Repository navigation
fix(subsonic): report AAC streams as audio/aac instead of audio/mp4 - #5998
Conversation
Strix Security ReviewNo security issues found. Updated for Reviewed by Strix |
|
Hey @justadityaraj Thanks for the PR. I verified this end to end: streamed a song with One change I'd like before merging: please drop
The one line change in the yaml is the whole fix, and it stands on its own. Also, the branch is behind master now, so it needs a rebase. Thanks! |
The default AAC transcode emits raw ADTS (`ffmpeg ... -f adts -`), but the MIME table mapped `.aac` to `audio/mp4`. Clients that dispatch strictly on Content-Type could reject the stream because the declared container did not match the payload. `.m4a` and `.alac` stay on `audio/mp4`, since those really are MP4. Fixes navidrome#5958 Signed-off-by: Aditya Raj Singh <[email protected]>
dabaf5d to
46aa21f
Compare
|
Thanks,, dropped I also dropped a stray end-of-file newline tweak that had crept in, so the diff is now literally the one line in +Rebased onto current master and squashed to a single commit. |
##### [\`0.64.0\`](https://github.com/navidrome/navidrome/releases/tag/v0.64.0) This release brings an **experimental Jellyfin Music API**, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a **new background pipeline** with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a **uniform canonical 128-bit format**, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling. #####⚠️ Breaking Changes / Migration Notes - **All internal IDs are re-encoded** to a single canonical 128-bit base62 format. The migration touches every table, so **back up your database before upgrading**. Clients that cache item IDs (for example, offline downloads) may need to re-sync. ([#5824](navidrome/navidrome#5824)) - **Plugin authors: Extism's built-in HTTP is disabled.** Calls through `pdk.NewHTTPRequest` (Go), `http::request` (Rust) or the equivalent in other PDKs now fail with `HTTP request ... is not allowed`. Plugins must use the host HTTP service instead: `host.HTTPSend` (Go) or `nd_pdk::host::http::send` (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's `requiredHosts`, or use a bare `"*"`. ([1a8463f7d](navidrome/navidrome@1a8463f7d), [276d767ce](navidrome/navidrome@276d767ce)) - **Shares are always owned by the user who creates them.** Admins can no longer create shares on behalf of another user via `userId`. ([1a8463f7d](navidrome/navidrome@1a8463f7d)) - **Configuration durations are now validated.** Negative values are rejected at startup. ([#6002](navidrome/navidrome#6002)) - Navidrome now **warns about unrecognized options** in the config file, so typos no longer fail silently. ([#5870](navidrome/navidrome#5870)) ##### Security This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them. - Fix SQL injection via the artist `role` sort and filter parameters in the Native API by validating the role against the known list. ([4168377b6](navidrome/navidrome@4168377b6), [GHSA-hm54-32q6-3rcr](GHSA-hm54-32q6-3rcr), reported and fixed by [@Sudo-Ivan](https://github.com/Sudo-Ivan)) - Fix share-ownership spoofing (IDOR) that let a client-supplied `userId` on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. ([1a8463f7d](navidrome/navidrome@1a8463f7d), [GHSA-82gh-4ggp-gfg5](GHSA-82gh-4ggp-gfg5), reported by [@gigioneggiando](https://github.com/gigioneggiando)) - Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. ([276d767ce](navidrome/navidrome@276d767ce), [GHSA-pr2j-mfc8-qjcc](GHSA-pr2j-mfc8-qjcc), reported by [@qrn12580](https://github.com/qrn12580)) - Fix login rate limit bypass via spoofed `X-Forwarded-For`, `X-Real-IP` and `True-Client-IP` headers by keying the limit on the trust-aware client IP. ([#6124](navidrome/navidrome#6124), [GHSA-f295-6wp9-qqfg](GHSA-f295-6wp9-qqfg), reported by [@gehan-psbc](https://github.com/gehan-psbc) and [@skarn958](https://github.com/skarn958)) - Fix memory exhaustion via a negative `size` parameter on `getCoverArt` and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. ([#5847](navidrome/navidrome#5847), [GHSA-f22h-6qxh-rqq2](GHSA-f22h-6qxh-rqq2), reported by [@arpitjain099](https://github.com/arpitjain099)) - Enforce track membership on public share streams so a share can only stream the tracks it contains. ([#5769](navidrome/navidrome#5769) by [@deluan](https://github.com/deluan)) - Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. ([#6098](navidrome/navidrome#6098) by [@deluan](https://github.com/deluan)) - Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. ([#5881](navidrome/navidrome#5881), [#5886](navidrome/navidrome#5886) by [@deluan](https://github.com/deluan)) - Redact sensitive auth headers from request logs. ([82b9a44a1](navidrome/navidrome@82b9a44a1) by [@deluan](https://github.com/deluan)) > **Note:** Several of the advisories linked above are still in **draft** on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release. ##### Configuration Changes | Status | Option | Description | Default | | ------ | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | New | `Jellyfin.Enabled` | Enable the experimental Jellyfin Music API. ([#5730](navidrome/navidrome#5730)) | `false` | | New | `Jellyfin.ServerName` | Server name advertised to Jellyfin clients. ([#5730](navidrome/navidrome#5730)) | `Navidrome <version>` | | New | `Jellyfin.ExposedPublicUsers` | Comma-separated usernames advertised on the unauthenticated public users endpoint. ([#5730](navidrome/navidrome#5730)) | `""` | | New | `Jellyfin.MaxConcurrentStreams` | Bounds how many Jellyfin collection responses can stream at once. ([#5783](navidrome/navidrome#5783)) | `max(2, MaxOpenConns/2)` | | New | `EnableNaturalSorting` | Sort names and titles naturally (e.g. "Track 2" before "Track 10"). ([#6015](navidrome/navidrome#6015)) | `false` | | New | `MaxImageSize` | Cap on the size of artwork images Navidrome will decode. ([#5931](navidrome/navidrome#5931)) | `20MB` | | New | `EnableScheduledDBAnalyze` | Periodically run a full `ANALYZE` to keep query planner statistics fresh. ([#5740](navidrome/navidrome#5740)) | `true` | For a complete list of all configuration options, see the [Configuration Options](https://www.navidrome.org/docs/usage/configuration-options/) documentation. ##### Jellyfin API (Experimental) - Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with `Jellyfin.Enabled = true`. ([#5730](navidrome/navidrome#5730) by [@deluan](https://github.com/deluan)) - Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. ([#5791](navidrome/navidrome#5791), [#5948](navidrome/navidrome#5948), [#5815](navidrome/navidrome#5815), [#5817](navidrome/navidrome#5817) by [@deluan](https://github.com/deluan), [#5809](navidrome/navidrome#5809) by [@kgarner7](https://github.com/kgarner7)) - Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. ([#5782](navidrome/navidrome#5782) by [@deluan](https://github.com/deluan)) - Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. ([#6013](navidrome/navidrome#6013) by [@deluan](https://github.com/deluan)) ##### Artwork - New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. ([#5847](navidrome/navidrome#5847) by [@deluan](https://github.com/deluan)) - Make the artwork image size cap configurable. ([#5931](navidrome/navidrome#5931) by [@deluan](https://github.com/deluan)) - Fix artist folder being promoted to album folder. ([#5856](navidrome/navidrome#5856) by [@kgarner7](https://github.com/kgarner7)) - Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. ([#5808](navidrome/navidrome#5808), [#6068](navidrome/navidrome#6068) by [@deluan](https://github.com/deluan)) ##### UI - Add Refresh Metadata action to album and artist pages and context menus. ([#6036](navidrome/navidrome#6036), [#6078](navidrome/navidrome#6078) by [@deluan](https://github.com/deluan)) - Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. ([#5805](navidrome/navidrome#5805) by [@deluan](https://github.com/deluan)) - Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. ([#5835](navidrome/navidrome#5835) by [@cmyksoda](https://github.com/cmyksoda)) - Add Artists, Songs, Playlists and Radio to the Default View options. ([#5754](navidrome/navidrome#5754), [#5801](navidrome/navidrome#5801) by [@deluan](https://github.com/deluan)) - Add Share and Download actions to the Artist detail page. ([#5944](navidrome/navidrome#5944) by [@deluan](https://github.com/deluan)) - Show translation completion percentage in the language selector. ([#5979](navidrome/navidrome#5979) by [@deluan](https://github.com/deluan)) - Remember the "items per page" selection across sessions. ([#5819](navidrome/navidrome#5819) by [@deluan](https://github.com/deluan)) - Give visual feedback when downloading from a share. ([#5865](navidrome/navidrome#5865) by [@deluan](https://github.com/deluan)) - Fix logins sometimes showing the wrong user. ([#5882](navidrome/navidrome#5882) by [@deluan](https://github.com/deluan), [#5767](navidrome/navidrome#5767) by [@apkatsikas](https://github.com/apkatsikas)) - Fix each page's scroll position not being restored when navigating back. ([#5892](navidrome/navidrome#5892) by [@deluan](https://github.com/deluan)) - Fix playback starting when closing the disc cover lightbox. ([#5901](navidrome/navidrome#5901) by [@deluan](https://github.com/deluan)) - Fix playlist not reloading after rating or loving a track. ([#6009](navidrome/navidrome#6009) by [@polybjorn](https://github.com/polybjorn)) - Fix the album grid resizing in Safari when top menus open. ([#6125](navidrome/navidrome#6125) by [@york9675](https://github.com/york9675)) - Fix the album grid hover overlay corners in the Nautiline theme. ([#6115](navidrome/navidrome#6115) by [@deluan](https://github.com/deluan)) - Fix transcoding Default Bit Rate not accepting 