Skip to content

v2.2.0 — Hardening + performance

Choose a tag to compare

View all tags
@ZL154 ZL154 released this 04 May 20:02
· 352 commits to main since this release
v2.2.0
697d660

Internal hardening pass on the auth pipeline plus a performance overhaul of the hot login path.

Hardening

  • Cookie attribute handling behind reverse proxies, stricter forwarded-header handling, additional input bounds, tightened token binding.
  • Trusted-browser cookie now carries the Secure flag correctly when Jellyfin is behind a TLS-terminating proxy (Cloudflare, Caddy, nginx, Traefik). Enable via TrustForwardedFor + TrustedProxyCidrs in plugin settings.

Performance

  • In-memory caches on the hot auth path: per-user data, audit log, parsed CIDRs, patched /web/ index. Disk I/O on every login is now near-zero.
  • Login latency improved by replacing an internal polling wait with immediate signaling.
  • Audit log is now background-flushed and stored as compact JSON. Existing logs continue to read fine.

Packaging fixes (vs earlier rev)

  • Zip ships only runtimes/linux-x64/ native libs; Windows / macOS native runtimes removed (Jellyfin's plugin loader was attempting to load them as managed assemblies).
  • Zip contents land at archive root (no wrapper folder) so the catalog extractor places DLLs directly under <Name>_<Version>/.
  • meta.json shipped with lowercase JSON keys + populated targetAbi so Jellyfin's catalog post-install rewrite preserves the assembly whitelist instead of zeroing it out.

No breaking changes. In-place upgrade.

MD5 29EF94596334EA4E67E9E34AEAD865B2

Assets 3
Loading