v2.6.4

A larger follow-up to v2.6.3 built almost entirely from contributor PRs: app passwords get safer and work for SSO and passkey accounts, admins can be alerted by email or Telegram, the setup page fits SSO-only users, and the dependency pins that held since the spring are finally lifted after live re-verification. Drop-in from any 2.5.x or 2.6.x, with no config or data migration.

App passwords

• An app password no longer signs in to the Jellyfin web interface (#249, by @camarigor; #244). App passwords are for native apps; accepting one in a browser session defeats the point. A native client (Symfonium, Findroid, Seerr, and the like) still uses them exactly as before.
• SSO and passkey accounts can create app passwords (#252/#248, by @camarigor). Accounts that sign in through an identity provider or with a passkey, and so have no TOTP, were stuck with no way to make an app password for a native client. A linked provider (or a passkey) now satisfies the step-up that creating one requires.

Sign-in and setup

• Hide the plugin's 2FA setup from SSO users (#250/#247, by @camarigor). An opt-in admin setting: a non-admin who signs in through a linked provider sees that the provider handles sign-in instead of the plugin's own TOTP/passkey enrolment. Administrators keep the full page.
• A clearer authenticator rotation flow (#255/#254, by @camarigor). The setup page shows the rotate card, and your old authenticator keeps working until the new one is confirmed.
• OIDC errors tell a refused sign-in apart from an expired code (#234/#64, by @camarigor).
• The login page works behind an access proxy (#253/#251, by @camarigor): the plugin's own requests now carry the page's cookies.
• The admin Users tab saves an edited email reliably through the step-up prompt (#264/#263, by @camarigor).

Notifications and detection

• Admin alert emails, and Telegram as a channel (#261/#259, by @camarigor). Security events (suspicious sign-in, emergency lockout) can now notify admins by email or Telegram.
• Turn suspicious-login detection off (#260/#258, by @camarigor), and leave impossible-travel out of the security score when geo checks run elsewhere.

Correctness

• Sign-in no longer saves a stale copy of the user record (#257/#256, by @camarigor), which could drop a concurrent change made during sign-in.

Dependencies

• The QuestPDF and IdentityModel pins are lifted (#262, by @camarigor). Microsoft.IdentityModel.Tokens / System.IdentityModel.Tokens.Jwt move to 8.23.0 and QuestPDF to 2026.9.1, after re-verifying a live OIDC sign-in and the recovery-code PDF on both the 10.11 and 12 builds. The spring OIDC regression turned out to be a missing bundled assembly, shipped since v2.6.2, not the library. Fido2 moves to 4.2.0 and MailKit to 4.18.1. The Jellyfin runtime references stay pinned.

Upgrade notes

In-place upgrade from any 2.5.x or 2.6.x, with no schema or configuration migration. Both the 10.11 (.NET 9) and 12 (.NET 10) packages are published and your server selects the right one automatically. Sigstore-signed and SLSA build-provenance attested.