v2.5.9

Highlights

• "Sign in with Google" (and other OIDC/SSO providers) now works inside the Jellyfin mobile apps. Previously the in-app browser was rejected by Google with 403: disallowed_useragent and dead-ended on the server screen. Sign-in now opens cleanly in your device's browser and returns you straight into the app — no codes to copy, and 2FA bypass (when enabled for the provider) is preserved. (Fixes #64.)

Security

• A broad internal security-hardening pass across the authentication, OIDC/SSO, step-up, device-bypass, and rate-limiting paths. No configuration changes or action required on upgrade.

Fixes & hardening

• The injected login script is served in a CDN/proxy-safe way so reverse-proxy and Cloudflare-style edge caches no longer pin a stale copy after an upgrade.
• GeoIP database path handling is now consistent across all lookups.
• Assorted reliability and resource-bounding improvements to in-memory sign-in state.

Upgrade

Drop-in from any 2.5.x — no config or data migration. Sigstore-signed + SLSA build-provenance attested. 254/254 tests pass on .NET 9 / Jellyfin 10.11.x.