grimmory-tools/grimmory v3.5.0 on GitHub

3.5.0 (2026-09-20)

This minor release primarily fixes three identified security issues in Grimmory:

The /api/v1/settings endpoint allowed any user to access sensitive server settings. (GHSA-x6vg-344c-qrmv)
The upload feature did not restrict users to only uploading into libraries they had access to. (GHSA-7f4w-5hc7-j96r)
An appropriately crafted epub could have lead to CPU / web server request thread exhaustion. (GHSA-mx77-3cq4-g227)

Full Changelog: v3.4.1...v3.5.0

api: add library access check to uploads (#2648) (2d7a3e9)
api: restrict settings by permission (#2647) (2b66ca6)
api: exclude supplementary files from file type facet (#2688) (e1d1c35)
api: include physical books in file type facet (#2687) (765a340)
audiobook: sum folder track durations (#2684) (bb44ce3)
opds: update opds references to be grimmory (#2659) (5986e36)
progress: reset koreader device when coming from grimmory (#2640) (a04652d)
ranobedb: use expected grimmory user agent (#2662) (2dbac19)
readers: fix mobile text selection (#2667) (6a778f8)
reader: stop unwanted page jumps when scrolling (#2699) (1042cad)

api: add BookParser.isEnabled() to test for enabled provider (#2694) (0b6689f)
api: remove unused book filters (#2690) (f0ca4e5)
metadata: add external url to all metadata sources (#2670) (b2fa4b7)
ui: drop frontend external URL generation (#2693) (40cf653)

deps: bump @openng/optimus-ui-tailwindcss from 2.0.1 to 2.0.2 (#2680) (7e6a2f3)
deps: bump @playwright/test from 1.62.1 to 1.63.0 (#2681) (07d5cd4)
deps: bump com.github.ben-manes.versions from 0.61.0 to 0.62.0 in /backend (#2679) (ebbd2d9)
deps: bump com.github.junrar:junrar from 8.1.0 to 8.1.1 in /backend (#2682) (ea7aaf4)
deps: bump epub4j to 2.1.0 (#2696) (569fd66)
deps: bump ng-mocks from 14.17.0 to 14.17.6 (#2676) (e592e44)
deps: bump org.flywaydb:flyway-mysql from 13.5.0 to 13.6.0 in /backend (#2675) (05c03aa)
deps: bump org.hibernate.orm from 7.4.7.Final to 7.4.8.Final in /backend (#2683) (a1eaa68)
deps: bump typescript-eslint from 8.67.0 to 8.70.0 (#2678) (ed0e0ef)
deps: bump vitest from 4.1.11 to 5.0.0 (#2677) (578b6c5)

We'd like to thank the contributors for this release for taking the time to make Grimmory better.