Calibre-Web

!Attention! For this update nh3 has to be installed !Attention!

New features:

• MOBI files now support metadata extraction on upload
• Reverse proxy login with shared secret header implemented

Bug Fixes:

• Cover path is now selected based on the correct setting instead of the presence of split_path (#3527)
• Title sort with "l'" now works correctly in French
• Exclamation marks removed from HTML strings
• Kobo sync behind reverse proxy now works correctly: library_sync URL is rewritten in init response
• Add-to-shelves dropdown menu now renders correctly
• Kobo "Sync to last page read" popup no longer appears repeatedly due to float/int mismatch
• Kobo "Return to last page read" popup when ProgressPercent is 0 now handled correctly
• Kobo PUT /state response now includes PriorityTimestamp
• Downloaded filenames now use native UTF-8 encoding for browsers that support it
• Series list view now sorts by the correct sort field, preventing incorrect article-inclusive sorting (#3583)
• natsort is now used for comic cover page detection when available
• Login failure now returns HTTP 401
• Registration and password reset emails are now sent in the recipient's language
• Crash when User-Agent header is missing is now fixed
• Infinite scroll now triggers correctly on mobile browsers (#3664)
• Case-insensitive duplicate tags are no longer created
• UNIQUE constraint crash on transliteration-identical authors is now fixed (#3403, #3170)
• Caliblur eReader toolbar dropdown overflow is now fixed
• Unauthenticated OPDS requests no longer cause an AttributeError (#3592)
• Metadata search no longer crashes when ComicVine or Douban return no results (#3606)
• Kobo API results are now correctly filtered
• kepubify path is now properly cleared when removed
• OPDS atom:updated now reflects the last modification date instead of date added
• Staged temporary download files are now cleaned up after the response is sent
• Cover sibling files are no longer created on every book download (--dont-save-cover)
• lubimyczytać.pl metadata provider is now working correctly
• Error handling for series display and book/user table sorting is now improved
• Book conversion format validation now works correctly with HTML-based formats
• Circular import issue in format conversion is now fixed
• File upload temp folder is now instance-specific
• Reverse proxy login now shows user warning when enabled
• Rate limiter reset for reverse proxy header login is now deactivated
• Reverse proxy login now restricts IP addresses and uses shared secret header
• Dialog size of Server side file picker is now limited
• Search metadata provider selection has been improved
• GDrive file type condition error is now fixed
• OPDS error handling for unauthenticated requests is improved

** Security **

• XSS payload in book comments imported via Calibre is now sanitized before display (reported by @Nozomu Sasaki)
• External binary names (e.g. unrar) are now restricted to prevent remote command execution (CVE-2025-7404)
• ReDoS vulnerability in whitespace stripping is now fixed (CVE-2025-6998)
• Stored XSS via author names in author.html is now prevented
• Magic link login flow is now hardened against misuse
• SQL injection via the database path parameter is now prevented
• LDAP injection in bind_user / get_object_details is now prevented
• XXE injection in EPUB, FB2 and Goodreads API parsing is now prevented
• IDOR in Kobo tokens is now fixed
• OAuth account relinking by unauthorized users is now prevented
• Shelf editing is now restricted to users with appropriate permissions
• Unauthorized access to book files via /show/ is now prevented
• Server credentials are no longer exposed in debug output
• Encryption key file now has restrictive file permissions (0o600)
• CSP nonce entropy increased from 32 to 128 bits
• SQL comment column names are now properly escaped
• A Format check during conversion is now performed
• Whitespace stripping performance is improved
• Non-admin users no longer see full stack traces on HTTP 500 errors
• Bleach library replaced with nh3 for improved security and performance
• Python 3.14 compatibility with lxml v6
• Comments are now cleaned/sanitized to prevent injection attacks

New features:

• Enabled multi-edit of books in the book list
• Added Instapaper configuration to Kobo sync
• Renamed Google Books Metadata provider
• Renamed environment variable CACHE_DIR to CACHE_DIRECTORY
• Improved performance during certain search operations (#3476)
• Added Books button to EPUB reader to return to Calibre-Web
• Added page count display in EPUB reader (e.g. 1/1234 locations)

• Added an additional EPUB reader theme

Bug Fixes:

• Fixed compatibility with Calibre 9
• Added certifi to requirements on macOS (fixes #3385)
• Fixed read status not updating when a book is archived and a custom column is used
• Fixed Caliblur theme display issues
• Added missing texts to the Caliblur theme
• Fixed language icon in Caliblur theme
• Fixed issue where the console remains open when started on Windows via console, allowing Calibre-Web to be stopped even after an in-app restart
• Fixed inability to download books from Calibre-Web OPDS in Readest 0.9.95 (iOS & macOS)
• Replaced archive icon with an open folder instead of a trashcan
• Fixed exclusion of shelves in advanced search
• Fixed support for route kobo/auth/refresh
• Fixed public registration not applying default allowed/denied tags to new users (#3522)
• Removed invalid sort_param GET parameter (#3447)
• Generated valid session cookie paths (fixes #3459)
• Fixed mass removal of books from shelves (#3520)

** Security **

• Prevented exposure of sensitive information in config_sql.py — API keys are no longer exported.

