v2.6.2

A follow-up to v2.6.1 that finishes the Jellyfin 12 sign-in story: TVs and other keyboard-less devices can complete OIDC sign-in, the links the plugin hands to an identity provider or a phone now carry the right public address, the GeoIP alerts the README promised are actually raised, and the Seerr / Jellyseerr sign-in guidance is corrected. Drop-in from any 2.5.x, 2.6.0 or 2.6.1, with no config or data migration.

OIDC sign-in works on a TV, and links use the right host

(Fixes #216, by @camarigor.)

A smart TV cannot open a browser and has no keyboard, so both ways out of the OIDC sign-in prompt were dead ends there. Two changes fix it:

• A scannable QR. The sign-in prompt now shows a QR of the same authorize URL, so the consent can be finished on a phone while the TV keeps polling. It is a device flow already, so nothing about the security model changes, and a client that ignores the QR behaves exactly as before.
• The correct public address. The OIDC redirect_uri, the pairing QR, and the password-reset email link were all derived from the incoming request, which is wrong for a client that reaches Jellyfin directly on the LAN with no proxy in the path. A new Public base URL setting (and, when it is empty, Jellyfin's own published server URI) now supplies the outside address. Left empty with no published URI, behaviour is unchanged. The value comes only from admin configuration, never from a request header.

Optionally, a device that finished sign-in by a second-screen approval can be remembered (new opt-in setting, off by default). It only waives 2FA on later logins if the existing bare-device-id bypass is also enabled, so it feeds an existing opt-in path rather than creating a new one, and the paired device is visible and revocable.

GeoIP suspicious-login and impossible-travel alerts actually fire

(Fixes #215, by @camarigor.)

Both detectors shipped fully implemented but nothing ever called them, so the databases loaded, diagnostics looked healthy, and no alert was ever raised. A single observer now hands every completed sign-in to both detectors, as fire-and-forget work that can never delay or fail a sign-in, and a new diagnostics check confirms sign-ins are reaching them. The audit records for a sign-in behind a trusted proxy now also record the proxy-resolved client address, not the proxy's.

Clearer Seerr / Jellyseerr guidance

(Addresses #228.)

Signing in to Seerr or Jellyseerr with a Jellyfin username and password is a password sign-in for that account, so an account with TOTP or a passkey correctly gets a 2FA challenge the app cannot answer. The README now says so and points to app passwords or Quick Connect, corrects the device-pairing guidance, and warns against widening the trusted-proxy list to Seerr's address.

Under the hood

Fido2 updated to 4.1.0 (with the RPID / RPName rename), plus routine test-tooling bumps. The QuestPDF and IdentityModel pins are deliberately held.

Upgrade notes

In-place upgrade from any 2.5.x, 2.6.0 or 2.6.1, with no schema or configuration migration. Both the 10.11 (.NET 9) and 12 (.NET 10) packages are published for this version and your server selects the right one automatically. Sigstore-signed and SLSA build-provenance attested.