0. ([8d77a49b3](navidrome/navidrome@8d77a49b3) by [@deluan](https://github.com/deluan)) - Fix the Last.fm link not always showing on the artist details page. ([b0e1943d8](navidrome/navidrome@b0e1943d8) by [@deluan](https://github.com/deluan)) ##### Playlists & Smart Playlists - Add album-level fields for sorting and filtering in smart playlists. ([#5899](navidrome/navidrome#5899) by [@deluan](https://github.com/deluan)) - Add per-playlist `refreshDelay` for stable daily or weekly smart playlists. ([#5790](navidrome/navidrome#5790) by [@deluan](https://github.com/deluan)) - Store playlist stars and ratings per user. ([#5749](navidrome/navidrome#5749) by [@deluan](https://github.com/deluan)) - Make playlist import much faster on large libraries. ([#6055](navidrome/navidrome#6055) by [@deluan](https://github.com/deluan)) - Fix in-place playlist edits not being detected by the scanner. ([#5914](navidrome/navidrome#5914) by [@junkerderprovinz](https://github.com/junkerderprovinz)) - Fix track edits being allowed on synced playlists via some APIs. ([#5984](navidrome/navidrome#5984) by [@deluan](https://github.com/deluan)) - Fix smart playlist song count being lost on re-import. ([#5908](navidrome/navidrome#5908) by [@deluan](https://github.com/deluan)) - Fix deleting many tracks from a playlist at once failing. ([#5977](navidrome/navidrome#5977) by [@deluan](https://github.com/deluan)) - Fix the `changed` timestamp not being updated when renaming a smart playlist. ([#6082](navidrome/navidrome#6082) by [@deluan](https://github.com/deluan)) ##### Scanner - Add optional natural sort order for names and titles. ([#6015](navidrome/navidrome#6015) by [@deluan](https://github.com/deluan)) - Support the `[bg:]` tag and skip unknown tags in LRC lyrics files. ([#5966](navidrome/navidrome#5966) by [@deluan](https://github.com/deluan)) - Fix album tags being sorted alphabetically instead of keeping the order from the files. ([#5872](navidrome/navidrome#5872) by [@deluan](https://github.com/deluan)) - Fix file creation time not being read on Linux. ([#6046](navidrome/navidrome#6046) by [@deluan](https://github.com/deluan)) ##### Subsonic API - Implement the OpenSubsonic `topSongsByArtistId` extension. ([#5853](navidrome/navidrome#5853) by [@kgarner7](https://github.com/kgarner7)) - Expose album-level ReplayGain. ([#5816](navidrome/navidrome#5816) by [@deluan](https://github.com/deluan)) - Fix `createShare` ignoring `DefaultDownloadableShare`. ([#6121](navidrome/navidrome#6121) by [@deluan](https://github.com/deluan)) - Fix double brackets when appending subtitle or version to titles. ([#5832](navidrome/navidrome#5832) by [@deluan](https://github.com/deluan)) ##### Transcoding & Streaming - Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. ([#6105](navidrome/navidrome#6105) by [@deluan](https://github.com/deluan)) - Fix truncated transcoded streams being delivered as complete. ([#6035](navidrome/navidrome#6035) by [@deluan](https://github.com/deluan)) - Fix AAC streams being reported as `audio/mp4` instead of `audio/aac`. ([#5998](navidrome/navidrome#5998) by [@justadityaraj](https://github.com/justadityaraj)) - Fix bit depth being reported for lossy transcode targets. ([#5768](navidrome/navidrome#5768) by [@deluan](https://github.com/deluan)) ##### Scrobbling - Add a per-user scrobble filter. ([#5964](navidrome/navidrome#5964) by [@deluan](https://github.com/deluan)) - Add a scrobble history Native API. ([#5761](navidrome/navidrome#5761) by [@kgarner7](https://github.com/kgarner7)) - Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. ([#5818](navidrome/navidrome#5818), [#6028](navidrome/navidrome#6028) by [@deluan](https://github.com/deluan)) - Fix out-of-order playback reports being rejected. ([#5793](navidrome/navidrome#5793) by [@deluan](https://github.com/deluan)) ##### Plugins - Add plugin-specific storage. ([#5839](navidrome/navidrome#5839) by [@kgarner7](https://github.com/kgarner7)) - Add scrobble access to the plugin SDK. ([#5795](navidrome/navidrome#5795) by [@kgarner7](https://github.com/kgarner7)) - Surface the valid agent names in logs and the Plugins UI. ([#5910](navidrome/navidrome#5910) by [@deluan](https://github.com/deluan)) - Fix plugin agents not being loaded in CLI commands. ([#5959](navidrome/navidrome#5959) by [@deluan](https://github.com/deluan)) - Fix public URLs built by plugins pointing at localhost instead of the caller's address. ([#6059](navidrome/navidrome#6059) by [@deluan](https://github.com/deluan)) ##### CLI - Add an `artwork` command group (`explain`, `refresh`, `cancel`) for diagnosing and re-driving artwork resolution. ([#5957](navidrome/navidrome#5957) by [@deluan](https://github.com/deluan)) - Add `missing list` and `missing fix` subcommands to deal with files that moved. ([#5928](navidrome/navidrome#5928) by [@zerovox](https://github.com/zerovox)) - Add `doctor` and `search rebuild` commands to detect and recover from search index corruption. ([#6069](navidrome/navidrome#6069) by [@deluan](https://github.com/deluan)) - Fix `restore` wiping the database when the backup file does not exist. ([#6085](navidrome/navidrome#6085) by [@Huang-404-Q](https://github.com/Huang-404-Q)) - Fix selective scan `--target` rejecting absolute paths. ([#5947](navidrome/navidrome#5947) by [@deluan](https://github.com/deluan)) - Fix `pls -p` writing playlist output to stderr instead of stdout. ([#5996](navidrome/navidrome#5996) by [@deluan](https://github.com/deluan)) ##### Server - Make genre and artist filtering much faster across all APIs by using indexed join tables. ([#5940](navidrome/navidrome#5940), [#5930](navidrome/navidrome#5930) by [@deluan](https://github.com/deluan)) - Report the app store or hosting platform via `ND_PLATFORM` in insights. ([#5956](navidrome/navidrome#5956) by [@deluan](https://github.com/deluan)) - Send the Navidrome User-Agent in all outgoing requests. ([#6020](navidrome/navidrome#6020) by [@mintsoft](https://github.com/mintsoft)) - Fix `getScanStatus` reporting `count=0` for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when `MusicFolder` contains a single quote. ([#6098](navidrome/navidrome#6098) by [@deluan](https://github.com/deluan)) ##### Database - Periodically run a full `ANALYZE` to keep query planner statistics trustworthy. ([#5740](navidrome/navidrome#5740) by [@deluan](https://github.com/deluan)) ##### Packaging & Build - Upgrade to Go 1.27. ([#5990](navidrome/navidrome#5990) by [@deluan](https://github.com/deluan)) - Upgrade the Docker base image to Alpine 3.22, and add `curl` to the container image. ([#6048](navidrome/navidrome#6048) by [@deluan](https://github.com/deluan), [#6116](navidrome/navidrome#6116) by [@miguelallopes](https://github.com/miguelallopes)) - Bump TagLib to 2.3.2. ([#6088](navidrome/navidrome#6088) by [@deluan](https://github.com/deluan)) - Windows MSI: remember install properties across upgrades. ([#5333](navidrome/navidrome#5333) by [@mintsoft](https://github.com/mintsoft)) - Fix a missing hyphen in the OpenRC script that caused crashes on startup. ([#5906](navidrome/navidrome#5906) by [@alinxviso](https://github.com/alinxviso)) - Fix a typo in the `--prometheus.enabled` description. ([#5878](navidrome/navidrome#5878) by [@0mp](https://github.com/0mp)) ##### Translations - Update Chinese (Simplified) translation. ([#5779](navidrome/navidrome#5779), [#5873](navidrome/navidrome#5873) by [@fxj368](https://github.com/fxj368)) - Update Italian translation. ([#5848](navidrome/navidrome#5848) by [@McCio](https://github.com/McCio)) - Update Japanese translation. ([#6080](navidrome/navidrome#6080) by [@karigane-cha](https://github.com/karigane-cha)) - Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. ([#5833](navidrome/navidrome#5833), [#6128](navidrome/navidrome#6128) by [@deluan](https://github.com/deluan)) ##### New Contributors - [@McCio](https://github.com/McCio) made their first contribution in [#5848](navidrome/navidrome#5848) - [@0mp](https://github.com/0mp) made their first contribution in [#5878](navidrome/navidrome#5878) - [@alinxviso](https://github.com/alinxviso) made their first contribution in [#5906](navidrome/navidrome#5906) - [@IgorPolyakov](https://github.com/IgorPolyakov) made their first contribution in [#5867](navidrome/navidrome#5867) - [@junkerderprovinz](https://github.com/junkerderprovinz) made their first contribution in [#5916](navidrome/navidrome#5916) - [@justadityaraj](https://github.com/justadityaraj) made their first contribution in [#5998](navidrome/navidrome#5998) - [@polybjorn](https://github.com/polybjorn) made their first contribution in [#6009](navidrome/navidrome#6009) - [@karigane-cha](https://github.com/karigane-cha) made their first contribution in [#6080](navidrome/navidrome#6080) - [@Shxiao101](https://github.com/Shxiao101) made their first contribution in [#6097](navidrome/navidrome#6097) - [@cmyksoda](https://github.com/cmyksoda) made their first contribution in [#5835](navidrome/navidrome#5835) - [@miguelallopes](https://github.com/miguelallopes) made their first contribution in [#6116](navidrome/navidrome#6116) - [@Huang-404-Q](https://github.com/Huang-404-Q) made their first contribution in [#6085](navidrome/navidrome#6085) - [@zerovox](https://github.com/zerovox) made their first contribution in [#5928](navidrome/navidrome#5928) - [@Sudo-Ivan](https://github.com/Sudo-Ivan) made their first contribution in [4168377b6](navidrome/navidrome@4168377b6) **Full Changelog**: <navidrome/navidrome@v0.63.2...v0.64.0> ##### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). ##### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods?run=navidrome) or [Zenith](https://zenith.hosting/host/navidrome?ref=navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)!
