Skip to content

v2.5.20

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jul 21:25
v2.5.20
35eabd9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.5.20 - Mobile authentication, OIDC onboarding, and dashboard reliability

In-place upgrade from any 2.5.x. No schema migration or configuration reset is required. Supports Jellyfin 10.11.x (10.11.9+). The release package is Sigstore-signed and includes SLSA build provenance.

Added

  • Visible account identity during 2FA - the verification challenge now shows Signing in as username, including the flow where Jellyfin has already accepted the username and password.
  • OIDC symbol policy (#136) - providers that require a local password can now require at least one symbol. The generated policy text and validation use the same rule.
  • Secure onboarding cancellation (#134) - users can leave the first-login password screen through a dedicated cancel action that also revokes the temporary Jellyfin session.
  • Audit sort selection (#130) - admins can choose newest-first or oldest-first ordering in the Audit Log tab.
  • Opt-in exact username linking (#133) - existing users can be linked by an exact username match only when the provider explicitly enables it. Admin accounts and conflicting OIDC subjects remain protected.

Fixed

  • Android and mobile login controls (#138) - the plugin now reinjects its login controls into current Jellyfin web shells, serves the injection script and patched shell with cache-safe headers, and handles the navigation lifecycle used by the Android app.
  • Android external-browser OIDC return (#64) - the one-shot login hand-off is Base URL aware, rejects replay, and returns native clients to the correct server route.
  • Post-2FA mobile login loop (#137) - proxy-aware public addresses and the native-client completion path are retained so a successful challenge no longer drops the user back at sign-in.
  • Challenge timeout and stale state - pending challenges are consumed atomically, stale browser state is cleared safely, and repeated sign-in attempts cannot leave the challenge page spinning indefinitely.
  • Trusted-device continuity - finite trust uses the configured sliding lifetime, indefinite trust remains indefinite, and validated native sessions survive the device/session variations used by mobile clients while remaining bound to the authenticated session.
  • Portable passkey registration (#102) - new credentials explicitly request ES256 instead of Ed25519, avoiding platform-specific native-libsodium failures on Linux, ARM, Windows, iOS, and password-manager authenticators.
  • OIDC bridge loops and proxy paths (#98) - redirect URI calculation respects forwarded headers and Jellyfin Base URLs, and bridge failures surface the underlying error instead of silently bouncing to login.
  • OIDC discovery guidance (#120) - issuer/realm roots are retried with /.well-known/openid-configuration, and invalid documents report the missing field with an actionable message.
  • OIDC existing-user conflicts (#133) - verified-email and exact-username linking refuse conflicting provider subjects instead of linking or creating the wrong account.
  • OIDC set-password access control (#135) - the page now requires a short-lived, single-use onboarding proof tied to the user and provider. A stale URL cannot be used outside the active sign-in flow.
  • Plugin install, update, disable, and uninstall lifecycle (#123) - package metadata uses Jellyfin's required property casing, versions stay aligned, and builds fail if a required assembly or image is missing.
  • Dashboard security posture and navigation - the admin page no longer remains at Computing... on Jellyfin 10.11.11, and tab navigation remains functional if one diagnostic request fails.
  • Dashboard sidebar entry and localization (#131) - the extension entry appears on desktop and mobile, follows live language changes, and ships with its image for manual installs.
  • Notification grouping behind proxies (#124) - deduplication uses a stable event identity instead of fragmenting when forwarded client addresses change.
  • Passwordless policy consistency - the standalone login endpoint now applies the same passwordless-account restrictions as the normal provider flow.

Security and compatibility

  • OIDC onboarding proofs are short-lived, single-use, bound to the expected user/provider, and revalidated against the live Jellyfin session before a password change.
  • Cancelling OIDC onboarding revokes the temporary server access token rather than only clearing browser state.
  • Recovery-code documentation now matches the implementation: per-code-salted PBKDF2-HMAC-SHA256 with 600,000 iterations. Legacy 100,000-iteration records remain valid until consumed.
  • The package keeps the Jellyfin 10.11.9 compile floor so it loads on 10.11.9, 10.11.10, and 10.11.11+.

Notes

  • All new settings and UI text are translated across English, German, Spanish, French, Italian, Japanese, Portuguese, and Chinese.
  • 344/344 tests pass, including authentication, onboarding, OIDC, dashboard, packaging, and translation regression coverage.
  • Existing TOTP secrets, recovery codes, passkeys, trusted devices, OIDC links, configuration, and audit history are preserved.
Assets 8
Loading