Navidrome - Package Updates

[Package Updates]

[1.26.0]

• Update navidrome to 0.59.0
• Full Changelog
• Scanner Improvements: Selective folder scanning and enhancements to the file system watcher for better performance and reliability.
• Scrobble History: Native scrobble/listen history tracking, allowing Navidrome to keep a record of your listening habits. This will be used in future visualizations and features (Navidrome Wrapped maybe?).
• User Administration: New CLI commands for user management, making it easier to handle user accounts from the terminal.
• New Themes: Two new themes have been added: SquiddiesGlass and AMusic (Apple Music inspired).
• General: Numerous bug fixes, translation updates, and configuration options for advanced use cases.
• Add AMusic (Apple Music inspired) theme. (#4723 by @metalheim)
• Add SquiddiesGlass Theme. (#4632 by @rendergraf)
• Add loading state to artist action buttons for improved user experience. (f6b2ab572 by @deluan)
• Add SizeField to display total size in LibraryList. (73ec89e1a by @deluan)
• Update totalSize formatting to display two decimal places. (c3e8c6711 by @deluan)

[Package Updates]

[1.27.0]

• Update navidrome to 0.60.0
• Full Changelog
• This release introduces a major rewrite of the experimental Plugin System, now with multi-language PDK support, enabling developers to extend Navidrome's functionality using WebAssembly-based plugins written in Go, Rust, Python or JavaScript. Plugins run in a secure sandbox and can provide additional metadata sources, custom integrations, and server-side enhancements. Users can now easily configure plugins directly from the UI through a new JSONForms-based configuration interface.
• Additionally, this version includes a pure-Go metadata extractor built on top of the new go-taglib library. This is a significant step toward removing the C++ TagLib dependency, which will simplify cross-platform builds and packaging in future releases. The new extractor is activated by default, but in case of any issues you can revert to the previous implementation by setting Scanner.Extractor="legacy-taglib" configuration option.
• The Instant Mix feature generates a playlist of similar songs based on a selected track. By default, it retrieves similar songs from Last.fm (if configured with an API key) or falls back to Deezer. It can also be configured to use external plugins, like AudioMuse-AI for sonic analysis-based similarity recommendations.
• Fix potential XSS vulnerability by sanitizing user-supplied data before rendering (GHSA-rh3r-8pxm-hg4w). (d7ec735 by @AlexGustafsson)
• Fix potential DoS vulnerability in cover art upscaling by clamping requested square size to original dimensions (GHSA-hrr4-3wgr-68x3). (77367548 by @deluan). Thanks to @yunfachi
• Add new WebAssembly-based plugin system with multi-language PDK support (Go, Rust, Python). (#4833 by @deluan)
• Add JSONForms-based plugin configuration UI. (#4911 by @deluan)
• Add similar songs retrieval functions to plugins API. (#4933 by @deluan)
• Add pure-Go metadata extractor (go-taglib) as alternative to FFmpeg-based extraction. (#4902 by @deluan)

[Package Updates]

[1.27.1]

• Update navidrome to 0.60.2
• Full Changelog
• This release expands ListenBrainz integration with artist URLs and top/similar songs, adds OpenSubsonic readonly and validUntil properties for playlists, and includes several bug fixes for the UI, scanner, and plugin system.
• Add artist URL, top songs, and similar songs support to the ListenBrainz agent. (#4934 by @kgarner7)
• Add OpenSubsonic readonly and validUntil properties to playlists. (#4993 by @kgarner7)
• Add CallRaw method to SubsonicAPI host function with support for binary responses. (#4982 by @deluan)
• Fix Last.fm URL handling and Biographies rendering on artist page. (#4980 by @kgarner7)
• Fix Nautiline theme font path. (#4983 by @borisrorsvort)
• Preserve first line in parentheses in lyrics. (#4985 by @deluan)
• Clean up Last.fm content by removing "Read more" links from descriptions and bios. (e11206f0e by @deluan)
• Handle WASM runtime panics in gotaglib openFile function. (4e720ee93 by @deluan)

[Package Updates]

[1.27.2]

