1.18.0 (2026-11-08)
🔒 Security
- auth: stop serializing user credential fields (#880) (ce09aad)
- auth: validate post-sign-in redirects (#882) (559f8ba)
- auth: verify current password on self password change (#877) (40ce707)
- csrf: harden protection across APIs and service proxies (#863) (32a307d)
- docker: exclude build tooling from runtime (#899) (9ca9f95)
- email: harden email dependencies (#898) (f2b3c6d)
- server: enforce plex access and invite settings permissions (#888) (abc2c61)
- sessions: complete device revocation (#901) (970b76a)
- settings: rate-limit lidarr auth (#897) (014b323)
✨ Features
- auth: add device management and sign out devices on password change (#881) (4589309), closes #876
- network: trust proxy presets and Cloudflare IP ranges (#883) (c952c9b)
- services: configure new-user defaults (#870) (0a5bceb)
🐛 Bug Fixes
- auth: align session entity with connect-typeorm soft-delete column (#879) (4de351f)
- deps: patch daisyUI join selectors rejected by Lightning CSS (#878) (c06ffb5)
- libraries: make shared library defaults live (#889) (04c15c7)
- libraries: retry failed plex syncs (#894) (210000c)
- plex: preserve explicit legacy library access (#903) (01b31fe)
- plex: retain permissions for sync retries (#902) (afea879)
- proxy: use Undici 8 fetch for custom dispatchers (#874) (198ca28)
- request: keep nav active state in sync with iframe routing (#887) (fbab64f)
- server: stop scheduled jobs before restart (#884) (427090a)
💎 Styles
📦 Build System
- docker: update node.js runtime to 8996bb5 (#896) (db96b29)
- docker: update node.js runtime to c6ad9e9 (#875) (1c4de44)
- node: update node.js runtime to v26 (#871) (cac2e33)
🤖 CI/CD
⚠️ Upgrade notes
Shared library defaults are now live. Users and invites set to Default Libraries now follow Settings → Users → Default Shared Libraries as it changes. Changing the default, or enabling/disabling a library, updates Plex access for affected users when you save.
One-time migration on first start:
- Plex users who were never assigned libraries keep their current Plex access instead of being moved to the default. Each one is listed in the startup log:
Shared libraries upgrade: N user(s) without assigned libraries kept their existing Plex access…
Set them to Default Libraries under Users if they should follow the server default. - If Plex can't be reached during startup, the affected users are logged instead (
Shared libraries upgrade could not read Plex access…) and startup continues. Review those users before changing the default or enabled libraries.
Before changing defaults after upgrading:
- Users who previously chose "Default" were saved with explicit libraries by older versions and will show those libraries. Set them back to Default Libraries if they should follow the server default.
- A user whose assigned libraries are all disabled is removed from Plex and deactivated. Use Reinvite to restore them.
- You can't disable the last enabled library in the default; change the default first.
Other upgrade considerations:
- Existing installations with Proxy Support enabled retain their current single-proxy behavior until trusted-proxy settings are changed. Changes require a restart.
- Device IP recording is enabled by default. Disabling Settings → Network → Record Device IP Addresses deletes stored device IPs.
- With CSRF protection enabled, production requires HTTPS and correctly configured trusted proxies. Existing clients should obtain fresh CSRF cookies after upgrading; API-key mutations still require a valid CSRF token.