Ampache - Package Updates

Package Updates

[1.27.0]

Package Updates

[1.28.0]

Update ampache to 8.0.0
Full Changelog
This version adds a new Folder domain which functions as a virtual filesystem browsing layer over catalog files.
OpenID Connect (OIDC) login
Play history consolidation
Multi select
OpenSubsonic implementation audited against the published specification on 2026-08-07
New per-user Subsonic Password set from the account page, the admin user edit page, or bin/cli admin:updateUser <username> --subsonic <password>, so token auth works without pasting your API key into a music player
A collection is a hand-curated list of objects of any type: the static counterpart to a search, and the non-media counterpart to a playlist.
direct_play_limit: any existing "unlimited" (0) value is reset to a default cap of 500 tracks
The popup web player is removed (web_player.php, create_web_player.inc.php). Playback is always the embedded player at the bottom of the page. NOTE if you used the popup to keep the player in a separate window, there is no replacement for it

Package Updates

[1.29.0]

Package Updates

[1.29.1]

Update ampache to 8.0.1
Full Changelog
Show Catalog name on song pages
Increase redirect count on Podcast Episode download from 5 to 10
Lock database connection on catalog actions to avoid repeats and deadlocks
An unrecognised transcode_TYPE value (e.g. transcode_mp3 = "falsed") no longer counts as enabling transcoding; only allowed, required and false are accepted and anything else is logged and treated as false
Many possible nullable database column issues fixed
Don't lock the UI on larger click operations. (e.g. Album delete)
Core::generate_random_key() hashed a predictable seed instead of drawing directly from a secure random source; it backs session ids, api keys and the CSRF form token, and now uses random_bytes() for the full 128 bits
Login compared the stored password hash to the submitted one with ==/in_array() instead of a constant-time comparison; both now use hash_equals()
A podcast feed's own <title> was used unsanitized as a folder name, so a hostile feed containing ../ could create directories and write episode files outside the catalog
New users are given the default transcode_bitrate of 128000 bps instead of 32

Package Updates

[1.30.0]

Update ampache to 8.1.0
Full Changelog
Proof of work checks in front of the endpoints bots hammer
Database 810011: New album.enabled and artist.enabled, so a release can be withdrawn without deleting it and losing its playlist entries, ratings and play history
New album_grouping_fields option controlling which fields decide whether two songs share an album row
Drawn cover art for items that have none: an album gets a record, an artist a medallion, an orphaned song a waveform, a playlist a tracklist
The OPML export of podcast subscriptions read every podcast in the system regardless of the caller's catalog filter, letting a restricted user enumerate the subscriptions of catalogs they cannot browse
A username was used raw as an upload folder name, so ../.. escaped the catalog. Path segments are no longer allowed in username
A disabled user account could still authenticate through Subsonic and an RSS feed token
Password/token comparisons in the API handshake, the session_remember cookie MAC, and API key/stream token lookups used ===/!= instead of hash_equals()
Ldap::auth() concatenated the raw username into the LDAP search filter and group-membership regex with no escaping
Private playlists and searches leaked through several endpoints: web smartlist, Subsonic getPlaylist/getPlaylists

Package Updates

[1.31.0]

Update ampache to 8.2.2
Full Changelog
Jellyfin API: Third-party Jellyfin clients can now browse and stream Ampache libraries through a new optional Jellyfin-compatible API. https://ampache.org/docs/configuration/jellyfin/
Dragging to reorder a playlist or a song list now works on a touch screen
login.php redirected straight back to update.php with a pending database update, looping forever (ERR_TOO_MANY_REDIRECTS) instead of showing the login form
preferences.php?action=user, which required admin but only ever showed your own preferences
update.php skipped auth based on a request parameter, letting anyone reach the update dispatcher
batch.php skipped catalog scoping for stream-session requests, allowing bulk download outside the catalog filter
lost_password is now disabled by default, and blocked for Content Manager, Manager and Admin accounts
Subsonic search3 rejected an empty query (regression since 7.10.0/8.1.0); restored search2's "browse everything" behaviour
deleted_songs API always returning an empty result
Header-authenticated session ids were md5(username), guessable from a username; now derived from the credential

Package Updates

[1.32.0]

Update ampache to 8.3.0
Full Changelog
Playlist Folders with folder sharing, hiding, and API support (playlist_folder_create, playlist_folder_edit, playlist_folders)
Search rules now support grouping with AND/OR match, last_play/last_skip suffixes, "is not before"/"is not after" operators, and Length/Size Limit options
ID3v2 SYLT frames are read for lyrics, preferred over plain USLT text when a file carries both
The web player and API player can report a pause, clearing now_playing until play resumes
Re-identifying an album or artist during a catalog scan dropped a user's rating/flag/tag/mood/catalog mapping instead of merging it
Rating a song wiped every other tag (title, artist, album, genre, ...) on its mp3 file instead of preserving them
Writing tags to an mp3 dropped the track/disc total from TRCK/TPOS, leaving only the bare number
stats (API6, API8) - filter=flagged, newest, highest, frequent, recent and forgotten all reported total_count for the whole catalog instead of the actual result count; random is unaffected, since it is a sample of the catalog by design
playlists, user_playlists (API6, API8) - include=songs on a very large library could exhaust memory; the response is now capped at 200,000 rows
A CLI install never enabled the default plugins (HomeDashboard, Catalog Favorites, Personal Favorites)

Package Updates

[1.33.0]

Package Updates

[1.33.1]

Package Updates

[1.34.0]

Update ampache to 8.4.0
Full Changelog
reborn gains four new colors: Dusk, Dawn, Sepia and High-Contrast
reborn gains nine colors modeled on Nord, Dracula, Gruvbox, Catppuccin Mocha, Tokyo Night, Monokai, Ros Pine, Solarized Dark and Solarized Light
New catalog_clean_empty_dirs key; Clean/Garbage Collection/Scan Folder can now also remove an empty directory from disk, not just its row
New folder search type (name, path, parent folder, catalog, ratings, play counts, dates), web Search page and API8 advanced_search
Grid view browses (album, artist, playlist, etc.) gain a Sort By control, like the list view already had
Removed the Amazon art search plugin; Amazon shut down the API it used years ago
Deleting an album_disk row now removes just that disk; the album itself goes once its last disk is gone
Add, Clean and Verify maintain catalog_map and album/artist counts per row, instead of a full resync after every scan
getIndexes could drop artists from a catalog whose folder data was incomplete, not just when it was empty
The native API's folders action returned nothing for every catalog and every user

Cloudron Forum