New features:

• Improved error handling for invalid libraries
• Enhanced dependency check and stability for the Windows EXE version
• Added binary paths support for FreeBSD
• Updated Kobo links to support "reading_service_host"
• Added tag to OPDS feed
• EPUB Reader now supports the Kepub format
• Added bulk functions: delete, archive, and mark as read in the book table
• Added Storygraph to identifier links
• Lazy loading of cover images implemented
• Added smashwords.com and ebooks.com to recognized identifiers
• Improved error handling for invalid recipient addresses in emails
• Improved generation of unique identifiers for sending emails to readers
• Logged activities now include IP addresses
• Logger output improved: file name is logged instead of responsible logger
• Modal dialog in EPUB reader can now be closed on smartphones
• Added Arabic translation
• Official Support for python 3.12

Bug Fixes:

• Version detection now works with SQLAlchemy 2.0.36.dev0 (Arch Linux)
• Fixed error 500 when uploading metadata with non-numeric series_index (#3230)
• Invisible books are no longer counted in the archived page (#3221)
• Covers and metadata are now displayed correctly when sharing a public book via WhatsApp (and other Open Graph-enabled apps)
• Amazon identifiers beside amazon_uk are now correctly converted
• Fixed layout of identifiers on the book edit page when starting with none
• Connection handling to metadata.db is now request-based, solving upload issues with multiple files at once
• Fixed typo in security settings
• Updated MIME type handling: distinct MIME types are used for download vs. upload validation (#3245, #3243)
• Permission errors when generating new folders during author rename are now handled correctly (#3261)
• Upload of AZW, MOBI, and RTF files works again (#3263)
• Fixed issue where uploaded cover images appeared too dark (#3275)
• PDF Viewer now loads correctly on Windows (MIME type issue fixed) (#3277)
• Kindle browser downloads now handle ASCII-only filenames correctly (#3266)
• Improved error handling when proxying Kobo requests (#3334)
• Fixed Kobo sync failure when “Synchronize Notebooks” was enabled
• Locale and language names are now sorted alphabetically; duplicate “English” entry removed
• Improved error output for empty author sort values
• Unhandled errors in background tasks are now logged
• UI improvements for Caliblur theme on the book edit page
• Correct check of DjVu MIME type implemented
• Fixed issue with Overdrive where returning borrowed books partially failed (#3398)
• Fixed 403 error when accessing /ajax/updateThumbnails from a session authenticated by reverse proxy

New features:

• Extract metadata of audiofiles during upload (mp3, opus, ogg, ogv, aac, ac3, aiff, asf, flac, m4a, m4b)
• Updated Pdf Viewer (pdf.js)
• Upload (multiple) book formats with progress and merge the corresponding metadata into the book on book edit page (also via drag'n drop #2252)
• Add cookie prefix environment variable to config to enable storing user credentials for multiple indstances on one server
• Implementation of sorting according to shelf added (#3003)
• Improved contrast for epub reader headline in dark modes (#3145)
• Enable python3.12 compatability (Migrate from iso639)
• Integrate the advocate project to simlify installations on newer python version (>3.9) on windows
• Set number of decimals of series_index shown everywhere to 2 digits
• Changed response code to opds download forbidden to 401 instead of 404 for opds downloads (improves anonymous browsing with guest has no download permission)
• libmagic binary files are now installed automatically on windows to simplify installation on windows

Bug Fixes:

• Changed formating of float values. If value ends not with "0" tailing "0" are printed
• Fix for Kobo browser not downloading kepub files (#2990)
• Fix for cover size during kobo sync (#2523)
• Improved whitespace removal at start and end of strings for "unicode whitespaces"
• Shelf sort algorithm is now saved
• Music icon is now only visible once if more than one audio format available
• Fix for only last e-mail address is saved when specifying multiple e-reader mail addresses in user settings (#3130)
• Fix to generate thumbnails on gdrive
• Fix for metadata search results with amazon and google returning nothing
• Fix invalid database can not be saved for split library (#3131)
• Fix for Invalid cross-device link error during upload on very very(?) special drive configuration
• Fix Invalid amazon link for uk amazon store (#3151)
• Fix bookmarks button for safari browser (#3178)
• Fix Embedding metadata during convert not working on windows
• Fix Calibre convert parameters with spaces are not working (#3189)
• Import LDAP users from Microsoft Active Directory with special characters like "," and "[" is now working (#3186)
• Display error message if visiblity resticting custom column is not available and delete custom column related values on database change (#3190)

!Attention! For this update http-Auth has to be installed !Attention!

