Navidrome - Package Updates

[Package Updates]

[1.27.1]

• Update navidrome to 0.60.2
• Full Changelog
• This release expands ListenBrainz integration with artist URLs and top/similar songs, adds OpenSubsonic readonly and validUntil properties for playlists, and includes several bug fixes for the UI, scanner, and plugin system.
• Add artist URL, top songs, and similar songs support to the ListenBrainz agent. (#4934 by @kgarner7)
• Add OpenSubsonic readonly and validUntil properties to playlists. (#4993 by @kgarner7)
• Add CallRaw method to SubsonicAPI host function with support for binary responses. (#4982 by @deluan)
• Fix Last.fm URL handling and Biographies rendering on artist page. (#4980 by @kgarner7)
• Fix Nautiline theme font path. (#4983 by @borisrorsvort)
• Preserve first line in parentheses in lyrics. (#4985 by @deluan)
• Clean up Last.fm content by removing "Read more" links from descriptions and bios. (e11206f0e by @deluan)
• Handle WASM runtime panics in gotaglib openFile function. (4e720ee93 by @deluan)

[Package Updates]

[1.27.2]

• Update navidrome to 0.60.3
• Full Changelog
• 34c6f12: feat(server): add explicit status support in smart playlists (#​5031) (@​kgarner7)
• 408aa78: fix(scanner): log warning when metadata extraction fails (@​deluan)
• ed79a88: fix(scanner): pass filename hint to gotaglib's OpenStream for format detection (#​5012) (@​deluan)
• fd09ca1: fix(scanner): resolve data race on conf.Server access in getScanner (@​deluan)
• 0a47228: fix(subsonic): validate JSONP callback parameter (@​deluan)
• eb9ebc3: fix(ui): add missing keys in Danish translation (#​5011) (@​denisarissa)
• 62f9c3a: fix: linux service should restart when upgrading (#​5001) (@​mintsoft)
• e05a7e2: fix: prevent data race on conf.Server during cleanup in e2e tests (@​deluan)
• bee0305: fix: split reflex -R flags to preserve directory exclusion optimization (@​deluan)

[Package Updates]

[1.28.0]

• Update navidrome to 0.61.0
• Full Changelog
• Remove built-in Spotify integration. The Spotify.ID and Spotify.Secret configuration options are no longer supported. Use the Last.fm or Deezer agents, or a plugin for similar functionality, like the new Apple Music Plugin. (#​5197 by @​deluan)
• Add per-disc cover art support, with configurable DiscArtPriority. (#​5182 by @​deluan)
• Add artist image uploads and image-folder artwork source. (#​5198 by @​deluan)
• Preserve animated image artwork (GIF, APNG, animated WebP) during resize. (#​5184 by @​deluan)
• Improve image serving performance with WebP encoding and optimized pipeline. (#​5181 by @​deluan)
• Increase cover art size to 600px and use CatmullRom scaling for sharper images. (cb396f3db by @​deluan)
• Fallback mediafile cover art to disc artwork before album. (#​5216 by @​deluan)
• Refresh stale artist image URLs on expiry. (#​5267 by @​deluan)
• Validate ffmpeg pipe before returning in cover art fallback. (420d2c8e5 by @​deluan)
• Search parent folders for album cover art in multi-disc layouts. (#​5157 by @​deluan)

[Package Updates]

[1.28.1]

• Update navidrome to 0.61.1
• Full Changelog
• This patch release addresses a WebP performance regression on low-power hardware introduced in v0.61.0, adds a new EnableWebPEncoding config option and a configurable UI cover art size, and includes several Subsonic API and translation fixes.
• | New | EnableWebPEncoding | Opt-in to WebP encoding for resized artwork. When false (default), Navidrome uses JPEG/PNG (preserving the original source format), avoiding the WebP WASM encoder overhead that caused slow image processing on low-power hardware in v0.61.0. Set to true to re-enable WebP output. Replaces the internal DevJpegCoverArt flag. (#​5286) | false |
• | New | UICoverArtSize | Size (in pixels, 2001200) of cover art requested by the web UI. It was increased from 300px to 600px in 0.61.0; now configurable and defaulting to 300px to reduce image encoding load on low-power hardware. Users on capable hardware can raise it for sharper thumbnails. (#​5286) | 300 |
• | Changed | DevArtworkMaxRequests | Default lowered from max(4, NumCPU) to max(2, NumCPU/2) to reduce load on low-power hardware. (#​5286). (Note: this is an internal configuration and can be removed in future releases) | max(2, NumCPU/2) |
• | Removed | DevJpegCoverArt | Replaced by the user-facing EnableWebPEncoding option. (#​5286) | |

[Package Updates]

[1.28.2]

