Speakr v0.10.17-alpha

In this release, the authentication library is updated for seven security advisories, SSO sign-in works again under the default security policy, API tokens in the query string are limited to reading and marked deprecated, several unauthenticated addresses now require sign-in, permissions on an existing share can be changed in place, and several people can be found and selected in the share window at once.

Security

• Authlib 1.9.1. Seven advisories for Authlib were published on 27 October 2026, among them forged ID token signatures and a way to skip the nonce check. Speakr uses Authlib for SSO, so every installation with SSO enabled should update. An end-to-end sign-in test against a local OpenID provider is added, covering forged, unsigned, expired and mismatched ID tokens. Providers that put client_id in the ID token header (#298) still sign in.
• API tokens in the query string (#500). ?token= is now accepted only on GET and HEAD requests and is deprecated. Any other request with a token in the query string is refused with 401 and code: query_token_read_only. Responses to such requests carry a Deprecation header. Send the token in the Authorization: Bearer header. New tokens on the Account page default to 90 days.
• Addresses that now require sign-in. /api/config (#502), which carried the default summary prompt, and /api/system/info (#499) now require sign-in. The LLM and transcription addresses in the system info are shown to administrators only.
• Recording ids (#504). In API v1, a recording the caller cannot see is answered with 404, the same as a missing id, so the ids of other accounts stay unknown.
• Forwarded headers (#501). The new TRUSTED_PROXIES setting lists the reverse proxies, as addresses or CIDR ranges. When it is set, the forwarded client address, scheme and host are read only from connections that come from those proxies, so a client that reaches Speakr directly cannot set its own address for login throttling. Until it is set, a warning is written at startup.
• Public share links (#498). When APP_BASE_URL is set, public share links are built from it and no longer from the request headers.
• Database files (#506). World read access is removed from the SQLite database and its WAL files at startup.
• Folder moves (#515). Placing another person's recording in a group folder now requires the admin role in that group, as group tags already do. A personal folder requires ownership of the recording.
• Folder names in API v1 (#516). A person a recording is shared with sees its folder only while it is the group folder that shared it, the same rule as in the web app.

Thanks to @branch1337 for the reports above and below, each with a reproduction.

Added

• Change permissions on a share (discussion #517). The person who granted a share can change its edit and re-share permissions in place, from the share window or Shared Transcripts. Shares created by a group tag or group folder still follow the group.
• Share with several people (discussion #519). The share window no longer loads every account. A search starts at two characters and lists up to 10 matches by username or email (email only when usernames are shown). Several people can be selected and shared with in one step, and the permission checkboxes keep their values until the window is closed.
• Default sort (discussion #489). Under Account > Preferences, each account can choose whether the recordings list opens sorted by date added or by meeting date. The Sort menu still overrides it per browser. Thanks to @muness.
• Voyage AI embeddings (#487). Embedding request parameters can be set for Voyage AI in API mode. Thanks to @i-iooi-i.
• Anthropic prompt caching (discussion #488). With PREFIX_CACHE_OPTIMIZED_PROMPTS=true, TEXT_MODEL_CACHE_BREAKPOINTS=true marks the shared transcript block with a cache breakpoint, so Anthropic models reuse it between the title and summary calls.
• ASR example settings (discussion #518). 29 existing settings are listed in config/env.asr.example, commented out at their defaults.

Changed

• Interface language (#477). API error and information messages and budget messages follow the interface language, and each API error carries a stable code. The remaining hard-coded English in the web interface is translated.
• Group tags (#493). Members see the group tags of a recording shared with them through that group, and no longer see the owner's personal tags or tags from other groups. Thanks to @lhpereira.
• Folder names and colors (#512). A folder name must have 1 to 50 characters without control characters, and a color must have the form #RRGGBB. Other values are refused with 400. On PostgreSQL, a longer name returned 500.
• Group folder names (#513). A group folder name is unique within its group, whoever creates it.
• Folder filter (#514). A folder filter on the recording lists that is neither a folder id nor none is refused with 400 and code: invalid_parameter. It was ignored.
• Recording lists (#507, #508). The admin status counts use a new index, and the recording list no longer loads the full notes text.

Fixed

• SSO sign-in (#496). Sign-in with SSO, and "Link account" on the Account page, were blocked by the form-action rule of the default Content Security Policy.
• Group folder sharing (#515). A recording placed in a group folder through API v1, the batch update or an upload was not shared with the group.
• Upload formats (#510). The upload dialog skipped Ogg and other files that the file picker offered.
• Storage quota (#509). Two overlapping uploads could both pass the storage quota.
• Recording sessions (#505). Links from recording sessions to deleted recordings are cleared, and a stitch job checks that the session and the recording belong to the same account.
• Filename dates (#486). A time in a filename followed by Z is read as UTC.
• Duplicate folder names (#511). A refused duplicate name was logged as an application error with the SQL statement.

Dependencies

• authlib 1.6.12 → 1.9.1, with joserfc 1.7.7 (new).
• gunicorn 23.0.0 → 26.2.0. The gunicorn control socket is turned off.
• openai 3.29.0 → 3.36.1, certifi 2026.10.19.
• Minimum versions raised for psycopg2-binary and itsdangerous (#470–#474).

Upgrading

Pull the new image and start as usual. At startup, recording-session links to deleted recordings are cleared, an index on the recording status and a unique index on group folder names are created, and world read access is removed from the SQLite files. If a group already has two folders with the same name, the newer one is renamed with a number, for example "Projects (2)", and the rename is logged.

• API clients: a write request with ?token= now returns 401; send the token in the Authorization header. A recording the token cannot see returns 404 (was 403). A folder filter that is neither an id nor none returns 400.
• Behind a reverse proxy: set TRUSTED_PROXIES to the proxy address to remove the startup warning.
• Pages or scripts that read /api/config or /api/system/info without signing in now receive 401.
• SSO users who added the provider to CONTENT_SECURITY_POLICY as a workaround can remove that setting.

Full Changelog: v0.10.16-alpha...v0.10.17-alpha