This release patches 1 CVE for security teams tracking exposure across their dependency inventory.
Topics
+2 more
Affected surfaces
ReleasePort's take
Light signalRelease v0.1.3 fixes CVEs, changes default user permissions, and adds Kobo sync.
Why it matters: Patch immediately to address the fixed CVEs; adjust managed account configurations for the changed default user permissions.
Summary
AI summaryCVE fixes, default user permissions changed, and Kobo sync added.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
CVEs fixed in this release. CVEs fixed in this release. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Breaking | Medium |
Default user permissions changed, requiring adjustments for managed accounts. Default user permissions changed, requiring adjustments for managed accounts. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Kobo sync functionality added. Kobo sync functionality added. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
JWT secrets now persisted in the database for token validity across restarts. JWT secrets now persisted in the database for token validity across restarts. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Tag assignment added to books management. Tag assignment added to books management. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
OPDS v2 fixes implemented. OPDS v2 fixes implemented. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
User info fetched from OIDC provider. User info fetched from OIDC provider. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Docs migrated to fumadocs. Docs migrated to fumadocs. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Basic metadata fetching foundations added, experimental and incomplete. Basic metadata fetching foundations added, experimental and incomplete. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Epub locale strings and locale debug option added for Expo. Epub locale strings and locale debug option added for Expo. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Type-to-confirm dialog for library deletion added. Type-to-confirm dialog for library deletion added. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Expo canvas size increased for Android app icons. Expo canvas size increased for Android app icons. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Feature | Low |
Documentation migrated to fumadocs platform. Documentation migrated to fumadocs platform. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Dependency | Medium |
GraphQLSP bumped from 1.15.1 to 1.15.4. GraphQLSP bumped from 1.15.1 to 1.15.4. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
React Hook Form bumped from 7.68.0 to 7.74.0. React Hook Form bumped from 7.68.0 to 7.74.0. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
TS Essentials bumped from 10.1.1 to 10.2.0. TS Essentials bumped from 10.1.1 to 10.2.0. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
React Native SVG bumped from 15.15.3 to 15.15.4. React Native SVG bumped from 15.15.3 to 15.15.4. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
Drizzle ORM bumped from 0.44.7 to 0.45.2. Drizzle ORM bumped from 0.44.7 to 0.45.2. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Dependency | Low |
GraphQLSP library upgraded from 1.15.1 to 1.15.4. GraphQLSP library upgraded from 1.15.1 to 1.15.4. Source: granite4.1:30b@2026-05-21-audit Confidence: high |
— |
| Performance | Medium |
Indexes added for media and series name columns. Indexes added for media and series name columns. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Image ratio issue in reader fixed for Expo. Image ratio issue in reader fixed for Expo. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Missing media detection when series directory is empty fixed. Missing media detection when series directory is empty fixed. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Thumbnail-related insert statements now adhere to SQLite bind limits. Thumbnail-related insert statements now adhere to SQLite bind limits. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
HTML parsing fixed for certain ebook metadata fields. HTML parsing fixed for certain ebook metadata fields. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Inverted query condition for series completion fixed. Inverted query condition for series completion fixed. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Active series excluded from on deck list. Active series excluded from on deck list. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Reading time updates fixed for paged image reader. Reading time updates fixed for paged image reader. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Consistent read time language used throughout the app. Consistent read time language used throughout the app. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
IP extraction logic improved to better handle proxies. IP extraction logic improved to better handle proxies. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
t() function expanded to accept optional record for interpolation on mobile. t() function expanded to accept optional record for interpolation on mobile. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
IP extraction logic improved to better account for proxies. IP extraction logic improved to better account for proxies. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Position prefix restored in certain contexts. Position prefix restored in certain contexts. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
Full changelog
A few things of note (things that may require your attention or were popular requests fulfilled):
- A couple of CVEs fixed (see #1157)
- Kobo sync was added (thank you @bct!)
- The default permissions for users has changed, things like permission to change password etc. So if you have managed accounts you may need to adjust permissions
- A bit more strict proxy header parsing, if you run a reverse proxy you'll want to see here
- Auth JWTs (e.g., for mobile app auth) now have stable secrets persisted to the database, so restarts retain token validity. The secrets should be created on first start after upgrade
- The foundations for metadata fetching are present. It is extremely experimental and incomplete. You are welcome to try it, but please understand it isn't finished yet.
