Release v2.5.12 · ZL154/JellyfinSecurity

v2.5.12 — UI translated everywhere, passwordless 2FA login, Admins-Only fix

A localization + bug-fix release. In-place upgrade from any 2.5.x — no schema or data migration.

Fully translated login & setup UI (#79). The login page, the 2FA setup page, the admin config UI, and the injected "Two-Factor Auth" sidebar entry now all follow Jellyfin's display language — auto-detected and remembered across restarts — across all 8 languages (en / de / es / fr / it / ja / pt / zh). The shared scripts are now served on cache-immune paths, so a CDN (e.g. Cloudflare) can no longer freeze the translations behind a *.js edge-cache rule.
Hide Jellyfin's built-in "Forgot password?" link (#80). An optional sub-toggle under email recovery removes Jellyfin's native recovery link so users see only the plugin's flow. Defaults on when recovery is enabled; turn it off to keep both.

Passwordless 2FA login (#82). Users whose password is disabled can now sign in through the 2FA login portal with a blank password, matching Jellyfin's standard login page. Both the login page and the server endpoint were over-requiring a password; the server still enforces the real password policy for users who actually have one.
Admins-Only enforcement no longer blocks non-admins (#81). With enforcement scope set to Admins Only, a non-admin without 2FA signing in through the standard portal used to hang on "Server Unavailable." The session safety-check now verifies administrator status and exempts non-admins — and fails safe (enforces) if a user can't be resolved, so an admin is never accidentally let past.
Android Google sign-in fallback (#64). When an embedded app WebView trips Google's "Use secure browsers" policy (Error 403: disallowed_useragent), the in-app sign-in dialog now reliably routes you to "Copy sign-in link" → open in Chrome, which always opens a real browser.
Clearer email-claim diagnostics (#80). When IdP email auto-fill doesn't populate, the log now explains why (auto-fill disabled, no email in the claims — check the email scope / claim name — or an email already set).

QuestPDF pinned to 2026.5.0 — a newer build produced a broken recovery-codes PDF.
Analyzer and test-only dependency bumps merged; Microsoft.IdentityModel auto-bumps blocked (8.19.x breaks OIDC token validation).