New features:

• Epub reader themes stored locally
• Added font size switch to Epub reader
• Allow sending to multiple kindle emails at once
• Update redirect for login/logout in case of anonymous browsing enabled to keep last visible page active
• Log Forwarded for address in accesslog instead of client address for gevent
• Error message for faild tasks is displayed in UI
• Search for custom int and float values within ranges (#3109)

Bug Fixes:

• Update to make upload of m4a and m4b files work (#3102)

• Fixed error during debug logging on upload

• Better error message on failed convert because of running calibre instance (#3100)

• Updated pdf.js

• Schedules reconnect is now working even if reconnect route is not available ( #3107)

• Bugfix upload format with language to book without language

• Fix wrong quotes on calibre binary call for windows during embed metada on download/email etc.

• Fix csp Header for reader and google drive (#3108)

• Fixed read status search with linked column in advanced search

• Fix back function on simple search

• Fix archiving books from calibre-web side

• Security Fix: Cookies are no longer stored for opds basic authentication and proxy authentication

!Attention! For this update regex, bleach and python-magic has to be installed !Attention!

New features:

• lubimyczytac metadata fetches now the right tags section
• OPDS catalog now only shows categories which are also visible in the normal User interface
• PRC is added as source for book conversion
• Added option for read status "Any" in Advanced Searching
• Metadata Backup is supported now
• Metadata changes can be applied during downloading and sending books
• Splited library locations are supported
• In all categories a category "No category applied (None) is visible

Bug Fixes:

• CB7 metadata extraction working with newer version of py7zr

• douban metadata fetching is working again

• Improved Content Security Policy header

• Improvements for Caliblur! Dark Theme

• It's now possible to reset Kobo sync for other users

• Improved parsing of book content on upload to prevent crashes

• refactored author renaming issue to prevent Oops Database corrupt messages

• Fix on Windows that prevents starting calibre-web

• Ä Ö Ü re now counting as uppercase letters for Passwords

• Fix for Text reader to handle invalid mulitbyte sequence (mainly for CJK-Languaes)

• Fix for _internal folder showing up using windows installer version

• Security fix: File upload mimetype is checked to prevent malicious file content in the books library

• Security fix: Cross-site scripting (XSS) stored in comments section is prevented better (switching from lxml to bleach for sanitizing strings)

New features:

• cb7 files are now supported for metadata extrcation of comicfiles (but not for comicreader)
• Updated lubimyczytac metadata provider
• Cover size is adapted to requested size from kobo
• Added option "-o" to define logfile via command line
• Added "/opds/stats" route to generate a widget
• Reading position can be saved in comic reader
• Several dependencies are upgraded to newer versions
• Additional translations: portuguese

Bug Fixes:

• Fix for proxying cover images to Kobo store

• Fix for 'NoneType' object has no attribute 'author_sort' while trying to read a book

• Added djv file format as default to djvu reader

• Home button in caliblur is now leading calibre-web home instead of "/"

• Bugfix for logfile viewer behind proxy located in a folder

• Bug

• Fixes for special cases during parsing of pdf metadata during upload

• Fixes to work with new version of comicapi

• Fix for upper- lowercase change of non ascii values in series, tags, ...

• Fix for search request fails with error after browser session closed

• Remove autocomplete on several elements in edi book section to make typeahead work without problems

• Bugfix rename author in book list

• Fix creating shelves on mobile device with caliblur theme

• Fix visibility for sending to reader without download permissions

• Handle invalid or missing or invalid container.xml in epub files during kobo sync

• Fixes Uploading pdf file fails with whitespace title

• Fix for Kobo UserKey in request missing due to no kobo account

• Fix for showing last book of series in grid view

• Bugfix for showing series containing only one book in list view having this book no series_index value set

• Added additional debug output for download links during kobo sync

• Security fix: SMTP server credentials are no longer returned to client

• Security fix: Cross-site scripting (XSS) stored in href bypasses filter using data wrapper no longer possible

• Security fix: Cross-site scripting (XSS) is no longer possible via pathchooser

• Security fix: Error Handling at non existent rating, language, and user downloaded books was fixed

!Attention! For this update flask-limiter has to be installed !Attention!