Otherwise, a lot of bug fixes and some long-awaited feature requests (like Kobo). The documentation website also got a new look: https://www.stumpapp.dev/.
What's Changed
- :card_file_box: Add indexes for media and series
namecolumns by @aaronleopold in https://github.com/stumpapp/stump/pull/1049 - :bug: Adhere to SQLite bind limits for thumbnail-related insert statements by @aaronleopold in https://github.com/stumpapp/stump/pull/962
- 🐛 detect missing media when series directory is empty by @aaronleopold in https://github.com/stumpapp/stump/pull/1054
- :bug: (expo): Fix OPDS auth dialog positioning by @aaronleopold in https://github.com/stumpapp/stump/pull/1056
- :passport_control: Restrict default user permissions by @aaronleopold in https://github.com/stumpapp/stump/pull/1032
- :memo: Clarify OIDC config for TOML by @aaronleopold in https://github.com/stumpapp/stump/pull/1057
- ♻️ refactor IP extraction to account for proxies better by @aaronleopold in https://github.com/stumpapp/stump/pull/1053
- :wrench: (expo): Change configured orientation by @aaronleopold in https://github.com/stumpapp/stump/pull/1060
- 🌐 (expo): Epub locale strings and locale debug option by @Arklaum in https://github.com/stumpapp/stump/pull/1063
- :arrow_up: (expo): Upgrade to expo SDK 55 by @aaronleopold in https://github.com/stumpapp/stump/pull/1076
- ✨ Add tag assignment to books management by @Kernald in https://github.com/stumpapp/stump/pull/1077
- :globe_with_meridians: Update translations by @aaronleopold in https://github.com/stumpapp/stump/pull/1068
- :bug: Fix Swfit concurrency crash after expo SDK 55 upgrade by @aaronleopold in https://github.com/stumpapp/stump/pull/1079
- ✨ Add type-to-confirm dialog for library deletion by @Kernald in https://github.com/stumpapp/stump/pull/1078
- 🔨 Expand t() to take an optional record for interpolation by @Kernald in https://github.com/stumpapp/stump/pull/1084
- :bug: Fix HTML parsing for some ebook metadata fields by @aaronleopold in https://github.com/stumpapp/stump/pull/1080
- :adhesive_bandage: (expo): Fix iOS large title not collapsing on scroll by @aaronleopold in https://github.com/stumpapp/stump/pull/1085
- :wrench: Add optional env var to configure directory for Stump.log by @henrywhitaker3 in https://github.com/stumpapp/stump/pull/1082
- :recycle: Prefer semantic content types when possible by @aaronleopold in https://github.com/stumpapp/stump/pull/1088
- Basic Kobo sync implementation by @bct in https://github.com/stumpapp/stump/pull/1046
- 🐛 (expo): Fix various image reader bugs by @Arklaum in https://github.com/stumpapp/stump/pull/1091
- 🔨 Clean up Android development environment by @Kernald in https://github.com/stumpapp/stump/pull/1090
- :globe_with_meridians: Update translations by @aaronleopold in https://github.com/stumpapp/stump/pull/1081
- :twisted_rightwards_arrows: Merge
unstableintoexperimentalby @aaronleopold in https://github.com/stumpapp/stump/pull/1093 - :recycle: Expand t on mobile for interpolation by @Kernald in https://github.com/stumpapp/stump/pull/1094
- 🐛 Sort dynamically added tags alphabetically in TagSelect by @Kernald in https://github.com/stumpapp/stump/pull/1096
- :twisted_rightwards_arrows: Merge
experimentalintonightlyby @aaronleopold in https://github.com/stumpapp/stump/pull/1098 - ✨ Add tag assignment to series and inline tag creation by @Kernald in https://github.com/stumpapp/stump/pull/1097
- 🐛 Mark EPUB as 100% complete when reaching the final page by @season179 in https://github.com/stumpapp/stump/pull/1105
- :globe_with_meridians: Localize remaining keys for app appearance settings by @season179 in https://github.com/stumpapp/stump/pull/1109
- :sparkles: Intake tags from ComicInfo.xml during scans by @season179 in https://github.com/stumpapp/stump/pull/1110
- OPDS v2 fixes by @aaronleopold in https://github.com/stumpapp/stump/pull/1112
