operationETH/ABSulli v0.8.0 on GitHub

What's Changed

Important

Breaking changes
These only affect you if you use the features listed below. If you only use the ABSulli web interface with a standard Docker setup, no action is needed.

If you use the ABSulli API token (for example, Home Assistant or scripts): it now only works for read-only GET requests to /api/v1/status, /api/v1/activity, /api/v1/history, /api/v1/users, and /api/v1/libraries (and their deprecated /api/ aliases). Other requests using the API token now get a 401 or a redirect to login.
If you scrape /metrics with the API token: configure a metrics token in Settings → Network and use that instead.
If you called /api/v1/auth/revoke-sessions: it has been removed. Use Sign out everywhere in Settings → Users.
If you defined a custom healthcheck using curl: curl is no longer in the image. Remove your custom healthcheck and use the built-in one.
If you set PUID or PGID to 0 or a non-numeric value: ABSulli now runs as 1000 with a warning in the logs. Set them to a valid non-root ID.

security

restricted the API token to the read-only API endpoints; it can no longer open settings, change configuration, regenerate tokens, or run jobs
saved secrets are no longer rendered into the Settings page HTML
API token, metrics token, and RSS feed URL are fetched only when revealed or copied
Discord, Slack, ntfy, and webhook URLs, webhook headers, and the Audiobookshelf API key are masked; leaving a field blank keeps the saved value
login rate limiting now only trusts X-Forwarded-For from configured trusted proxy IPs and uses the last forwarded address
notification cover links are now bound to a fixed size, preventing unauthenticated cache filling; existing links in old notifications keep working
cover cache is capped at 250 MB with hourly cleanup, and cover sizes snap to a fixed set
responses from Audiobookshelf are size-limited (8 MB for images, 64 MB for JSON)
HTTP client request logging is quieted so notification URLs and tokens are not written to logs

features

added Sign out everywhere in Settings → Users
added Trusted Proxy IP Addresses in Settings → Network (or ABSULLI_TRUSTED_PROXY_IPS)
added a warning on the Network tab and at startup when proxy trust is enabled without trusted proxy addresses
added remove options for the metrics token, ntfy access token, and webhook Authorization header

container

application code in /app is now read-only to the runtime user; /config remains writable
PUID/PGID are applied with numeric gosu instead of modifying system users
/config ownership is only corrected when files with the wrong owner are found
clearer startup errors when /config permissions cannot be set
the healthcheck now respects ABSULLI_PORT
removed pip from the runtime image
the example docker-compose.yml now enables no-new-privileges
the Python base image is pinned by digest and updated by Dependabot
reduced the Docker image download size from about 80 MB to 70 MB

Not a breaking change
No database migrations in this release. Existing /config volumes keep working; ownership is corrected automatically on first start if needed. Keep an eye on the logs after pulling.

fixes

fixed application log messages being silenced after database migrations ran at startup
restored the configured log level, stdout output, and timestamps after startup
removed the "Revoke existing browser sessions after saving" checkbox in favor of Sign out everywhere; changing the username or password still revokes sessions automatically

maintenance

added Ruff, test coverage enforcement, dependency auditing, and root-level entrypoint tests to CI
restricted GitHub Actions package write permissions to the Docker publishing jobs
nightly builds now also run for test, dev dependency, and workflow changes
pinned test tooling in requirements-dev.txt, including httpx2 for the Starlette test client
added a regression test that checks every Settings tab for leaked secrets
fixed unclosed SQLite connections in tests
Dependabot now checks Python packages and the Docker base image daily; GitHub Actions stay weekly
updated the README for API token scope, metrics tokens, reverse proxy trust, no-new-privileges, container changes, and notification cover art setup
build(deps): bump alembic from 1.20.0 to 1.20.1 by @dependabot[bot] in #60
build(deps): bump sqlalchemy from 2.1.2 to 2.1.6 by @dependabot[bot] in #59
build(deps): bump pydantic from 2.13.5 to 2.14.1 by @dependabot[bot] in #55
build(deps): bump pydantic-settings from 2.15.0 to 2.16.1 by @dependabot[bot] in #57
build(deps): bump fastapi from 0.143.0 to 0.162.0 by @dependabot[bot] in #58

Full Changelog: v0.7.1...v0.8.0