Navidrome - Package Updates

[Package Updates]

[1.29.1]

• fix: default settings for Scanner.Schedule and CoverArtQuality

[Package Updates]

[1.30.0]

• Update navidrome to 0.63.0
• Full Changelog
• Enforce per-library access on playlist import and sharing paths. In multi-library setups, three read paths did not consistently apply per-library restrictions: M3U import path resolution, shared-playlist track loading, and public share-scoped streams. A user with access to only some libraries could resolve or be served tracks from libraries they weren't assigned to. All three now respect the user's (or share owner's) library access. (#5640 by @deluan)
• Add structured sidecar lyrics support with OpenSubsonic v2 karaoke cues and agent layers: TTML, ELRC, SRT and YAML sidecar files are now parsed with word-by-word timing and multi-voice information. (#5076 by @ranokay)
• Rank exact matches above prefix matches in search results. (#5704 by @deluan)
• Fix artists with short or non-ASCII names being unfindable after the FTS5 search migration. (#5703 by @deluan)
• Speed up getRandomSongs on large libraries with two-phase random selection, about 13x faster on a 1M-track library. (#5618 by @deluan)
• Speed up search3 empty-query (browse-all) pagination: response times are now flat at any offset, 30-50x faster at deep offsets, making a full ~1M-track library sync about 20x faster overall. (#5601 by @deluan)
• Enable sharing by default. (#5714 by @deluan)
• Add Scanner.ArtistSplitExceptions to protect artist names from being split by tag separators. (#5701 by @deluan)
• Fix partially-written transcodes being served from the cache after a server crash. (#5657 by @deluan)
• Add a navidrome plugin CLI for managing and inspecting plugins. (#5682 by @deluan)

[Package Updates]

[1.30.1]

• Update navidrome to 0.63.1
• Full Changelog
• fix(build): prevent 32-bit startup crash (segfault/SIGILL) in downloads binaries (#5739) (@deluan)
• fix(plugins): discard buffered scrobbles when a plugin is removed (#5737) (@deluan)
• fix(plugins): populate username for buffered plugin scrobbles (#5736) (@deluan)
• fix(service): rewrite systemd service template for kardianos/service v1.3.0 (#5743) (@deluan)

[Package Updates]

[1.30.2]

• Update navidrome to 0.63.2
• Full Changelog
• fix(plugins): surface host service failures when loading plugins (#5756) (@deluan)
• fix(scanner): resolve file symlinks with the production local storage FS (#5755) (@deluan)
• fix(smartplaylist): reject NSP mixing top-level 'any' and 'all' (#5759) (@deluan)

[Package Updates]

[1.31.0]

• Update navidrome to 0.64.0
• Full Changelog
• All internal IDs are re-encoded to a single canonical 128-bit base62 format. The migration touches every table, so back up your database before upgrading. Clients that cache item IDs (for example, offline downloads) may need to re-sync. (#5824)
• Plugin authors: Extism's built-in HTTP is disabled. Calls through pdk.NewHTTPRequest (Go), http::request (Rust) or the equivalent in other PDKs now fail with HTTP request ... is not allowed. Plugins must use the host HTTP service instead: host.HTTPSend (Go) or nd_pdk::host::http::send (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's requiredHosts, or use a bare "*". (1a8463f7d, 276d767ce)
• Shares are always owned by the user who creates them. Admins can no longer create shares on behalf of another user via userId. (1a8463f7d)
• Configuration durations are now validated. Negative values are rejected at startup. (#6002)
• Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with Jellyfin.Enabled = true. (#5730 by @deluan)
• Add Refresh Metadata action to album and artist pages and context menus. (#6036, #6078 by @deluan)
• Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. (#5805 by @deluan)
• Add Catppuccin Mocha and Frapp themes, and update Macchiato to match the official palette. (#5835 by @cmyksoda)
• Fix logins sometimes showing the wrong user. (#5882 by @deluan, #5767 by @apkatsikas)
• Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. (#6105 by @deluan)

[Package Updates]

[1.31.1]

• Update navidrome to 0.64.1
• Full Changelog
• Unauthenticated password brute-force through the Subsonic API. Failed Subsonic logins were never throttled, so an attacker could guess passwords at full speed. Navidrome now rate limits failed authentication attempts. High, CVSS 7.4. (GHSA-p994-r776-mw52, #6185) Reported by @osageling.
• Authenticated SSRF through M3U external album artwork. A playlist could point #EXTALBUMARTURL at a private or loopback address, turning the server into a probe for internal network services. Navidrome now blocks private and loopback addresses in remote image fetches. Medium, CVSS 6.5. (GHSA-8hjf-6h34-82hr, #6181) Reported by @kaardeco.
• Cross-library file read through the M3U playlist cover. #EXTALBUMARTURL also accepted a local path, so a playlist could serve any file the server can read as its cover image. Only real image files are accepted as local artwork sources now. Medium, CVSS 6.5. (GHSA-vwq6-xrw5-phpg, #6180) Reported by @qrn12580.
• Player takeover by any authenticated user. Creating a player could overwrite an existing record and reassign its owner, and device registration reused another user's player without an ownership check. Both paths now check the owner. Medium, CVSS 6.4. (GHSA-37h4-53gj-cw8m, #6184) Reported by @RealFakeAccount and @qrn12580.
• Library filter skipped on bookmarks, playlist tracks and now-playing. These three endpoints ignored the libraries a user is allowed to see, leaking track metadata from other libraries. The filter now applies to all of them. Medium, CVSS 4.3. (GHSA-pcjv-h48m-833g, #6179) Reported by @sondt99.
• Add Quick Connect sign-in. The client shows a short code, and you approve it from a session that is already signed in, so the client never sees your password. (#6174 by @deluan)
• Add opt-in LAN auto-discovery, so Jellyfin clients find the server without you typing its address. Docker users need host networking for the UDP broadcast to reach the container. (#6169 by @deluan)
• Format dates using the language selected in Personal settings, instead of always following the browser locale. (#6160 by @deluan)
• Reference another playlist by its path in a smart playlist rule, instead of by id. (#5187 by @davidvedvick)
• Double-encode plus signs in artist and track names sent to Last.fm, so tracks with a + in the name scrobble correctly. (#6158 by @deluan)