##### [\`0.64.0\`](https://github.com/navidrome/navidrome/releases/tag/v0.64.0) This release brings an **experimental Jellyfin Music API**, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a **new background pipeline** with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a **uniform canonical 128-bit format**, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling. #####⚠️ Breaking Changes / Migration Notes - **All internal IDs are re-encoded** to a single canonical 128-bit base62 format. The migration touches every table, so **back up your database before upgrading**. Clients that cache item IDs (for example, offline downloads) may need to re-sync. ([#5824](navidrome/navidrome#5824)) - **Plugin authors: Extism's built-in HTTP is disabled.** Calls through `pdk.NewHTTPRequest` (Go), `http::request` (Rust) or the equivalent in other PDKs now fail with `HTTP request ... is not allowed`. Plugins must use the host HTTP service instead: `host.HTTPSend` (Go) or `nd_pdk::host::http::send` (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's `requiredHosts`, or use a bare `"*"`. ([1a8463f7d](navidrome/navidrome@1a8463f7d), [276d767ce](navidrome/navidrome@276d767ce)) - **Shares are always owned by the user who creates them.** Admins can no longer create shares on behalf of another user via `userId`. ([1a8463f7d](navidrome/navidrome@1a8463f7d)) - **Configuration durations are now validated.** Negative values are rejected at startup. ([#6002](navidrome/navidrome#6002)) - Navidrome now **warns about unrecognized options** in the config file, so typos no longer fail silently. ([#5870](navidrome/navidrome#5870)) ##### Security This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them. - Fix SQL injection via the artist `role` sort and filter parameters in the Native API by validating the role against the known list. ([4168377b6](navidrome/navidrome@4168377b6), [GHSA-hm54-32q6-3rcr](GHSA-hm54-32q6-3rcr), reported and fixed by [@Sudo-Ivan](https://github.com/Sudo-Ivan)) - Fix share-ownership spoofing (IDOR) that let a client-supplied `userId` on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. ([1a8463f7d](navidrome/navidrome@1a8463f7d), [GHSA-82gh-4ggp-gfg5](GHSA-82gh-4ggp-gfg5), reported by [@gigioneggiando](https://github.com/gigioneggiando)) - Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. ([276d767ce](navidrome/navidrome@276d767ce), [GHSA-pr2j-mfc8-qjcc](GHSA-pr2j-mfc8-qjcc), reported by [@qrn12580](https://github.com/qrn12580)) - Fix login rate limit bypass via spoofed `X-Forwarded-For`, `X-Real-IP` and `True-Client-IP` headers by keying the limit on the trust-aware client IP. ([#6124](navidrome/navidrome#6124), [GHSA-f295-6wp9-qqfg](GHSA-f295-6wp9-qqfg), reported by [@gehan-psbc](https://github.com/gehan-psbc) and [@skarn958](https://github.com/skarn958)) - Fix memory exhaustion via a negative `size` parameter on `getCoverArt` and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. ([#5847](navidrome/navidrome#5847), [GHSA-f22h-6qxh-rqq2](GHSA-f22h-6qxh-rqq2), reported by [@arpitjain099](https://github.com/arpitjain099)) - Enforce track membership on public share streams so a share can only stream the tracks it contains. ([#5769](navidrome/navidrome#5769) by [@deluan](https://github.com/deluan)) - Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. ([#6098](navidrome/navidrome#6098) by [@deluan](https://github.com/deluan)) - Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. ([#5881](navidrome/navidrome#5881), [#5886](navidrome/navidrome#5886) by [@deluan](https://github.com/deluan)) - Redact sensitive auth headers from request logs. ([82b9a44a1](navidrome/navidrome@82b9a44a1) by [@deluan](https://github.com/deluan)) > **Note:** Several of the advisories linked above are still in **draft** on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release. ##### Configuration Changes | Status | Option | Description | Default | | ------ | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | New | `Jellyfin.Enabled` | Enable the experimental Jellyfin Music API. ([#5730](navidrome/navidrome#5730)) | `false` | | New | `Jellyfin.ServerName` | Server name advertised to Jellyfin clients. ([#5730](navidrome/navidrome#5730)) | `Navidrome <version>` | | New | `Jellyfin.ExposedPublicUsers` | Comma-separated usernames advertised on the unauthenticated public users endpoint. ([#5730](navidrome/navidrome#5730)) | `""` | | New | `Jellyfin.MaxConcurrentStreams` | Bounds how many Jellyfin collection responses can stream at once. ([#5783](navidrome/navidrome#5783)) | `max(2, MaxOpenConns/2)` | | New | `EnableNaturalSorting` | Sort names and titles naturally (e.g. "Track 2" before "Track 10"). ([#6015](navidrome/navidrome#6015)) | `false` | | New | `MaxImageSize` | Cap on the size of artwork images Navidrome will decode. ([#5931](navidrome/navidrome#5931)) | `20MB` | | New | `EnableScheduledDBAnalyze` | Periodically run a full `ANALYZE` to keep query planner statistics fresh. ([#5740](navidrome/navidrome#5740)) | `true` | For a complete list of all configuration options, see the [Configuration Options](https://www.navidrome.org/docs/usage/configuration-options/) documentation. ##### Jellyfin API (Experimental) - Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with `Jellyfin.Enabled = true`. ([#5730](navidrome/navidrome#5730) by [@deluan](https://github.com/deluan)) - Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. ([#5791](navidrome/navidrome#5791), [#5948](navidrome/navidrome#5948), [#5815](navidrome/navidrome#5815), [#5817](navidrome/navidrome#5817) by [@deluan](https://github.com/deluan), [#5809](navidrome/navidrome#5809) by [@kgarner7](https://github.com/kgarner7)) - Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. ([#5782](navidrome/navidrome#5782) by [@deluan](https://github.com/deluan)) - Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. ([#6013](navidrome/navidrome#6013) by [@deluan](https://github.com/deluan)) ##### Artwork - New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. ([#5847](navidrome/navidrome#5847) by [@deluan](https://github.com/deluan)) - Make the artwork image size cap configurable. ([#5931](navidrome/navidrome#5931) by [@deluan](https://github.com/deluan)) - Fix artist folder being promoted to album folder. ([#5856](navidrome/navidrome#5856) by [@kgarner7](https://github.com/kgarner7)) - Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. ([#5808](navidrome/navidrome#5808), [#6068](navidrome/navidrome#6068) by [@deluan](https://github.com/deluan)) ##### UI - Add Refresh Metadata action to album and artist pages and context menus. ([#6036](navidrome/navidrome#6036), [#6078](navidrome/navidrome#6078) by [@deluan](https://github.com/deluan)) - Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. ([#5805](navidrome/navidrome#5805) by [@deluan](https://github.com/deluan)) - Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. ([#5835](navidrome/navidrome#5835) by [@cmyksoda](https://github.com/cmyksoda)) - Add Artists, Songs, Playlists and Radio to the Default View options. ([#5754](navidrome/navidrome#5754), [#5801](navidrome/navidrome#5801) by [@deluan](https://github.com/deluan)) - Add Share and Download actions to the Artist detail page. ([#5944](navidrome/navidrome#5944) by [@deluan](https://github.com/deluan)) - Show translation completion percentage in the language selector. ([#5979](navidrome/navidrome#5979) by [@deluan](https://github.com/deluan)) - Remember the "items per page" selection across sessions. ([#5819](navidrome/navidrome#5819) by [@deluan](https://github.com/deluan)) - Give visual feedback when downloading from a share. ([#5865](navidrome/navidrome#5865) by [@deluan](https://github.com/deluan)) - Fix logins sometimes showing the wrong user. ([#5882](navidrome/navidrome#5882) by [@deluan](https://github.com/deluan), [#5767](navidrome/navidrome#5767) by [@apkatsikas](https://github.com/apkatsikas)) - Fix each page's scroll position not being restored when navigating back. ([#5892](navidrome/navidrome#5892) by [@deluan](https://github.com/deluan)) - Fix playback starting when closing the disc cover lightbox. ([#5901](navidrome/navidrome#5901) by [@deluan](https://github.com/deluan)) - Fix playlist not reloading after rating or loving a track. ([#6009](navidrome/navidrome#6009) by [@polybjorn](https://github.com/polybjorn)) - Fix the album grid resizing in Safari when top menus open. ([#6125](navidrome/navidrome#6125) by [@york9675](https://github.com/york9675)) - Fix the album grid hover overlay corners in the Nautiline theme. ([#6115](navidrome/navidrome#6115) by [@deluan](https://github.com/deluan)) - Fix transcoding Default Bit Rate not accepting 0. ([8d77a49b3](navidrome/navidrome@8d77a49b3) by [@deluan](https://github.com/deluan)) - Fix the Last.fm link not always showing on the artist details page. ([b0e1943d8](navidrome/navidrome@b0e1943d8) by [@deluan](https://github.com/deluan)) ##### Playlists & Smart Playlists - Add album-level fields for sorting and filtering in smart playlists. ([#5899](navidrome/navidrome#5899) by [@deluan](https://github.com/deluan)) - Add per-playlist `refreshDelay` for stable daily or weekly smart playlists. ([#5790](navidrome/navidrome#5790) by [@deluan](https://github.com/deluan)) - Store playlist stars and ratings per user. ([#5749](navidrome/navidrome#5749) by [@deluan](https://github.com/deluan)) - Make playlist import much faster on large libraries. ([#6055](navidrome/navidrome#6055) by [@deluan](https://github.com/deluan)) - Fix in-place playlist edits not being detected by the scanner. ([#5914](navidrome/navidrome#5914) by [@junkerderprovinz](https://github.com/junkerderprovinz)) - Fix track edits being allowed on synced playlists via some APIs. ([#5984](navidrome/navidrome#5984) by [@deluan](https://github.com/deluan)) - Fix smart playlist song count being lost on re-import. ([#5908](navidrome/navidrome#5908) by [@deluan](https://github.com/deluan)) - Fix deleting many tracks from a playlist at once failing. ([#5977](navidrome/navidrome#5977) by [@deluan](https://github.com/deluan)) - Fix the `changed` timestamp not being updated when renaming a smart playlist. ([#6082](navidrome/navidrome#6082) by [@deluan](https://github.com/deluan)) ##### Scanner - Add optional natural sort order for names and titles. ([#6015](navidrome/navidrome#6015) by [@deluan](https://github.com/deluan)) - Support the `[bg:]` tag and skip unknown tags in LRC lyrics files. ([#5966](navidrome/navidrome#5966) by [@deluan](https://github.com/deluan)) - Fix album tags being sorted alphabetically instead of keeping the order from the files. ([#5872](navidrome/navidrome#5872) by [@deluan](https://github.com/deluan)) - Fix file creation time not being read on Linux. ([#6046](navidrome/navidrome#6046) by [@deluan](https://github.com/deluan)) ##### Subsonic API - Implement the OpenSubsonic `topSongsByArtistId` extension. ([#5853](navidrome/navidrome#5853) by [@kgarner7](https://github.com/kgarner7)) - Expose album-level ReplayGain. ([#5816](navidrome/navidrome#5816) by [@deluan](https://github.com/deluan)) - Fix `createShare` ignoring `DefaultDownloadableShare`. ([#6121](navidrome/navidrome#6121) by [@deluan](https://github.com/deluan)) - Fix double brackets when appending subtitle or version to titles. ([#5832](navidrome/navidrome#5832) by [@deluan](https://github.com/deluan)) ##### Transcoding & Streaming - Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. ([#6105](navidrome/navidrome#6105) by [@deluan](https://github.com/deluan)) - Fix truncated transcoded streams being delivered as complete. ([#6035](navidrome/navidrome#6035) by [@deluan](https://github.com/deluan)) - Fix AAC streams being reported as `audio/mp4` instead of `audio/aac`. ([#5998](navidrome/navidrome#5998) by [@justadityaraj](https://github.com/justadityaraj)) - Fix bit depth being reported for lossy transcode targets. ([#5768](navidrome/navidrome#5768) by [@deluan](https://github.com/deluan)) ##### Scrobbling - Add a per-user scrobble filter. ([#5964](navidrome/navidrome#5964) by [@deluan](https://github.com/deluan)) - Add a scrobble history Native API. ([#5761](navidrome/navidrome#5761) by [@kgarner7](https://github.com/kgarner7)) - Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. ([#5818](navidrome/navidrome#5818), [#6028](navidrome/navidrome#6028) by [@deluan](https://github.com/deluan)) - Fix out-of-order playback reports being rejected. ([#5793](navidrome/navidrome#5793) by [@deluan](https://github.com/deluan)) ##### Plugins - Add plugin-specific storage. ([#5839](navidrome/navidrome#5839) by [@kgarner7](https://github.com/kgarner7)) - Add scrobble access to the plugin SDK. ([#5795](navidrome/navidrome#5795) by [@kgarner7](https://github.com/kgarner7)) - Surface the valid agent names in logs and the Plugins UI. ([#5910](navidrome/navidrome#5910) by [@deluan](https://github.com/deluan)) - Fix plugin agents not being loaded in CLI commands. ([#5959](navidrome/navidrome#5959) by [@deluan](https://github.com/deluan)) - Fix public URLs built by plugins pointing at localhost instead of the caller's address. ([#6059](navidrome/navidrome#6059) by [@deluan](https://github.com/deluan)) ##### CLI - Add an `artwork` command group (`explain`, `refresh`, `cancel`) for diagnosing and re-driving artwork resolution. ([#5957](navidrome/navidrome#5957) by [@deluan](https://github.com/deluan)) - Add `missing list` and `missing fix` subcommands to deal with files that moved. ([#5928](navidrome/navidrome#5928) by [@zerovox](https://github.com/zerovox)) - Add `doctor` and `search rebuild` commands to detect and recover from search index corruption. ([#6069](navidrome/navidrome#6069) by [@deluan](https://github.com/deluan)) - Fix `restore` wiping the database when the backup file does not exist. ([#6085](navidrome/navidrome#6085) by [@Huang-404-Q](https://github.com/Huang-404-Q)) - Fix selective scan `--target` rejecting absolute paths. ([#5947](navidrome/navidrome#5947) by [@deluan](https://github.com/deluan)) - Fix `pls -p` writing playlist output to stderr instead of stdout. ([#5996](navidrome/navidrome#5996) by [@deluan](https://github.com/deluan)) ##### Server - Make genre and artist filtering much faster across all APIs by using indexed join tables. ([#5940](navidrome/navidrome#5940), [#5930](navidrome/navidrome#5930) by [@deluan](https://github.com/deluan)) - Report the app store or hosting platform via `ND_PLATFORM` in insights. ([#5956](navidrome/navidrome#5956) by [@deluan](https://github.com/deluan)) - Send the Navidrome User-Agent in all outgoing requests. ([#6020](navidrome/navidrome#6020) by [@mintsoft](https://github.com/mintsoft)) - Fix `getScanStatus` reporting `count=0` for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when `MusicFolder` contains a single quote. ([#6098](navidrome/navidrome#6098) by [@deluan](https://github.com/deluan)) ##### Database - Periodically run a full `ANALYZE` to keep query planner statistics trustworthy. ([#5740](navidrome/navidrome#5740) by [@deluan](https://github.com/deluan)) ##### Packaging & Build - Upgrade to Go 1.27. ([#5990](navidrome/navidrome#5990) by [@deluan](https://github.com/deluan)) - Upgrade the Docker base image to Alpine 3.22, and add `curl` to the container image. ([#6048](navidrome/navidrome#6048) by [@deluan](https://github.com/deluan), [#6116](navidrome/navidrome#6116) by [@miguelallopes](https://github.com/miguelallopes)) - Bump TagLib to 2.3.2. ([#6088](navidrome/navidrome#6088) by [@deluan](https://github.com/deluan)) - Windows MSI: remember install properties across upgrades. ([#5333](navidrome/navidrome#5333) by [@mintsoft](https://github.com/mintsoft)) - Fix a missing hyphen in the OpenRC script that caused crashes on startup. ([#5906](navidrome/navidrome#5906) by [@alinxviso](https://github.com/alinxviso)) - Fix a typo in the `--prometheus.enabled` description. ([#5878](navidrome/navidrome#5878) by [@0mp](https://github.com/0mp)) ##### Translations - Update Chinese (Simplified) translation. ([#5779](navidrome/navidrome#5779), [#5873](navidrome/navidrome#5873) by [@fxj368](https://github.com/fxj368)) - Update Italian translation. ([#5848](navidrome/navidrome#5848) by [@McCio](https://github.com/McCio)) - Update Japanese translation. ([#6080](navidrome/navidrome#6080) by [@karigane-cha](https://github.com/karigane-cha)) - Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. ([#5833](navidrome/navidrome#5833), [#6128](navidrome/navidrome#6128) by [@deluan](https://github.com/deluan)) ##### New Contributors - [@McCio](https://github.com/McCio) made their first contribution in [#5848](navidrome/navidrome#5848) - [@0mp](https://github.com/0mp) made their first contribution in [#5878](navidrome/navidrome#5878) - [@alinxviso](https://github.com/alinxviso) made their first contribution in [#5906](navidrome/navidrome#5906) - [@IgorPolyakov](https://github.com/IgorPolyakov) made their first contribution in [#5867](navidrome/navidrome#5867) - [@junkerderprovinz](https://github.com/junkerderprovinz) made their first contribution in [#5916](navidrome/navidrome#5916) - [@justadityaraj](https://github.com/justadityaraj) made their first contribution in [#5998](navidrome/navidrome#5998) - [@polybjorn](https://github.com/polybjorn) made their first contribution in [#6009](navidrome/navidrome#6009) - [@karigane-cha](https://github.com/karigane-cha) made their first contribution in [#6080](navidrome/navidrome#6080) - [@Shxiao101](https://github.com/Shxiao101) made their first contribution in [#6097](navidrome/navidrome#6097) - [@cmyksoda](https://github.com/cmyksoda) made their first contribution in [#5835](navidrome/navidrome#5835) - [@miguelallopes](https://github.com/miguelallopes) made their first contribution in [#6116](navidrome/navidrome#6116) - [@Huang-404-Q](https://github.com/Huang-404-Q) made their first contribution in [#6085](navidrome/navidrome#6085) - [@zerovox](https://github.com/zerovox) made their first contribution in [#5928](navidrome/navidrome#5928) - [@Sudo-Ivan](https://github.com/Sudo-Ivan) made their first contribution in [4168377b6](navidrome/navidrome@4168377b6) **Full Changelog**: <navidrome/navidrome@v0.63.2...v0.64.0> ##### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). ##### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods?run=navidrome) or [Zenith](https://zenith.hosting/host/navidrome?ref=navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)!