• Update navidrome to 0.60.3
• Full Changelog
• 34c6f12: feat(server): add explicit status support in smart playlists (#​5031) (@​kgarner7)
• 408aa78: fix(scanner): log warning when metadata extraction fails (@​deluan)
• ed79a88: fix(scanner): pass filename hint to gotaglib's OpenStream for format detection (#​5012) (@​deluan)
• fd09ca1: fix(scanner): resolve data race on conf.Server access in getScanner (@​deluan)
• 0a47228: fix(subsonic): validate JSONP callback parameter (@​deluan)
• eb9ebc3: fix(ui): add missing keys in Danish translation (#​5011) (@​denisarissa)
• 62f9c3a: fix: linux service should restart when upgrading (#​5001) (@​mintsoft)
• e05a7e2: fix: prevent data race on conf.Server during cleanup in e2e tests (@​deluan)
• bee0305: fix: split reflex -R flags to preserve directory exclusion optimization (@​deluan)

[Package Updates]

[1.28.0]

• Update navidrome to 0.61.0
• Full Changelog
• Remove built-in Spotify integration. The Spotify.ID and Spotify.Secret configuration options are no longer supported. Use the Last.fm or Deezer agents, or a plugin for similar functionality, like the new Apple Music Plugin. (#​5197 by @​deluan)
• Add per-disc cover art support, with configurable DiscArtPriority. (#​5182 by @​deluan)
• Add artist image uploads and image-folder artwork source. (#​5198 by @​deluan)
• Preserve animated image artwork (GIF, APNG, animated WebP) during resize. (#​5184 by @​deluan)
• Improve image serving performance with WebP encoding and optimized pipeline. (#​5181 by @​deluan)
• Increase cover art size to 600px and use CatmullRom scaling for sharper images. (cb396f3db by @​deluan)
• Fallback mediafile cover art to disc artwork before album. (#​5216 by @​deluan)
• Refresh stale artist image URLs on expiry. (#​5267 by @​deluan)
• Validate ffmpeg pipe before returning in cover art fallback. (420d2c8e5 by @​deluan)
• Search parent folders for album cover art in multi-disc layouts. (#​5157 by @​deluan)

[Package Updates]

[1.28.1]

• Update navidrome to 0.61.1
• Full Changelog
• This patch release addresses a WebP performance regression on low-power hardware introduced in v0.61.0, adds a new EnableWebPEncoding config option and a configurable UI cover art size, and includes several Subsonic API and translation fixes.
• | New | EnableWebPEncoding | Opt-in to WebP encoding for resized artwork. When false (default), Navidrome uses JPEG/PNG (preserving the original source format), avoiding the WebP WASM encoder overhead that caused slow image processing on low-power hardware in v0.61.0. Set to true to re-enable WebP output. Replaces the internal DevJpegCoverArt flag. (#​5286) | false |
• | New | UICoverArtSize | Size (in pixels, 2001200) of cover art requested by the web UI. It was increased from 300px to 600px in 0.61.0; now configurable and defaulting to 300px to reduce image encoding load on low-power hardware. Users on capable hardware can raise it for sharper thumbnails. (#​5286) | 300 |
• | Changed | DevArtworkMaxRequests | Default lowered from max(4, NumCPU) to max(2, NumCPU/2) to reduce load on low-power hardware. (#​5286). (Note: this is an internal configuration and can be removed in future releases) | max(2, NumCPU/2) |
• | Removed | DevJpegCoverArt | Replaced by the user-facing EnableWebPEncoding option. (#​5286) | |

[Package Updates]

[1.28.2]

• Update navidrome to 0.61.2
• Full Changelog
• Another round of bugfixes. Transcoding now properly clamps target channels to codec limits, WAV files play directly in browsers without unnecessary transcoding, and the scanner picks up ORIGYEAR tags for VorbisComment and MP4 formats. Cover art handling got a few fixes too, including configurable max upload size. Plugin developers now get the file path in TrackInfo for Scrobbler and Lyrics plugins.
• Prevent theme CSS filters from affecting disc cover art. (c91721363 by @​deluan)
• Refine image filters for playing and paused states in SquiddiesGlass theme. (4570dec67 by @​deluan)
• Update Chinese (Simplified) translation. (#​5323 by @​fxj368)
• Update Russian translations. (#​5329 by @​amakeenk)
• Map ORIGYEAR tag for VorbisComment and MP4 formats, bringing them in line with ID3. (#​5303 by @​obskyr)
• Fix issue with empty ID3v2 frames in go-taglib. (1de4e43d2 by @​deluan)
• Always emit required created field on AlbumID3 responses. (#​5340 by @​deluan)
• Make max image upload size configurable. (#​5335 by @​m8tec)
• Allow shared disc art from unnumbered filenames in single-folder albums. (#​5344 by @​deluan)

