
- Original notes: https://github.com/advplyr/audiobookshelf/releases/tag/v2.36.0
- Permalink: https://whatsnew.fyi/product/audiobookshelf/releases/v2.36.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Logout all devices button on account page
- **added** — Auth sessions table on account page with ability to logout of individual sessions
- **fixed** — Weak protocol validation for OIDC post-login callback URL
- **fixed** — User delete endpoint allowing for root account deletion
- **fixed** — API and websocket authentication allowing refresh tokens
- **fixed** — Bulk library item download endpoint not checking access on individual items
- **fixed** — Manual podcast episode match not setting the enclosure url
- **changed** — Changing user password invalidates all auth sessions
- **changed** — Extend refresh token grace period to 10 minutes and allow REFRESH_TOKEN_GRACE_PERIOD env variable override
- **added** — API: New GET endpoints /api/me/progress, /api/me/bookmarks, /api/me/bookmarks/:libraryItemId
- **changed** — API: Add all minified fields to expanded library item JSON
- **changed** — API: Server settings now include timeZone for server timezone
- **changed** — API: /logout endpoint now supports ?allDevices=1 query param to delete all other sessions and rotate current
- **added** — API: New endpoint GET /api/me/sessions to get all auth sessions
- **added** — API: New endpoint DELETE /api/me/sessions/:id to delete an auth session
- **added** — New socket event authors_num_books_updated is emitted during a scan when author book count changes
- **added** — Socket event author_added is now emitted during scans
- **changed** — Update outdated help links for new docs site

###### Important: New authentication system was added in [v2.26.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.26.0). See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

###### Added

- Logout all devices button on account page (in #5395)
- Auth sessions table on account page w/ ability to logout of individual sessions (in #5400)

###### Fixed

- Weak protocol validation for OIDC post-login callback URL by @mikiher in #5386
- User delete endpoint allowing for root account deletion by @mikiher in #5370
- API and websocket authentication allowing refresh tokens by @mikiher in #5387
- Bulk library item download endpoint not checking access on individual items by @mikiher in #5388
- Manual podcast episode match not setting the enclosure url #5317 by @mikiher in #5318

###### Updated

- Changing user password invalidates all auth sessions (in #5393)
- Extend refresh token grace period to 10 minutes and allow `REFRESH_TOKEN_GRACE_PERIOD` env variable override #5281 by @DanielAshley in #5376
- API: New GET endpoints `/api/me/progress`, `/api/me/bookmarks`, `/api/me/bookmarks/:libraryItemId` by @Vito0912 in #5363
- API: Add all minified fields to expanded library item JSON by @mikiher in #5341
- API: Server settings now include `timeZone` for server timezone (for giving accurate cron job next schedule date)
- API: `/logout` endpoint now supports `?allDevices=1` query param to delete all other sessions and rotate current (in #5395)
- API: New endpoint GET `/api/me/sessions` to get all auth sessions (in #5400 and #5405)
- API: New endpoint DELETE `/api/me/sessions/:id` to delete an auth session (in #5405)
- New socket event `authors_num_books_updated` is emitted during a scan when author book count changes by @mikiher in #5354
- Socket event `author_added` is now emitted during scans by @mikiher in #5354
- UI/UX: Update outdated help links for new docs site by @francisrath in #5336
- More strings translated
  - Chinese (Simplified Han script) by @FiendFEARing
  - Danish by @MikkelOlesen @hhjuhl
  - Greek by @no1ta
  - Icelandic by @axelbjornsson
  - Portuguese (Brazil) by @AgenteGabrielofc
  - Tamil by @TamilNeram

###### Internal

- Read AllowedDevOrigins from dev.js into ALLOWED_DEV_ORIGINS env var by @mikiher in #5291
- Setup internal-api file upload passthrough for next.js by @mikiher in #5325
- Readme update about frontend rewrite by @nichwall in #5407

##### New Contributors
* @DanielAshley made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5376
* @francisrath made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5336

**Full Changelog**: https://github.com/advplyr/audiobookshelf/compare/v2.35.1...v2.36.0