##### [\`0.64.0\`](https://github.com/navidrome/navidrome/releases/tag/v0.64.0) This release brings an **experimental Jellyfin Music API**, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a **new background pipeline** with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a **uniform canonical 128-bit format**, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling. #####⚠️ Breaking Changes / Migration Notes - **All internal IDs are re-encoded** to a single canonical 128-bit base62 format. The migration touches every table, so **back up your database before upgrading**. Clients that cache item IDs (for example, offline downloads) may need to re-sync. ([#5824](navidrome/navidrome#5824)) - **Plugin authors: Extism's built-in HTTP is disabled.** Calls through `pdk.NewHTTPRequest` (Go), `http::request` (Rust) or the equivalent in other PDKs now fail with `HTTP request ... is not allowed`. Plugins must use the host HTTP service instead: `host.HTTPSend` (Go) or `nd_pdk::host::http::send` (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's `requiredHosts`, or use a bare `"*"`. ([1a8463f7d](navidrome/navidrome@1a8463f7d), [276d767ce](navidrome/navidrome@276d767ce)) - **Shares are always owned by the user who creates them.** Admins can no longer create shares on behalf of another user via `userId`. ([1a8463f7d](navidrome/navidrome@1a8463f7d)) - **Configuration durations are now validated.** Negative values are rejected at startup. ([#6002](navidrome/navidrome#6002)) - Navidrome now **warns about unrecognized options** in the config file, so typos no longer fail silently. ([#5870](navidrome/navidrome#5870)) ##### Security This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them. - Fix SQL injection via the artist `role` sort and filter parameters in the Native API by validating the role against the known list. ([4168377b6](navidrome/navidrome@4168377b6), [GHSA-hm54-32q6-3rcr](GHSA-hm54-32q6-3rcr), reported and fixed by [@Sudo-Ivan](https://github.com/Sudo-Ivan)) - Fix share-ownership spoofing (IDOR) that let a client-supplied `userId` on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. ([1a8463f7d](navidrome/navidrome@1a8463f7d), [GHSA-82gh-4ggp-gfg5](GHSA-82gh-4ggp-gfg5), reported by [@gigioneggiando](https://github.com/gigioneggiando)) - Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. ([276d767ce](navidrome/navidrome@276d767ce), [GHSA-pr2j-mfc8-qjcc](GHSA-pr2j-mfc8-qjcc), reported by [@qrn12580](https://github.com/qrn12580)) - Fix login rate limit bypass via spoofed `X-Forwarded-For`, `X-Real-IP` and `True-Client-IP` headers by keying the limit on the trust-aware client IP. ([#6124](navidrome/navidrome#6124), [GHSA-f295-6wp9-qqfg](GHSA-f295-6wp9-qqfg), reported by [@gehan-psbc](https://github.com/gehan-psbc) and [@skarn958](https://github.com/skarn958)) - Fix memory exhaustion via a negative `size` parameter on `getCoverArt` and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. ([#5847](navidrome/navidrome#5847), [GHSA-f22h-6qxh-rqq2](GHSA-f22h-6qxh-rqq2), reported by [@arpitjain099](https://github.com/arpitjain099)) - Enforce track membership on public share streams so a share can only stream the tracks it contains. ([#5769](navidrome/navidrome#5769) by [@deluan](https://github.com/deluan)) - Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. ([#6098](navidrome/navidrome#6098) by [@deluan](https://github.com/deluan)) - Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. ([#5881](navidrome/navidrome#5881), [#5886](navidrome/navidrome#5886) by [@deluan](https://github.com/deluan)) - Redact sensitive auth headers from request logs. ([82b9a44a1](navidrome/navidrome@82b9a44a1) by [@deluan](https://github.com/deluan)) > **Note:** Several of the advisories linked above are still in **draft** on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release. ##### Configuration Changes | Status | Option | Description | Default | | ------ | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | New | `Jellyfin.Enabled` | Enable the experimental Jellyfin Music API. ([#5730](navidrome/navidrome#5730)) | `false` | | New | `Jellyfin.ServerName` | Server name advertised to Jellyfin clients. ([#5730](navidrome/navidrome#5730)) | `Navidrome <version>` | | New | `Jellyfin.ExposedPublicUsers` | Comma-separated usernames advertised on the unauthenticated public users endpoint. ([#5730](navidrome/navidrome#5730)) | `""` | | New | `Jellyfin.MaxConcurrentStreams` | Bounds how many Jellyfin collection responses can stream at once. ([#5783](navidrome/navidrome#5783)) | `max(2, MaxOpenConns/2)` | | New | `EnableNaturalSorting` | Sort names and titles naturally (e.g. "Track 2" before "Track 10"). ([#6015](navidrome/navidrome#6015)) | `false` | | New | `MaxImageSize` | Cap on the size of artwork images Navidrome will decode. ([#5931](navidrome/navidrome#5931)) | `20MB` | | New | `EnableScheduledDBAnalyze` | Periodically run a full `ANALYZE` to keep query planner statistics fresh. ([#5740](navidrome/navidrome#5740)) | `true` | For a complete list of all configuration options, see the [Configuration Options](https://www.navidrome.org/docs/usage/configuration-options/) documentation. ##### Jellyfin API (Experimental) - Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with `Jellyfin.Enabled = true`. ([#5730](navidrome/navidrome#5730) by [@deluan](https://github.com/deluan)) - Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. ([#5791](navidrome/navidrome#5791), [#5948](navidrome/navidrome#5948), [#5815](navidrome/navidrome#5815), [#5817](navidrome/navidrome#5817) by [@deluan](https://github.com/deluan), [#5809](navidrome/navidrome#5809) by [@kgarner7](https://github.com/kgarner7)) - Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. ([#5782](navidrome/navidrome#5782) by [@deluan](https://github.com/deluan)) - Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. ([#6013](navidrome/navidrome#6013) by [@deluan](https://github.com/deluan)) ##### Artwork - New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. ([#5847](navidrome/navidrome#5847) by [@deluan](https://github.com/deluan)) - Make the artwork image size cap configurable. ([#5931](navidrome/navidrome#5931) by [@deluan](https://github.com/deluan)) - Fix artist folder being promoted to album folder. ([#5856](navidrome/navidrome#5856) by [@kgarner7](https://github.com/kgarner7)) - Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. ([#5808](navidrome/navidrome#5808), [#6068](navidrome/navidrome#6068) by [@deluan](https://github.com/deluan)) ##### UI - Add Refresh Metadata action to album and artist pages and context menus. ([#6036](navidrome/navidrome#6036), [#6078](navidrome/navidrome#6078) by [@deluan](https://github.com/deluan)) - Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. ([#5805](navidrome/navidrome#5805) by [@deluan](https://github.com/deluan)) - Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. ([#5835](navidrome/navidrome#5835) by [@cmyksoda](https://github.com/cmyksoda)) - Add Artists, Songs, Playlists and Radio to the Default View options. ([#5754](navidrome/navidrome#5754), [#5801](navidrome/navidrome#5801) by [@deluan](https://github.com/deluan)) - Add Share and Download actions to the Artist detail page. ([#5944](navidrome/navidrome#5944) by [@deluan](https://github.com/deluan)) - Show translation completion percentage in the language selector. ([#5979](navidrome/navidrome#5979) by [@deluan](https://github.com/deluan)) - Remember the "items per page" selection across sessions. ([#5819](navidrome/navidrome#5819) by [@deluan](https://github.com/deluan)) - Give visual feedback when downloading from a share. ([#5865](navidrome/navidrome#5865) by [@deluan](https://github.com/deluan)) - Fix logins sometimes showing the wrong user. ([#5882](navidrome/navidrome#5882) by [@deluan](https://github.com/deluan), [#5767](navidrome/navidrome#5767) by [@apkatsikas](https://github.com/apkatsikas)) - Fix each page's scroll position not being restored when navigating back. ([#5892](navidrome/navidrome#5892) by [@deluan](https://github.com/deluan)) - Fix playback starting when closing the disc cover lightbox. ([#5901](navidrome/navidrome#5901) by [@deluan](https://github.com/deluan)) - Fix playlist not reloading after rating or loving a track. ([#6009](navidrome/navidrome#6009) by [@polybjorn](https://github.com/polybjorn)) - Fix the album grid resizing in Safari when top menus open. ([#6125](navidrome/navidrome#6125) by [@york9675](https://github.com/york9675)) - Fix the album grid hover overlay corners in the Nautiline theme. ([#6115](navidrome/navidrome#6115) by [@deluan](https://github.com/deluan)) - Fix transcoding Default Bit Rate not accepting 0. ([8d77a49b3](navidrome/navidrome@8d77a49b3) by [@deluan](https://github.com/deluan)) - Fix the Last.fm link not always showing on the artist details page. ([b0e1943d8](navidrome/navidrome@b0e1943d8) by [@deluan](https://github.com/deluan)) ##### Playlists & Smart Playlists - Add album-level fields for sorting and filtering in smart playlists. ([#5899](navidrome/navidrome#5899) by [@deluan](https://github.com/deluan)) - Add per-playlist `refreshDelay` for stable daily or weekly smart playlists. ([#5790](navidrome/navidrome#5790) by [@deluan](https://github.com/deluan)) - Store playlist stars and ratings per user. ([#5749](navidrome/navidrome#5749) by [@deluan](https://github.com/deluan)) - Make playlist import much faster on large libraries. ([#6055](navidrome/navidrome#6055) by [@deluan](https://github.com/deluan)) - Fix in-place playlist edits not being detected by the scanner. ([#5914](navidrome/navidrome#5914) by [@junkerderprovinz](https://github.com/junkerderprovinz)) - Fix track edits being allowed on synced playlists via some APIs. ([#5984](navidrome/navidrome#5984) by [@deluan](https://github.com/deluan)) - Fix smart playlist song count being lost on re-import. ([#5908](navidrome/navidrome#5908) by [@deluan](https://github.com/deluan)) - Fix deleting many tracks from a playlist at once failing. ([#5977](navidrome/navidrome#5977) by [@deluan](https://github.com/deluan)) - Fix the `changed` timestamp not being updated when renaming a smart playlist. ([#6082](navidrome/navidrome#6082) by [@deluan](https://github.com/deluan)) ##### Scanner - Add optional natural sort order for names and titles. ([#6015](navidrome/navidrome#6015) by [@deluan](https://github.com/deluan)) - Support the `[bg:]` tag and skip unknown tags in LRC lyrics files. ([#5966](navidrome/navidrome#5966) by [@deluan](https://github.com/deluan)) - Fix album tags being sorted alphabetically instead of keeping the order from the files. ([#5872](navidrome/navidrome#5872) by [@deluan](https://github.com/deluan)) - Fix file creation time not being read on Linux. ([#6046](navidrome/navidrome#6046) by [@deluan](https://github.com/deluan)) ##### Subsonic API - Implement the OpenSubsonic `topSongsByArtistId` extension. ([#5853](navidrome/navidrome#5853) by [@kgarner7](https://github.com/kgarner7)) - Expose album-level ReplayGain. ([#5816](navidrome/navidrome#5816) by [@deluan](https://github.com/deluan)) - Fix `createShare` ignoring `DefaultDownloadableShare`. ([#6121](navidrome/navidrome#6121) by [@deluan](https://github.com/deluan)) - Fix double brackets when appending subtitle or version to titles. ([#5832](navidrome/navidrome#5832) by [@deluan](https://github.com/deluan)) ##### Transcoding & Streaming - Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. ([#6105](navidrome/navidrome#6105) by [@deluan](https://github.com/deluan)) - Fix truncated transcoded streams being delivered as complete. ([#6035](navidrome/navidrome#6035) by [@deluan](https://github.com/deluan)) - Fix AAC streams being reported as `audio/mp4` instead of `audio/aac`. ([#5998](navidrome/navidrome#5998) by [@justadityaraj](https://github.com/justadityaraj)) - Fix bit depth being reported for lossy transcode targets. ([#5768](navidrome/navidrome#5768) by [@deluan](https://github.com/deluan)) ##### Scrobbling - Add a per-user scrobble filter. ([#5964](navidrome/navidrome#5964) by [@deluan](https://github.com/deluan)) - Add a scrobble history Native API. ([#5761](navidrome/navidrome#5761) by [@kgarner7](https://github.com/kgarner7)) - Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. ([#5818](navidrome/navidrome#5818), [#6028](navidrome/navidrome#6028) by [@deluan](https://github.com/deluan)) - Fix out-of-order playback reports being rejected. ([#5793](navidrome/navidrome#5793) by [@deluan](https://github.com/deluan)) ##### Plugins - Add plugin-specific storage. ([#5839](navidrome/navidrome#5839) by [@kgarner7](https://github.com/kgarner7)) - Add scrobble access to the plugin SDK. ([#5795](navidrome/navidrome#5795) by [@kgarner7](https://github.com/kgarner7)) - Surface the valid agent names in logs and the Plugins UI. ([#5910](navidrome/navidrome#5910) by [@deluan](https://github.com/deluan)) - Fix plugin agents not being loaded in CLI commands. ([#5959](navidrome/navidrome#5959) by [@deluan](https://github.com/deluan)) - Fix public URLs built by plugins pointing at localhost instead of the caller's address. ([#6059](navidrome/navidrome#6059) by [@deluan](https://github.com/deluan)) ##### CLI - Add an `artwork` command group (`explain`, `refresh`, `cancel`) for diagnosing and re-driving artwork resolution. ([#5957](navidrome/navidrome#5957) by [@deluan](https://github.com/deluan)) - Add `missing list` and `missing fix` subcommands to deal with files that moved. ([#5928](navidrome/navidrome#5928) by [@zerovox](https://github.com/zerovox)) - Add `doctor` and `search rebuild` commands to detect and recover from search index corruption. ([#6069](navidrome/navidrome#6069) by [@deluan](https://github.com/deluan)) - Fix `restore` wiping the database when the backup file does not exist. ([#6085](navidrome/navidrome#6085) by [@Huang-404-Q](https://github.com/Huang-404-Q)) - Fix selective scan `--target` rejecting absolute paths. ([#5947](navidrome/navidrome#5947) by [@deluan](https://github.com/deluan)) - Fix `pls -p` writing playlist output to stderr instead of stdout. ([#5996](navidrome/navidrome#5996) by [@deluan](https://github.com/deluan)) ##### Server - Make genre and artist filtering much faster across all APIs by using indexed join tables. ([#5940](navidrome/navidrome#5940), [#5930](navidrome/navidrome#5930) by [@deluan](https://github.com/deluan)) - Report the app store or hosting platform via `ND_PLATFORM` in insights. ([#5956](navidrome/navidrome#5956) by [@deluan](https://github.com/deluan)) - Send the Navidrome User-Agent in all outgoing requests. ([#6020](navidrome/navidrome#6020) by [@mintsoft](https://github.com/mintsoft)) - Fix `getScanStatus` reporting `count=0` for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when `MusicFolder` contains a single quote. ([#6098](navidrome/navidrome#6098) by [@deluan](https://github.com/deluan)) ##### Database - Periodically run a full `ANALYZE` to keep query planner statistics trustworthy. ([#5740](navidrome/navidrome#5740) by [@deluan](https://github.com/deluan)) ##### Packaging & Build - Upgrade to Go 1.27. ([#5990](navidrome/navidrome#5990) by [@deluan](https://github.com/deluan)) - Upgrade the Docker base image to Alpine 3.22, and add `curl` to the container image. ([#6048](navidrome/navidrome#6048) by [@deluan](https://github.com/deluan), [#6116](navidrome/navidrome#6116) by [@miguelallopes](https://github.com/miguelallopes)) - Bump TagLib to 2.3.2. ([#6088](navidrome/navidrome#6088) by [@deluan](https://github.com/deluan)) - Windows MSI: remember install properties across upgrades. ([#5333](navidrome/navidrome#5333) by [@mintsoft](https://github.com/mintsoft)) - Fix a missing hyphen in the OpenRC script that caused crashes on startup. ([#5906](navidrome/navidrome#5906) by [@alinxviso](https://github.com/alinxviso)) - Fix a typo in the `--prometheus.enabled` description. ([#5878](navidrome/navidrome#5878) by [@0mp](https://github.com/0mp)) ##### Translations - Update Chinese (Simplified) translation. ([#5779](navidrome/navidrome#5779), [#5873](navidrome/navidrome#5873) by [@fxj368](https://github.com/fxj368)) - Update Italian translation. ([#5848](navidrome/navidrome#5848) by [@McCio](https://github.com/McCio)) - Update Japanese translation. ([#6080](navidrome/navidrome#6080) by [@karigane-cha](https://github.com/karigane-cha)) - Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. ([#5833](navidrome/navidrome#5833), [#6128](navidrome/navidrome#6128) by [@deluan](https://github.com/deluan)) ##### New Contributors - [@McCio](https://github.com/McCio) made their first contribution in [#5848](navidrome/navidrome#5848) - [@0mp](https://github.com/0mp) made their first contribution in [#5878](navidrome/navidrome#5878) - [@alinxviso](https://github.com/alinxviso) made their first contribution in [#5906](navidrome/navidrome#5906) - [@IgorPolyakov](https://github.com/IgorPolyakov) made their first contribution in [#5867](navidrome/navidrome#5867) - [@junkerderprovinz](https://github.com/junkerderprovinz) made their first contribution in [#5916](navidrome/navidrome#5916) - [@justadityaraj](https://github.com/justadityaraj) made their first contribution in [#5998](navidrome/navidrome#5998) - [@polybjorn](https://github.com/polybjorn) made their first contribution in [#6009](navidrome/navidrome#6009) - [@karigane-cha](https://github.com/karigane-cha) made their first contribution in [#6080](navidrome/navidrome#6080) - [@Shxiao101](https://github.com/Shxiao101) made their first contribution in [#6097](navidrome/navidrome#6097) - [@cmyksoda](https://github.com/cmyksoda) made their first contribution in [#5835](navidrome/navidrome#5835) - [@miguelallopes](https://github.com/miguelallopes) made their first contribution in [#6116](navidrome/navidrome#6116) - [@Huang-404-Q](https://github.com/Huang-404-Q) made their first contribution in [#6085](navidrome/navidrome#6085) - [@zerovox](https://github.com/zerovox) made their first contribution in [#5928](navidrome/navidrome#5928) - [@Sudo-Ivan](https://github.com/Sudo-Ivan) made their first contribution in [4168377b6](navidrome/navidrome@4168377b6) **Full Changelog**: <navidrome/navidrome@v0.63.2...v0.64.0> ##### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). ##### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods?run=navidrome) or [Zenith](https://zenith.hosting/host/navidrome?ref=navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)!
