Ampache - Package Updates

Package Updates

[1.27.0]

Package Updates

[1.28.0]

Update ampache to 8.0.0
Full Changelog
This version adds a new Folder domain which functions as a virtual filesystem browsing layer over catalog files.
OpenID Connect (OIDC) login
Play history consolidation
Multi select
OpenSubsonic implementation audited against the published specification on 2026-08-07
New per-user Subsonic Password set from the account page, the admin user edit page, or bin/cli admin:updateUser <username> --subsonic <password>, so token auth works without pasting your API key into a music player
A collection is a hand-curated list of objects of any type: the static counterpart to a search, and the non-media counterpart to a playlist.
direct_play_limit: any existing "unlimited" (0) value is reset to a default cap of 500 tracks
The popup web player is removed (web_player.php, create_web_player.inc.php). Playback is always the embedded player at the bottom of the page. NOTE if you used the popup to keep the player in a separate window, there is no replacement for it

Package Updates

[1.29.0]

Package Updates

[1.29.1]

Update ampache to 8.0.1
Full Changelog
Show Catalog name on song pages
Increase redirect count on Podcast Episode download from 5 to 10
Lock database connection on catalog actions to avoid repeats and deadlocks
An unrecognised transcode_TYPE value (e.g. transcode_mp3 = "falsed") no longer counts as enabling transcoding; only allowed, required and false are accepted and anything else is logged and treated as false
Many possible nullable database column issues fixed
Don't lock the UI on larger click operations. (e.g. Album delete)
Core::generate_random_key() hashed a predictable seed instead of drawing directly from a secure random source; it backs session ids, api keys and the CSRF form token, and now uses random_bytes() for the full 128 bits
Login compared the stored password hash to the submitted one with ==/in_array() instead of a constant-time comparison; both now use hash_equals()
A podcast feed's own <title> was used unsanitized as a folder name, so a hostile feed containing ../ could create directories and write episode files outside the catalog
New users are given the default transcode_bitrate of 128000 bps instead of 32

Package Updates

[1.30.0]

Update ampache to 8.1.0
Full Changelog
Proof of work checks in front of the endpoints bots hammer
Database 810011: New album.enabled and artist.enabled, so a release can be withdrawn without deleting it and losing its playlist entries, ratings and play history
New album_grouping_fields option controlling which fields decide whether two songs share an album row
Drawn cover art for items that have none: an album gets a record, an artist a medallion, an orphaned song a waveform, a playlist a tracklist
The OPML export of podcast subscriptions read every podcast in the system regardless of the caller's catalog filter, letting a restricted user enumerate the subscriptions of catalogs they cannot browse
A username was used raw as an upload folder name, so ../.. escaped the catalog. Path segments are no longer allowed in username
A disabled user account could still authenticate through Subsonic and an RSS feed token
Password/token comparisons in the API handshake, the session_remember cookie MAC, and API key/stream token lookups used ===/!= instead of hash_equals()
Ldap::auth() concatenated the raw username into the LDAP search filter and group-membership regex with no escaping
Private playlists and searches leaked through several endpoints: web smartlist, Subsonic getPlaylist/getPlaylists

Cloudron Forum