Version 2.36.1 gives audiobooks a server built for them
Audiobookshelf v2.36.1 treats spoken-word media as the main job. It scans audiobook folders, streams common audio formats, remembers progress per user, downloads podcast episodes, and can merge tracks into an M4B. Chapter editing, metadata lookup, cover retrieval, open RSS feeds, and basic ebook reading sit beside playback. That focus matters when a general media server can play the files but does not understand the collection around them.
The checkout we measured was 14.2 MB, with 952 files and about 148,819 lines of source. That is a substantial application rather than a thin player wrapped around a folder. Multi-user permissions, automated backups, library watching, upload tools, Chromecast support, and web and mobile clients explain the size. They also create more state to protect than the audio files alone, especially playback positions and corrected metadata.
What happened when we ran it
Our sandbox installed 429 npm packages in 9 seconds, leaving 112 MB on disk. The repository did not expose a build script or target, so the build stage was skipped rather than counted as a pass. Its test command completed in 23 seconds. Mocha reported 354 passed and 0 failed out of 354, a clean result for the server code at commit 1e88ff0.
The uncomfortable result came from npm audit: 54 known vulnerabilities, split across 3 critical, 33 high, 8 moderate, and 10 low findings. The log supplied to us does not identify which packages are reachable in a deployed server, so we cannot turn that count into an exploit claim. A public deployment still needs the findings reviewed and either fixed, excluded with evidence, or accepted before it carries a household's accounts and listening history.
The 112 MB install still needs four persistent paths
Audiobookshelf used 112 MB after our root install, but the supported container carries the operational path most people should choose. The supplied compose file maps separate locations for audiobooks, podcasts, metadata, and config, then exposes host port 13378 to port 80 in the container. Its comment is unusually specific: config must live on the same physical machine as the server. That warning matters because the SQLite database sits there.
Source development has a wider set of chores than the 9-second root install suggests. The README calls for Node 20 and FFmpeg, a root install, another install inside client, a generated client, and a dev.js file with local paths. It recommends a VS Code dev container for the easier route. Reverse proxies must carry a WebSocket connection, and a subfolder works only at /audiobookshelf, not at an operator-selected path.
Version 2.36.1 does not settle playback and storage risks
Version 2.36.1 shipped on September 16, 2026, one day before the last recorded push. Its fixes include access checks on author endpoints, stricter accepted settings, safer cover formats, and SQLite binding installation under npm 12. That is current maintenance. It also means an older deployment may sit before security-relevant request handling changes, so release notes deserve the same attention as the container update itself.
Two open reports show why backups and recovery drills matter even after 354 tests pass. Issue 5188 describes an Android Auto sequence that reset a book's saved position. Issue 5349 reports the server exiting when a library scan hit SQLITE_BUSY alongside FFmpeg metadata work. A third, issue 5568, shows downloads returning 404 after stored inode values diverged, with repeated scans unable to repair them. These are reports, not proof that every server will fail the same way.
Twelve CI workflows support an active, crowded project
Our scan found 12 CI workflow files, a Dockerfile, a compose file, and a tests directory. GitHub recorded 14,371 stars, 1,190 combined issues and pull requests, and a push on September 17, 2026. Fresh issues and pull requests were still moving on September 18. The queue is large, but the recent release and activity do not look like an abandoned hobby server.
The client transition is the sharper contributor warning. The README says pull requests for the Vue frontend are not being reviewed or merged while a React rewrite is underway and says the replacement should arrive soon. Treat that wording as an aspiration, not a delivery date. The Android and iOS apps are still labeled beta, and Apple's 10,000-tester cap has left the iOS TestFlight full. Browser access remains the dependable common client.
All 354 tests passed, so the remaining decision is operational
A 354-of-354 test result makes Audiobookshelf easy to trial for the job it actually targets. Jellyfin is a better comparison when books share a server with films and television. Navidrome fits a music-first collection, while Audioserve suits someone who mainly wants folders exposed as streams. Audiobookshelf earns its extra moving parts when progress sync, chapters, podcast downloads, and separate user permissions will be used every week.
Our 23-second test run removes one source-level worry but leaves the 54 audit findings, fixed proxy rules, and mutable library database in your hands. Keep media, metadata, and config backups separate enough to restore. Pin a release instead of following an unexamined latest tag, test progress on the clients your household uses, and verify a download after storage changes. If those jobs sound reasonable, Audiobookshelf is the focused choice. If they sound like unpaid administration, a hosted audiobook service is the honest alternative.