…0.64.0) (#2083) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/navidrome/navidrome](https://github.com/navidrome/navidrome) | minor | `0.63.2` → `0.64.0` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information. --- ### Release Notes <details> <summary>navidrome/navidrome (ghcr.io/navidrome/navidrome)</summary> ### [`v0.64.0`](https://github.com/navidrome/navidrome/releases/tag/v0.64.0) [Compare Source](navidrome/navidrome@v0.63.2...v0.64.0) This release brings an **experimental Jellyfin Music API**, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a **new background pipeline** with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a **uniform canonical 128-bit format**, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling. #####⚠️ Breaking Changes / Migration Notes - **All internal IDs are re-encoded** to a single canonical 128-bit base62 format. The migration touches every table, so **back up your database before upgrading**. Clients that cache item IDs (for example, offline downloads) may need to re-sync. ([#​5824](navidrome/navidrome#5824)) - **Plugin authors: Extism's built-in HTTP is disabled.** Calls through `pdk.NewHTTPRequest` (Go), `http::request` (Rust) or the equivalent in other PDKs now fail with `HTTP request ... is not allowed`. Plugins must use the host HTTP service instead: `host.HTTPSend` (Go) or `nd_pdk::host::http::send` (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's `requiredHosts`, or use a bare `"*"`. ([1a8463f7d](navidrome/navidrome@1a8463f7d), [276d767ce](navidrome/navidrome@276d767ce)) - **Shares are always owned by the user who creates them.** Admins can no longer create shares on behalf of another user via `userId`. ([1a8463f7d](navidrome/navidrome@1a8463f7d)) - **Configuration durations are now validated.** Negative values are rejected at startup. ([#​6002](navidrome/navidrome#6002)) - Navidrome now **warns about unrecognized options** in the config file, so typos no longer fail silently. ([#​5870](navidrome/navidrome#5870)) ##### Security This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them. - Fix SQL injection via the artist `role` sort and filter parameters in the Native API by validating the role against the known list. ([4168377b6](navidrome/navidrome@4168377b6), [GHSA-hm54-32q6-3rcr](GHSA-hm54-32q6-3rcr), reported and fixed by [@​Sudo-Ivan](https://github.com/Sudo-Ivan)) - Fix share-ownership spoofing (IDOR) that let a client-supplied `userId` on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. ([1a8463f7d](navidrome/navidrome@1a8463f7d), [GHSA-82gh-4ggp-gfg5](GHSA-82gh-4ggp-gfg5), reported by [@​gigioneggiando](https://github.com/gigioneggiando)) - Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. ([276d767ce](navidrome/navidrome@276d767ce), [GHSA-pr2j-mfc8-qjcc](GHSA-pr2j-mfc8-qjcc), reported by [@​qrn12580](https://github.com/qrn12580)) - Fix login rate limit bypass via spoofed `X-Forwarded-For`, `X-Real-IP` and `True-Client-IP` headers by keying the limit on the trust-aware client IP. ([#​6124](navidrome/navidrome#6124), [GHSA-f295-6wp9-qqfg](GHSA-f295-6wp9-qqfg), reported by [@​gehan-psbc](https://github.com/gehan-psbc) and [@​skarn958](https://github.com/skarn958)) - Fix memory exhaustion via a negative `size` parameter on `getCoverArt` and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. ([#​5847](navidrome/navidrome#5847), [GHSA-f22h-6qxh-rqq2](GHSA-f22h-6qxh-rqq2), reported by [@​arpitjain099](https://github.com/arpitjain099)) - Enforce track membership on public share streams so a share can only stream the tracks it contains. ([#​5769](navidrome/navidrome#5769) by [@​deluan](https://github.com/deluan)) - Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. ([#​6098](navidrome/navidrome#6098) by [@​deluan](https://github.com/deluan)) - Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. ([#​5881](navidrome/navidrome#5881), [#​5886](navidrome/navidrome#5886) by [@​deluan](https://github.com/deluan)) - Redact sensitive auth headers from request logs. ([82b9a44a1](navidrome/navidrome@82b9a44a1) by [@​deluan](https://github.com/deluan)) > **Note:** Several of the advisories linked above are still in **draft** on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release. ##### Configuration Changes | Status | Option | Description | Default | | ------ | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | New | `Jellyfin.Enabled` | Enable the experimental Jellyfin Music API. ([#​5730](navidrome/navidrome#5730)) | `false` | | New | `Jellyfin.ServerName` | Server name advertised to Jellyfin clients. ([#​5730](navidrome/navidrome#5730)) | `Navidrome <version>` | | New | `Jellyfin.ExposedPublicUsers` | Comma-separated usernames advertised on the unauthenticated public users endpoint. ([#​5730](navidrome/navidrome#5730)) | `""` | | New | `Jellyfin.MaxConcurrentStreams` | Bounds how many Jellyfin collection responses can stream at once. ([#​5783](navidrome/navidrome#5783)) | `max(2, MaxOpenConns/2)` | | New | `EnableNaturalSorting` | Sort names and titles naturally (e.g. "Track 2" before "Track 10"). ([#​6015](navidrome/navidrome#6015)) | `false` | | New | `MaxImageSize` | Cap on the size of artwork images Navidrome will decode. ([#​5931](navidrome/navidrome#5931)) | `20MB` | | New | `EnableScheduledDBAnalyze` | Periodically run a full `ANALYZE` to keep query planner statistics fresh. ([#​5740](navidrome/navidrome#5740)) | `true` | For a complete list of all configuration options, see the [Configuration Options](https://www.navidrome.org/docs/usage/configuration-options/) documentation. ##### Jellyfin API (Experimental) - Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with `Jellyfin.Enabled = true`. ([#​5730](navidrome/navidrome#5730) by [@​deluan](https://github.com/deluan)) - Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. ([#​5791](navidrome/navidrome#5791), [#​5948](navidrome/navidrome#5948), [#​5815](navidrome/navidrome#5815), [#​5817](navidrome/navidrome#5817) by [@​deluan](https://github.com/deluan), [#​5809](navidrome/navidrome#5809) by [@​kgarner7](https://github.com/kgarner7)) - Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. ([#​5782](navidrome/navidrome#5782) by [@​deluan](https://github.com/deluan)) - Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. ([#​6013](navidrome/navidrome#6013) by [@​deluan](https://github.com/deluan)) ##### Artwork - New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. ([#​5847](navidrome/navidrome#5847) by [@​deluan](https://github.com/deluan)) - Make the artwork image size cap configurable. ([#​5931](navidrome/navidrome#5931) by [@​deluan](https://github.com/deluan)) - Fix artist folder being promoted to album folder. ([#​5856](navidrome/navidrome#5856) by [@​kgarner7](https://github.com/kgarner7)) - Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. ([#​5808](navidrome/navidrome#5808), [#​6068](navidrome/navidrome#6068) by [@​deluan](https://github.com/deluan)) ##### UI - Add Refresh Metadata action to album and artist pages and context menus. ([#​6036](navidrome/navidrome#6036), [#​6078](navidrome/navidrome#6078) by [@​deluan](https://github.com/deluan)) - Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. ([#​5805](navidrome/navidrome#5805) by [@​deluan](https://github.com/deluan)) - Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. ([#​5835](navidrome/navidrome#5835) by [@​cmyksoda](https://github.com/cmyksoda)) - Add Artists, Songs, Playlists and Radio to the Default View options. ([#​5754](navidrome/navidrome#5754), [#​5801](navidrome/navidrome#5801) by [@​deluan](https://github.com/deluan)) - Add Share and Download actions to the Artist detail page. ([#​5944](navidrome/navidrome#5944) by [@​deluan](https://github.com/deluan)) - Show translation completion percentage in the language selector. ([#​5979](navidrome/navidrome#5979) by [@​deluan](https://github.com/deluan)) - Remember the "items per page" selection across sessions. ([#​5819](navidrome/navidrome#5819) by [@​deluan](https://github.com/deluan)) - Give visual feedback when downloading from a share. ([#​5865](navidrome/navidrome#5865) by [@​deluan](https://github.com/deluan)) - Fix logins sometimes showing the wrong user. ([#​5882](navidrome/navidrome#5882) by [@​deluan](https://github.com/deluan), [#​5767](navidrome/navidrome#5767) by [@​apkatsikas](https://github.com/apkatsikas)) - Fix each page's scroll position not being restored when navigating back. ([#​5892](navidrome/navidrome#5892) by [@​deluan](https://github.com/deluan)) - Fix playback starting when closing the disc cover lightbox. ([#​5901](navidrome/navidrome#5901) by [@​deluan](https://github.com/deluan)) - Fix playlist not reloading after rating or loving a track. ([#​6009](navidrome/navidrome#6009) by [@​polybjorn](https://github.com/polybjorn)) - Fix the album grid resizing in Safari when top menus open. ([#​6125](navidrome/navidrome#6125) by [@​york9675](https://github.com/york9675)) - Fix the album grid hover overlay corners in the Nautiline theme. ([#​6115](navidrome/navidrome#6115) by [@​deluan](https://github.com/deluan)) - Fix transcoding Default Bit Rate not accepting 0. ([8d77a49b3](navidrome/navidrome@8d77a49b3) by [@​deluan](https://github.com/deluan)) - Fix the Last.fm link not always showing on the artist details page. ([b0e1943d8](navidrome/navidrome@b0e1943d8) by [@​deluan](https://github.com/deluan)) ##### Playlists & Smart Playlists - Add album-level fields for sorting and filtering in smart playlists. ([#​5899](navidrome/navidrome#5899) by [@​deluan](https://github.com/deluan)) - Add per-playlist `refreshDelay` for stable daily or weekly smart playlists. ([#​5790](navidrome/navidrome#5790) by [@​deluan](https://github.com/deluan)) - Store playlist stars and ratings per user. ([#​5749](navidrome/navidrome#5749) by [@​deluan](https://github.com/deluan)) - Make playlist import much faster on large libraries. ([#​6055](navidrome/navidrome#6055) by [@​deluan](https://github.com/deluan)) - Fix in-place playlist edits not being detected by the