- :sparkles:/:recycle: (expo): Improved stats, grid vs list display, and various refactors by @aaronleopold in https://github.com/stumpapp/stump/pull/1113
- :globe_with_meridians: Update translations by @aaronleopold in https://github.com/stumpapp/stump/pull/1106
- :construction_worker: Remove
experimentalfrom release pipelines by @aaronleopold in https://github.com/stumpapp/stump/pull/1099 - 👷 Add OCI image labels for changelog/metadata discovery by @Kernald in https://github.com/stumpapp/stump/pull/1115
- 🐛 (expo): Fix image ratio in reader by @Arklaum in https://github.com/stumpapp/stump/pull/1117
- :globe_with_meridians: Update translations by @aaronleopold in https://github.com/stumpapp/stump/pull/1116
- 💄 (expo): Add blur to progress bars and smart list stats by @Arklaum in https://github.com/stumpapp/stump/pull/1120
- :globe_with_meridians: Update translations by @aaronleopold in https://github.com/stumpapp/stump/pull/1119
- 📌 (expo): Pin
@shopify/flash-listto2.1.0by @aaronleopold in https://github.com/stumpapp/stump/pull/1133 - :bug: Fix inverted query condition for series completion by @aaronleopold in https://github.com/stumpapp/stump/pull/1134
- :globe_with_meridians: Update translations by @aaronleopold in https://github.com/stumpapp/stump/pull/1121
- ⬆️ Bump react-hook-form from 7.68.0 to 7.74.0 by @dependabot[bot] in https://github.com/stumpapp/stump/pull/1131
- ⬆️ Bump ts-essentials from 10.1.1 to 10.2.0 by @dependabot[bot] in https://github.com/stumpapp/stump/pull/1129
- Fetch user info from OIDC provider by @ColonelThirtyTwo in https://github.com/stumpapp/stump/pull/1137
- 🐛(expo): Fix undefined image size by @Arklaum in https://github.com/stumpapp/stump/pull/1138
- 🐛 (expo): Fix header button colour for pre-ios 26 devices by @Arklaum in https://github.com/stumpapp/stump/pull/1141
- Expo fixes and improvements by @aaronleopold in https://github.com/stumpapp/stump/pull/1143
- :sparkles: Persist JWT secrets to database by @aaronleopold in https://github.com/stumpapp/stump/pull/1142
- ⬆️ Bump react-native-svg from 15.15.3 to 15.15.4 by @dependabot[bot] in https://github.com/stumpapp/stump/pull/1125
- ⬆️ Bump @0no-co/graphqlsp from 1.15.1 to 1.15.4 by @dependabot[bot] in https://github.com/stumpapp/stump/pull/1124
- ⬆️ Bump drizzle-orm from 0.44.7 to 0.45.2 by @dependabot[bot] in https://github.com/stumpapp/stump/pull/1130
- :bento: (expo): Increase canvas for Android app icons by @aaronleopold in https://github.com/stumpapp/stump/pull/1145
- ♻️ Exclude active series from on deck by @Arklaum in https://github.com/stumpapp/stump/pull/1146
- :adhesive_bandage: Restore position prefix by @aaronleopold in https://github.com/stumpapp/stump/pull/1149
- 🐛 Fix reading time updates for paged image reader by @Arklaum in https://github.com/stumpapp/stump/pull/1152
- :memo: Migrate docs to fumadocs by @aaronleopold in https://github.com/stumpapp/stump/pull/1155
- :recycle: Use consistent read time language by @aaronleopold in https://github.com/stumpapp/stump/pull/1154
- 🔖 Release v0.1.3 by @aaronleopold in https://github.com/stumpapp/stump/pull/1156
New Contributors
- @henrywhitaker3 made their first contribution in https://github.com/stumpapp/stump/pull/1082
- @season179 made their first contribution in https://github.com/stumpapp/stump/pull/1105
- @ColonelThirtyTwo made their first contribution in https://github.com/stumpapp/stump/pull/1137
Full Changelog: https://github.com/stumpapp/stump/compare/v0.1.2...v0.1.3
Breaking Changes
- Default user permissions have changed (e.g., ability to change password may be restricted).
Security Fixes
- CVE fixes addressed in pull request #1157
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About stump
A free and open source comics, manga and digital book server with OPDS support (WIP)
Related context
Beta — feedback welcome: [email protected]