[Package Updates]

[1.29.0]

• Update navidrome to 0.62.0
• Full Changelog
• Fix cross-account disclosure of other users' shares (incl. share tokens) by enforcing per-user ownership on share reads. (1e7996f5d, GHSA-3g4p-jhv2-xrxf, reported by @Wernerina)
• Fix cross-tenant player takeover and share-update IDOR by enforcing ownership atomically on player and share updates. (#5563, GHSA-x65f-m8x9-pjxm reported by @tonghuaroot; GHSA-58gr-c777-g23p reported by @lighthousekeeper1212; GHSA-wx2c-q8g7-4q5p reported by @CE2Sec)
• Fix unauthenticated Last.fm scrobble session hijack (IDOR) by requiring a signed state token on the link callback. (#5521, GHSA-8jrh-w926-8rvw, reported by @geo-chen)
• Fix JWT expiration bypass on public share stream endpoints by validating token expiration and share existence. (#5426, GHSA-3rfj-qx9q-jghx, reported by @wooseokdotkim)
• Cap concurrent transcodes to prevent an ffmpeg-based denial of service, with new per-server and per-user limits. (#5522 by @deluan)
• Add EnforceNonRootUser option to exit early if Navidrome is started as root. (#5373 by @kopf)
• Replace UI scrobble with reportPlayback and redesign the Now Playing panel. (#5448 by @deluan)
• Add the sonicSimilarity extension as a plugin capability. (#5419 by @deluan)
• Add ReplayGain fields to the criteria system. (d9dac4445 by @deluan)
• Add isMissing and isPresent operators. (#5436 by @deluan)

[Package Updates]

[1.29.1]

• fix: default settings for Scanner.Schedule and CoverArtQuality

[Package Updates]

[1.30.0]

• Update navidrome to 0.63.0
• Full Changelog
• Enforce per-library access on playlist import and sharing paths. In multi-library setups, three read paths did not consistently apply per-library restrictions: M3U import path resolution, shared-playlist track loading, and public share-scoped streams. A user with access to only some libraries could resolve or be served tracks from libraries they weren't assigned to. All three now respect the user's (or share owner's) library access. (#5640 by @deluan)
• Add structured sidecar lyrics support with OpenSubsonic v2 karaoke cues and agent layers: TTML, ELRC, SRT and YAML sidecar files are now parsed with word-by-word timing and multi-voice information. (#5076 by @ranokay)
• Rank exact matches above prefix matches in search results. (#5704 by @deluan)
• Fix artists with short or non-ASCII names being unfindable after the FTS5 search migration. (#5703 by @deluan)
• Speed up getRandomSongs on large libraries with two-phase random selection, about 13x faster on a 1M-track library. (#5618 by @deluan)
• Speed up search3 empty-query (browse-all) pagination: response times are now flat at any offset, 30-50x faster at deep offsets, making a full ~1M-track library sync about 20x faster overall. (#5601 by @deluan)
• Enable sharing by default. (#5714 by @deluan)
• Add Scanner.ArtistSplitExceptions to protect artist names from being split by tag separators. (#5701 by @deluan)
• Fix partially-written transcodes being served from the cache after a server crash. (#5657 by @deluan)
• Add a navidrome plugin CLI for managing and inspecting plugins. (#5682 by @deluan)

[Package Updates]

[1.30.1]

• Update navidrome to 0.63.1
• Full Changelog
• fix(build): prevent 32-bit startup crash (segfault/SIGILL) in downloads binaries (#5739) (@deluan)
• fix(plugins): discard buffered scrobbles when a plugin is removed (#5737) (@deluan)
• fix(plugins): populate username for buffered plugin scrobbles (#5736) (@deluan)
• fix(service): rewrite systemd service template for kardianos/service v1.3.0 (#5743) (@deluan)

[Package Updates]

[1.30.2]

• Update navidrome to 0.63.2
• Full Changelog
• fix(plugins): surface host service failures when loading plugins (#5756) (@deluan)
• fix(scanner): resolve file symlinks with the production local storage FS (#5755) (@deluan)
• fix(smartplaylist): reject NSP mixing top-level 'any' and 'all' (#5759) (@deluan)