• Update navidrome to 0.61.2
• Full Changelog
• Another round of bugfixes. Transcoding now properly clamps target channels to codec limits, WAV files play directly in browsers without unnecessary transcoding, and the scanner picks up ORIGYEAR tags for VorbisComment and MP4 formats. Cover art handling got a few fixes too, including configurable max upload size. Plugin developers now get the file path in TrackInfo for Scrobbler and Lyrics plugins.
• Prevent theme CSS filters from affecting disc cover art. (c91721363 by @​deluan)
• Refine image filters for playing and paused states in SquiddiesGlass theme. (4570dec67 by @​deluan)
• Update Chinese (Simplified) translation. (#​5323 by @​fxj368)
• Update Russian translations. (#​5329 by @​amakeenk)
• Map ORIGYEAR tag for VorbisComment and MP4 formats, bringing them in line with ID3. (#​5303 by @​obskyr)
• Fix issue with empty ID3v2 frames in go-taglib. (1de4e43d2 by @​deluan)
• Always emit required created field on AlbumID3 responses. (#​5340 by @​deluan)
• Make max image upload size configurable. (#​5335 by @​m8tec)
• Allow shared disc art from unnumbered filenames in single-folder albums. (#​5344 by @​deluan)

[Package Updates]

[1.29.0]

• Update navidrome to 0.62.0
• Full Changelog
• Fix cross-account disclosure of other users' shares (incl. share tokens) by enforcing per-user ownership on share reads. (1e7996f5d, GHSA-3g4p-jhv2-xrxf, reported by @Wernerina)
• Fix cross-tenant player takeover and share-update IDOR by enforcing ownership atomically on player and share updates. (#5563, GHSA-x65f-m8x9-pjxm reported by @tonghuaroot; GHSA-58gr-c777-g23p reported by @lighthousekeeper1212; GHSA-wx2c-q8g7-4q5p reported by @CE2Sec)
• Fix unauthenticated Last.fm scrobble session hijack (IDOR) by requiring a signed state token on the link callback. (#5521, GHSA-8jrh-w926-8rvw, reported by @geo-chen)
• Fix JWT expiration bypass on public share stream endpoints by validating token expiration and share existence. (#5426, GHSA-3rfj-qx9q-jghx, reported by @wooseokdotkim)
• Cap concurrent transcodes to prevent an ffmpeg-based denial of service, with new per-server and per-user limits. (#5522 by @deluan)
• Add EnforceNonRootUser option to exit early if Navidrome is started as root. (#5373 by @kopf)
• Replace UI scrobble with reportPlayback and redesign the Now Playing panel. (#5448 by @deluan)
• Add the sonicSimilarity extension as a plugin capability. (#5419 by @deluan)
• Add ReplayGain fields to the criteria system. (d9dac4445 by @deluan)
• Add isMissing and isPresent operators. (#5436 by @deluan)

[Package Updates]

[1.29.1]

• fix: default settings for Scanner.Schedule and CoverArtQuality

[Package Updates]

[1.30.0]

• Update navidrome to 0.63.0
• Full Changelog
• Enforce per-library access on playlist import and sharing paths. In multi-library setups, three read paths did not consistently apply per-library restrictions: M3U import path resolution, shared-playlist track loading, and public share-scoped streams. A user with access to only some libraries could resolve or be served tracks from libraries they weren't assigned to. All three now respect the user's (or share owner's) library access. (#5640 by @deluan)
• Add structured sidecar lyrics support with OpenSubsonic v2 karaoke cues and agent layers: TTML, ELRC, SRT and YAML sidecar files are now parsed with word-by-word timing and multi-voice information. (#5076 by @ranokay)
• Rank exact matches above prefix matches in search results. (#5704 by @deluan)
• Fix artists with short or non-ASCII names being unfindable after the FTS5 search migration. (#5703 by @deluan)
• Speed up getRandomSongs on large libraries with two-phase random selection, about 13x faster on a 1M-track library. (#5618 by @deluan)
• Speed up search3 empty-query (browse-all) pagination: response times are now flat at any offset, 30-50x faster at deep offsets, making a full ~1M-track library sync about 20x faster overall. (#5601 by @deluan)
• Enable sharing by default. (#5714 by @deluan)
• Add Scanner.ArtistSplitExceptions to protect artist names from being split by tag separators. (#5701 by @deluan)
• Fix partially-written transcodes being served from the cache after a server crash. (#5657 by @deluan)
• Add a navidrome plugin CLI for managing and inspecting plugins. (#5682 by @deluan)

[Package Updates]

[1.30.1]

• Update navidrome to 0.63.1
• Full Changelog
• fix(build): prevent 32-bit startup crash (segfault/SIGILL) in downloads binaries (#5739) (@deluan)
• fix(plugins): discard buffered scrobbles when a plugin is removed (#5737) (@deluan)
• fix(plugins): populate username for buffered plugin scrobbles (#5736) (@deluan)
• fix(service): rewrite systemd service template for kardianos/service v1.3.0 (#5743) (@deluan)

[Package Updates]

[1.30.2]

• Update navidrome to 0.63.2
• Full Changelog
• fix(plugins): surface host service failures when loading plugins (#5756) (@deluan)
• fix(scanner): resolve file symlinks with the production local storage FS (#5755) (@deluan)
• fix(smartplaylist): reject NSP mixing top-level 'any' and 'all' (#5759) (@deluan)