New features:

• Updated pdf reader
• Improvements for Caliblur Theme
• series type custom column are enable
• Allow schedules backup of metadata (metadata.opf files)
• Make drive letters available in file picker for windows
• Show additional book info one mp3 listening page
• Detect and respect google site verification environment variable
• Added "databazeknih" to supported identifier links
• Improved parsing of pdf files for metadata extraction
• Enabled additional reverse proxy authentication for opds feeds
• Show all authors in opds feed
• Comic can now be read in long stripped mode
• pdf files are now loading chunked in reader
• Enable debug output for ldap login
• Additional translations: galician, indonesian, norwegian

Bug Fixes:

• Allow deletion of kindle email address and force email addresses to have a valid format
• Fix for big databases not showing tags
• Ignore special files originating from Apple devices in comic reader
• Kobosync show right book languages on kobo
• Catch an additional database error on edit book
• Fix to respect default locale from user template
• Show right path to kobo config file
• Fix to save mp3 listening position
• Fix for metadata provider douban
• Fix for size of downloaded metadata covers from google
• Fix for loading metadata from google with old books (publishing date only year)
• Fix for error: TypeError: 'NoneType' object is not iterable from amazon
• Fix for epubs with identifiers without identifier-name
• Fix send to eReader is now working for guest user
• Fix on stop stop scheduler
• Fix for infinite creation of subprocesses on restart
• Fix for koboreader to detect fixed layout
• Fix to handle case that cover size is already smaller than thumbnail size for thumbnail generation
• Fix strip scheme from ldap server name to prevent error 'int' is not iterable
• Fix for python3.11 to prevent table gdrive_ids2 already exists
• Security fix: credentials for emails are now stored encrypted
• Security fix: Login is rate limited
• Security fix: Passwordstrength can be forced

New features:

• Cover images are cached when using gdrive storage and local storage
• Kobo sync now uses calibre-web generated thumbnails as cover pictures
• Pagination button disapear in standard theme once infinite scroll is triggered
• Added "None" to list of file formats, tags, series, languages
• Extract publishing date, identifier from epubs after upload
• Added basic themes to epub reader
• Allow "@" in imported ldap usernames
• Allow sending epub files to amazon kindle

Bug Fixes:

• Read status checkbox works again for custom columns
• Character '\u200d' is removed from end of email address and no longer causes an error on send emails
• Gevent log output is redirected to log file and no longer stops Calibre-web on Windows
• custom column of type "Text, but with a fixed set of permitted values" with default color no longer leads to error 500
• Permission problems while accessing the robots file are now handled better
• Fix for missing "query" entry in flask_session
• Handle empty response from lubimyczytac metadata provider
• Fix cover upload url with spaces at the end
• Support image/jpg as upload format
• Prevent "none" comment from uploaded pdf documents
• Prevent converting of kepubs on every new user

New features:

• Enabled search for text based custom column content in simple search

Bug Fixes:

• Bugfix errors for load metadata from amazon are now properly handled
• Errors with readonly library are handled better
• Bigfix author sort order differs from authors order with readonly database
• Improved cover extraction for epub files, better epub cover parsing with multiple cover-image items
• Undo check of read checkbox in case of error
• Display error message in details modal dialog instead of putting it to the hidden UI
• Bugfix set archive bit in booktable
• Added environment variables for reconnect
• Catch additional error on not existing custom column linked to read column
• Prevent metadata changes are lost on edit books with errors
• Bugfix remember sort order of series and authors if entered from link below book cover
• Bugfix gmail.json location
• Series Link in series view no longer clickable
• import error on python <3.7 dataclasses solved
• Deactivated several functions for kindle, tolino, bookeen and kobo e reader. Opening books now working for ebook readers
• Bugfix show covers from goodreads
• Bugfix for advanced search with linked read column and read column having a higher number than number of available custom columns
• Bugfix for plus ("+" vs. "%2B") encoded search strings in opds search feeds are now working
• Bugfix logging with gdrive
• Bugfix database locked in combination with gevent

Security fix: Prevent possible SQL Injection in user table Thanks to Iman Sharafaldin (Forward Security) Security fix: SSRF protection no longer can be bypassed by IPV6/IPV4 embedding. Thanks to @416e6e61 Security fix: SSRF protection no longer can be bypassed to connect to other servers in the local network. Thanks to @michaellrowley