Linkwarden 2.17.0 went up on 10 November, and the line that makes it more than a feature release is the security one. Linkwarden “keeps a permanent snapshot of the content of the links you save”, which is why people point it at a server and leave it there. It is the same instinct as Readeck’s saved pages, pointed at bookmarks instead of reading.

The security fix, as far as it goes

The release says it “fixes a number of moderate-severity security issues, thanks to everyone who reported them responsibly”. Then: “We recommend updating to 2.17.”

That is all of it. There is no CVE list and no count in the release, so nothing here claims what the issues were or who they affected. Updating is the action.

Two account changes you will feel

“Changing your password now signs you out on every other device and revokes your access tokens.” A reset is wider: “Resetting a forgotten password signs you out everywhere.” The release spells out what that means for anything holding a token. “If you use the browser extension or integrations like Floccus with an access token, you’ll need to sign them back in afterwards.”

The second is slower guessing. “After 15 wrong passwords in a row, an account accepts only one attempt every 25 seconds.” The release says this makes guessing much slower “without locking you out of your own account”. That is the trade: no lockout to recover from, but a rate that makes a dictionary attack impractical.

What changes day to day

“You can now drag the links inside a collection into any order you like.” Custom Order is the default sort now, the order is saved with the collection, and new links land at the top. Date or name sorting stays in the sort menu.

Long collections also got cheaper to render: “Links, collections, and tags now only render what’s on screen”, so a few thousand links keep scrolling. On mobile, the new link sheet takes a link’s name, collection, tags, description and banner before it saves, instead of making you edit afterwards. Email verification now arrives as “a 6-digit code” rather than a sign-in link.

For self-hosters

Self-hosted instances “can now replace the prompt sent to the model for each AI tagging method”. The three environment variables are AI_GENERATE_TAGS_PROMPT, AI_PREDEFINED_TAGS_PROMPT and AI_EXISTING_TAGS_PROMPT.

Imports now keep the order of their original dates whatever order they arrive in, Wallabag dates are read correctly, and larger imports are more reliable. The extension adds a shortcut worth learning: type lw, press space, then the query, and the search runs against your own links. It works in Chrome, Firefox and other Chromium browsers.

What this piece does not cover

Only the release body was read. Linkwarden’s documentation was not. Nothing here covers what those three prompt variables default to, how they are formatted, or which issues the security fixes address. No hands-on testing was done, and the release’s four screenshots were not used.

Update for the fixes, and expect to sign the extension back in the next time you change your password.

Sources: Linkwarden’s v2.17.0 release record, published 10 November 2026.

Written from the release body alone. Nothing was installed, and no instance was running while this was written.