new-usemame/Calibre-Web-NextGen v4.0.25

v4.0.25 — Kobo OIDC + delete CSRF + metadata-persist backports

on GitHub

A bug-fix release. Three CWA backports.

Get it

docker pull ghcr.io/new-usemame/calibre-web-nextgen:v4.0.25

Same volume layout as v4.0.24; no migration.

Fixed

• Kobo sync on firmware 4.45+ no longer fails with "Sync failed. Please try again." Adds the /oauth/.well-known/openid-configuration discovery endpoint Kobo expects, a dedicated /oauth/authorize route to break a 308 redirect loop, and uses current_user.id instead of the always-empty-on-GET request body. Backport of CWA #1144 by @mihneabulu.

• Book delete and bulk actions no longer silently break in some browser configurations. The detail-page delete flow now passes the saved return location to the generated POST form instead of assigning window.location (which was overwriting the global object); table bulk delete / edit / archive / read JSON POSTs now send an explicit X-CSRFToken header. Backport of CWA #1327 by @okms.

• Fetched metadata persists on first save when the book directory is renamed. When the fetched metadata changed the title or author, the directory rename used to happen after description / tags were staged, and on the first save those fields silently failed to write to metadata.db. Saving twice was the workaround. The directory rename now runs first; description and tags persist on the first save. Backport of CWA #1331 by @I-Would-Like-To-Report-A-Bug-Please (regression test included).

Validation

CI green on each backport before merge. End-to-end check on :v4.0.25 after deploy: container healthy, login + book detail + Kobo oauth/.well-known/openid-configuration route returns the OIDC discovery document instead of an empty-user_id token response.