[1.29.0]
Update navidrome to 0.62.0
Full Changelog
Fix cross-account disclosure of other users' shares (incl. share tokens) by enforcing per-user ownership on share reads. (1e7996f5d, GHSA-3g4p-jhv2-xrxf, reported by @Wernerina)
Fix cross-tenant player takeover and share-update IDOR by enforcing ownership atomically on player and share updates. (#5563, GHSA-x65f-m8x9-pjxm reported by @tonghuaroot; GHSA-58gr-c777-g23p reported by @lighthousekeeper1212; GHSA-wx2c-q8g7-4q5p reported by @CE2Sec)
Fix unauthenticated Last.fm scrobble session hijack (IDOR) by requiring a signed state token on the link callback. (#5521, GHSA-8jrh-w926-8rvw, reported by @geo-chen)
Fix JWT expiration bypass on public share stream endpoints by validating token expiration and share existence. (#5426, GHSA-3rfj-qx9q-jghx, reported by @wooseokdotkim)
Cap concurrent transcodes to prevent an ffmpeg-based denial of service, with new per-server and per-user limits. (#5522 by @deluan)
Add EnforceNonRootUser option to exit early if Navidrome is started as root. (#5373 by @kopf)
Replace UI scrobble with reportPlayback and redesign the Now Playing panel. (#5448 by @deluan)
Add the sonicSimilarity extension as a plugin capability. (#5419 by @deluan)
Add ReplayGain fields to the criteria system. (d9dac4445 by @deluan)
Add isMissing and isPresent operators. (#5436 by @deluan)