v0.12.0 (2026-04-05)

Added#

• Libraries: Add Edit Library modal.
• Libraries: Add retrying API client for TMDB.
• Music: Add Release page for music.
• Music: Display which track is playing.
• Photos: Add extra security checks for album share links.
• Search: Add link to advanced search.
• Admin: Add audio only mode to transcoder.
• Authentication: Add handler to get all active sessions.
• Authentication: Add role duplicate checks.
• Authentication: Track active sessions in the database.
• Configuration: Basic Music Metadata scraper.
• Apps: Add delete button.
• Apps: Add shuffle button.
• Apps: Basic shuffle works.
• General: Add file upload and download limits.
• General: Add file upload/download size and timeout limits.
• General: Add rate limiting by IP and User. Add user lockout support to simple login.
• General: Add some basic AI agent rules.
• General: Add special read only group attribute.
• General: Add tempfile cleanup.
• General: Allow list of CIDR ranges to exempt from IP rate limiting.
• General: Implement CSRF protections.

Changed#

• Libraries: Cinema uses cinema items and not gallery items.
• Libraries: Cinema uses its own schema and has it’s own navigation.
• Libraries: GalleryCinemaMovieItem not CinemaMovieItem.
• Libraries: GalleryCinemaSeriesItem not CinemaSeriesItem.
• Libraries: Instantly close media player and send stop request async but do not wait.
• Libraries: More filepath sanitization.
• Libraries: Stop transcoder when skipping to next and prev item in transcoder.
• Libraries: Switch all clients to use our retrying API client.
• Libraries: TMDB database functions no longer error out on duplicates.
• Music: Better styling for music album page.
• Music: DB design for music.
• Music: Dialog box fixes, creation fixes, and scanning fixes.
• Music: Improvements to music scanning.
• Music: Initial Music Library implementation.
• Music: More Music changes.
• Music: Permission and matching fixes.
• Photos: Better Album Owner description as Album Manager.
• Photos: Better quality video thumbnails, video thumbnail queue generation, frontend retries thumbnails that haven’t been generated yet.
• Photos: Can download and private flags are now tracked in album struct. Not album permissions.
• Photos: Frontend clears passwords on unmount.
• Photos: Have frontend give the album types the user is allowed to create.
• Photos: Last of the filepath join verification.
• Photos: Safety measures for thumbnail generation.
• Photos: Use shared DB value.
• Admin: Admins can now end transcoders and view them.
• Admin: More dash audio changes.
• Authentication: Api tokens now use jwt library.
• Authentication: Both OIDC and simple login now uses a unified session cookie that is a jwt.
• Authentication: Can delete an active session.
• Authentication: Check session status in DB before allowing user to auth.
• Authentication: Cleanup service for the active sessions.
• Authentication: Comment.
• Authentication: Final massive rbac change.
• Authentication: If session is revoked, we invalidate the session.
• Authentication: Initial RBAC support.
• Authentication: MaxAge JWT spec.
• Authentication: More RBAC plumbing.
• Authentication: More opaque error messages for auth related things.
• Authentication: More permission types as well as well as better default role management.
• Authentication: Move all oidc related middleware files to gallery/oidc package Add helper functions to not expose sensitive OIDC config to other packages Move all JWT validation into auth/jwt.go.
• Authentication: Move helper functions around.
• Authentication: Move jwt validation functions to jwt library.
• Authentication: No more api token session tracking.
• Authentication: No more magic album link cookie.
• Authentication: Oidc security fixes.
• Authentication: Only owners can add users to the owner/admin group and users cannot self manage their groups.
• Authentication: Rename APIToken auth path.
• Authentication: Session Management Refactor.
• Authentication: Session validation happens in jwt.go.
• Authentication: Specific permission for viewing directories.
• Authentication: Tie some system groups to admin privileges.
• Authentication: Transcoder JWTs use jwt library.
• Authentication: Update permissions.
• Authentication: Use typed permission instead of string.
• Authentication: User preference update permission.
• Configuration: Validate jwt secret is good enough.
• Apps: Audio playback actually works.
• Apps: Audio player improvements.
• Apps: Better directory setting UI.
• Apps: Better player start.
• Apps: Cinema item improvmenets.
• Apps: Don’t show HDR video in minimized video player since it’ll be washed out.
• Apps: End old transcoder when we play next.
• Apps: Frontend can actually play music.
• Apps: HeroUI V3 Upgrade.
• Apps: Logout works.
• Apps: Make transcoder item type agnostic.
• Apps: Minimize photos in lightbox.
• Apps: Move simple search.
• Apps: Music player works for individual tracks.
• Apps: Pass more accurate fallbacks to capabilities.
• Apps: Pass transcoder jwt.
• Apps: Rename suffle.
• Apps: Rename video player to media player.
• Apps: Restarting playback works.
• Apps: Single track looping is more reliable now.
• Apps: Transcoder and Gallery-UI video player are Type Agnostic.
• Apps: Transcoder restarts work on ios on seek stall.
• Apps: UI actually tries to play music now.
• Apps: UI improvements.
• Apps: Unified video player refactor to make easier to read.
• Apps: Unify audio and video player.
• Apps: Use shared minimized video player.
• Apps: User can see active sessions.
• Apps: We auto play after seeking and restarting. We also debounce correctly.
• General: Album ID’s are always unique and start above 10,000. refactor a shared function.
• General: Better admin permissions.
• General: Better login experience for gallery-app.
• General: CORS.
• General: Complex endpoints get rate limits.
• General: Every http error message uses standardized messaging.
• General: Item Can Download attribute stored on item.
• General: Logging parameter names is bad.
• General: Lots of bug fixes AND broken initial watch together stuff.
• General: Magic share uuids work for videos more securely now.
• General: More csp.
• General: More file upload security.
• General: More security fixes.
• General: Permission middleware now gives no information in return codes.
• General: Simple RBAC plumbing.
• General: Some filepath cleaning.
• General: Standardized API return errors.
• General: Unique users and tags above 10000.
• General: Use JWT for all transcoder operations instead of a cookie.
• General: Watch together fixes.

Removed#

• Admin: Remove shared types.
• Authentication: Remove uneeded comment.
• General: Remove backward compatibility.

Fixed#

• Libraries: Fix music brainz sync as well as audio only player.
• Libraries: Fix no user fallback.
• Music: Fix verbose logging.
• Photos: Fix adding user permissions.
• Photos: Fix album edit modal not working.
• Photos: Fix custom album thumbnails not working.
• Photos: Fix frontend build.
• Photos: Fix item upload and video thumbnail generation.
• Photos: Fix video player not restarting on seek.
• Admin: Fix file validation.
• Authentication: Fix album JWT management.
• Authentication: Fix bug where RBACs don’t check album level permissions for an item.
• Authentication: Fix bug where if you owned an album you were granted permission to create additional albums.
• Authentication: Fix cookie vulnerability.
• Authentication: Fix the session id and claim JTI never matching.
• Authentication: Fixed a bug where removing a user from a group didn’t remove their priveleges.
• Apps: Fix CSP.
• Apps: Fix colors.
• Apps: Fix gallery-app errors.
• Apps: Fix minimize button placement on cinema video.
• Apps: Fix mobile seek.
• Apps: Fix react hook error when clicking settings button on album page.
• Apps: Fix the drop downs for options.
• Apps: Fix videos not playing on gallery app.
• General: Fix frontend UI.
• General: Fix gallery-ui map.
• General: Fix video playback on safari.