v2.6.1
A focused fix release on top of v2.6.0: OIDC sign-in now hands off to the 2FA prompt correctly when a user has both SSO and plugin TOTP, and a native-library crash that could core-dump the whole Jellyfin process is gone. Drop-in from any 2.5.x or 2.6.0, with no config or data migration.
OIDC sign-in reaches the 2FA prompt instead of erroring
If a user signed in with OIDC/SSO and also had plugin TOTP enabled, the sign-in stopped on the callback page with "Sign-in could not be completed. Error: HTTP 401". That 401 was actually the expected TwoFactorRequired response with a challenge token, but the bridge page treated any 401 as a terminal failure and never opened the TOTP page.
Both sign-in bridges (the browser callback and the in-app webview) now recognise a TwoFactorRequired response and continue to the existing 2FA challenge, then complete sign-in once the code is accepted. A wrong code is still rejected, an ordinary 401 is still an authentication failure, and credentials are not stored before the second factor is completed. The challenge redirect is built from the server's own base path, never from anything in the response.
No more libsodium core dumps
(Fixes #203, reported by @bluej007.)
On some hosts (seen on the linuxserver.io image on Jellyfin 12) the Jellyfin process could randomly core-dump while browsing the dashboard, with the crash inside the dynamic linker loading libsodium.so.
The cause was the recovery-code PDF service eagerly loading libsodium.so as if it were a QuestPDF dependency. It is not: libsodium belongs to the passkey code (NSec), and loading it late from the PDF path meant even servers that never use passkeys pulled it in, where a late load of that library can crash glibc's loader outright. The PDF service now loads only its real native dependencies; libsodium is loaded on demand only when a passkey is actually used, so passkeys are unaffected and everyone else stops crashing.
Upgrade notes
In-place upgrade from any 2.5.x or 2.6.0, with no schema or configuration migration. Both the 10.11 (.NET 9) and 12 (.NET 10) packages are published for this version and your server selects the right one automatically. Sigstore-signed and SLSA build-provenance attested.