Differences from Upstream

Differences from Upstream

Behavior	Upstream CWA :latest	This build
Cover saves from Hardcover/Google Books/iTunes/Open Library	Returns "not a valid image"	Saves and persists
Generate Kobo Auth Token	Blank page	Works
Safari metadata search	Silent 400	Works
Safari book-delete button	Broken since the Feb-4 commit	Works
Kobo bookmark sync with missing Location	Crashes	Tolerates
/kobo_auth/generate_auth_token IDOR	Open (any user can mint another user's token)	Closed
Reverse-proxy user-profile updates	Drops path prefix	Honors getPath()
Docker healthcheck on / → /login 302	Trips on curl -f	Uses dedicated endpoint with service health checks
.cbr / .cbz OPDS mimetypes	Non-IANA	IANA-compliant
Cover resolution on high-DPI readers	Often 290×475 (Hardcover thumbnail)	1000×1500+ via booster
Admin routes (cwa_logs, convert, epub_fixer, …)	14 unauthenticated	All require admin
Translations: ja, fr, cs, hu, zh_Hans, zh_Hant	Open in PRs	Merged

Backports are conservative. Anything that touches auth, schema, or dependencies gets a manual review before merging.

The complete, per-commit list — with the original PR author and release tag for each backport — is in CHANGES-vs-upstream.md, and each release's changes are on the Releases page.