Version 17.1.0

Changes

• Fixed the generated OpenAPI/Swagger API specification: endpoints that bind path parameters through a combined DTO (e.g. GET /api/users/:user_id, GET /api/games/:game_id) now declare those path parameters correctly, so the API docs and auto-generated clients work as expected.
• Deleting a game now also hides it's associated bookmarks from users' bookmarked-games lists.
• Fixed removing a bookmark from a game that was deleted from the server: unbookmarking now works even after the game is deleted, so a deleted game no longer leaves a stale bookmark you can't clear.
• Game metadata now supports umu-launcher defaults for Linux clients: umu_game_id (GAMEID), umu_store (STORE) and umu_proton_path (PROTONPATH) can be set once per game and are inherited by every client that installs the game.
• Fixed uploaded games disappearing from the library until the next scan
• Fixed file uploads consuming excessive memory
• Fixed games whose titles only differ by capitalization
• Fixed OAuth2/SSO login always returning to the server's own address: the flow now returns the session to the app that started it (e.g. the desktop client), with the return address validated against trusted origins.
• Fixed OAuth2/SSO logins failing with a duplicate-user error on the second attempt: newly registered SSO users now respect the account activation setting, and existing but inactive or deleted users report their real state instead of triggering another registration.
• The desktop app origins (http://tauri.localhost and tauri://localhost) are now always allowed by CORS, even when SERVER_CORS_ALLOWED_ORIGINS is set, so restricting CORS no longer breaks the new desktop client.