scanner. ([#​5914](navidrome/navidrome#5914) by [@​junkerderprovinz](https://github.com/junkerderprovinz)) - Fix track edits being allowed on synced playlists via some APIs. ([#​5984](navidrome/navidrome#5984) by [@​deluan](https://github.com/deluan)) - Fix smart playlist song count being lost on re-import. ([#​5908](navidrome/navidrome#5908) by [@​deluan](https://github.com/deluan)) - Fix deleting many tracks from a playlist at once failing. ([#​5977](navidrome/navidrome#5977) by [@​deluan](https://github.com/deluan)) - Fix the `changed` timestamp not being updated when renaming a smart playlist. ([#​6082](navidrome/navidrome#6082) by [@​deluan](https://github.com/deluan)) ##### Scanner - Add optional natural sort order for names and titles. ([#​6015](navidrome/navidrome#6015) by [@​deluan](https://github.com/deluan)) - Support the `[bg:]` tag and skip unknown tags in LRC lyrics files. ([#​5966](navidrome/navidrome#5966) by [@​deluan](https://github.com/deluan)) - Fix album tags being sorted alphabetically instead of keeping the order from the files. ([#​5872](navidrome/navidrome#5872) by [@​deluan](https://github.com/deluan)) - Fix file creation time not being read on Linux. ([#​6046](navidrome/navidrome#6046) by [@​deluan](https://github.com/deluan)) ##### Subsonic API - Implement the OpenSubsonic `topSongsByArtistId` extension. ([#​5853](navidrome/navidrome#5853) by [@​kgarner7](https://github.com/kgarner7)) - Expose album-level ReplayGain. ([#​5816](navidrome/navidrome#5816) by [@​deluan](https://github.com/deluan)) - Fix `createShare` ignoring `DefaultDownloadableShare`. ([#​6121](navidrome/navidrome#6121) by [@​deluan](https://github.com/deluan)) - Fix double brackets when appending subtitle or version to titles. ([#​5832](navidrome/navidrome#5832) by [@​deluan](https://github.com/deluan)) ##### Transcoding & Streaming - Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. ([#​6105](navidrome/navidrome#6105) by [@​deluan](https://github.com/deluan)) - Fix truncated transcoded streams being delivered as complete. ([#​6035](navidrome/navidrome#6035) by [@​deluan](https://github.com/deluan)) - Fix AAC streams being reported as `audio/mp4` instead of `audio/aac`. ([#​5998](navidrome/navidrome#5998) by [@​justadityaraj](https://github.com/justadityaraj)) - Fix bit depth being reported for lossy transcode targets. ([#​5768](navidrome/navidrome#5768) by [@​deluan](https://github.com/deluan)) ##### Scrobbling - Add a per-user scrobble filter. ([#​5964](navidrome/navidrome#5964) by [@​deluan](https://github.com/deluan)) - Add a scrobble history Native API. ([#​5761](navidrome/navidrome#5761) by [@​kgarner7](https://github.com/kgarner7)) - Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. ([#​5818](navidrome/navidrome#5818), [#​6028](navidrome/navidrome#6028) by [@​deluan](https://github.com/deluan)) - Fix out-of-order playback reports being rejected. ([#​5793](navidrome/navidrome#5793) by [@​deluan](https://github.com/deluan)) ##### Plugins - Add plugin-specific storage. ([#​5839](navidrome/navidrome#5839) by [@​kgarner7](https://github.com/kgarner7)) - Add scrobble access to the plugin SDK. ([#​5795](navidrome/navidrome#5795) by [@​kgarner7](https://github.com/kgarner7)) - Surface the valid agent names in logs and the Plugins UI. ([#​5910](navidrome/navidrome#5910) by [@​deluan](https://github.com/deluan)) - Fix plugin agents not being loaded in CLI commands. ([#​5959](navidrome/navidrome#5959) by [@​deluan](https://github.com/deluan)) - Fix public URLs built by plugins pointing at localhost instead of the caller's address. ([#​6059](navidrome/navidrome#6059) by [@​deluan](https://github.com/deluan)) ##### CLI - Add an `artwork` command group (`explain`, `refresh`, `cancel`) for diagnosing and re-driving artwork resolution. ([#​5957](navidrome/navidrome#5957) by [@​deluan](https://github.com/deluan)) - Add `missing list` and `missing fix` subcommands to deal with files that moved. ([#​5928](navidrome/navidrome#5928) by [@​zerovox](https://github.com/zerovox)) - Add `doctor` and `search rebuild` commands to detect and recover from search index corruption. ([#​6069](navidrome/navidrome#6069) by [@​deluan](https://github.com/deluan)) - Fix `restore` wiping the database when the backup file does not exist. ([#​6085](navidrome/navidrome#6085) by [@​Huang-404-Q](https://github.com/Huang-404-Q)) - Fix selective scan `--target` rejecting absolute paths. ([#​5947](navidrome/navidrome#5947) by [@​deluan](https://github.com/deluan)) - Fix `pls -p` writing playlist output to stderr instead of stdout. ([#​5996](navidrome/navidrome#5996) by [@​deluan](https://github.com/deluan)) ##### Server - Make genre and artist filtering much faster across all APIs by using indexed join tables. ([#​5940](navidrome/navidrome#5940), [#​5930](navidrome/navidrome#5930) by [@​deluan](https://github.com/deluan)) - Report the app store or hosting platform via `ND_PLATFORM` in insights. ([#​5956](navidrome/navidrome#5956) by [@​deluan](https://github.com/deluan)) - Send the Navidrome User-Agent in all outgoing requests. ([#​6020](navidrome/navidrome#6020) by [@​mintsoft](https://github.com/mintsoft)) - Fix `getScanStatus` reporting `count=0` for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when `MusicFolder` contains a single quote. ([#​6098](navidrome/navidrome#6098) by [@​deluan](https://github.com/deluan)) ##### Database - Periodically run a full `ANALYZE` to keep query planner statistics trustworthy. ([#​5740](navidrome/navidrome#5740) by [@​deluan](https://github.com/deluan)) ##### Packaging & Build - Upgrade to Go 1.27. ([#​5990](navidrome/navidrome#5990) by [@​deluan](https://github.com/deluan)) - Upgrade the Docker base image to Alpine 3.22, and add `curl` to the container image. ([#​6048](navidrome/navidrome#6048) by [@​deluan](https://github.com/deluan), [#​6116](navidrome/navidrome#6116) by [@​miguelallopes](https://github.com/miguelallopes)) - Bump TagLib to 2.3.2. ([#​6088](navidrome/navidrome#6088) by [@​deluan](https://github.com/deluan)) - Windows MSI: remember install properties across upgrades. ([#​5333](navidrome/navidrome#5333) by [@​mintsoft](https://github.com/mintsoft)) - Fix a missing hyphen in the OpenRC script that caused crashes on startup. ([#​5906](navidrome/navidrome#5906) by [@​alinxviso](https://github.com/alinxviso)) - Fix a typo in the `--prometheus.enabled` description. ([#​5878](navidrome/navidrome#5878) by [@​0mp](https://github.com/0mp)) ##### Translations - Update Chinese (Simplified) translation. ([#​5779](navidrome/navidrome#5779), [#​5873](navidrome/navidrome#5873) by [@​fxj368](https://github.com/fxj368)) - Update Italian translation. ([#​5848](navidrome/navidrome#5848) by [@​McCio](https://github.com/McCio)) - Update Japanese translation. ([#​6080](navidrome/navidrome#6080) by [@​karigane-cha](https://github.com/karigane-cha)) - Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. ([#​5833](navidrome/navidrome#5833), [#​6128](navidrome/navidrome#6128) by [@​deluan](https://github.com/deluan)) ##### New Contributors - [@​McCio](https://github.com/McCio) made their first contribution in [#​5848](navidrome/navidrome#5848) - [@​0mp](https://github.com/0mp) made their first contribution in [#​5878](navidrome/navidrome#5878) - [@​alinxviso](https://github.com/alinxviso) made their first contribution in [#​5906](navidrome/navidrome#5906) - [@​IgorPolyakov](https://github.com/IgorPolyakov) made their first contribution in [#​5867](navidrome/navidrome#5867) - [@​junkerderprovinz](https://github.com/junkerderprovinz) made their first contribution in [#​5916](navidrome/navidrome#5916) - [@​justadityaraj](https://github.com/justadityaraj) made their first contribution in [#​5998](navidrome/navidrome#5998) - [@​polybjorn](https://github.com/polybjorn) made their first contribution in [#​6009](navidrome/navidrome#6009) - [@​karigane-cha](https://github.com/karigane-cha) made their first contribution in [#​6080](navidrome/navidrome#6080) - [@​Shxiao101](https://github.com/Shxiao101) made their first contribution in [#​6097](navidrome/navidrome#6097) - [@​cmyksoda](https://github.com/cmyksoda) made their first contribution in [#​5835](navidrome/navidrome#5835) - [@​miguelallopes](https://github.com/miguelallopes) made their first contribution in [#​6116](navidrome/navidrome#6116) - [@​Huang-404-Q](https://github.com/Huang-404-Q) made their first contribution in [#​6085](navidrome/navidrome#6085) - [@​zerovox](https://github.com/zerovox) made their first contribution in [#​5928](navidrome/navidrome#5928) - [@​Sudo-Ivan](https://github.com/Sudo-Ivan) made their first contribution in [4168377b6](navidrome/navidrome@4168377b6) **Full Changelog**: <navidrome/navidrome@v0.63.2...v0.64.0> ##### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). ##### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods?run=navidrome) or [Zenith](https://zenith.hosting/host/navidrome?ref=navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)! </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNy4xIiwidXBkYXRlZEluVmVyIjoiNDQuMTcuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9taW5vciJdfQ==--> Reviewed-on: https://git.aresu.eu/GiorgioAresu/home-ops/pulls/2083
Problem
Navidrome's default AAC transcode emits raw ADTS (
ffmpeg ... -f adts -), but the MIME table mapped.aactoaudio/mp4. Clients that dispatch strictly onContent-Typecould reject the stream because the declared container did not match the payload.Changes
One line in
resources/mime_types.yaml: map.aactoaudio/aac..m4aand.alacstay onaudio/mp4, since those really are MP4.User impact
AAC transcodes and Jellyfin packed-audio segments are now labeled with the media type matching their ADTS payload, improving playback compatibility without changing the encoded bytes.
Related issue
Fixes #5958
Verification
resources.FS()thatinitMimeTypesnow resolves.aactoaudio/aac, while.m4a/.alacstayaudio/mp4and.mp3/.flacare unchanged.go build -tags netgo,sqlite_fts5 ./conf/... ./server/subsonic/... ./resources/...passed. (./dbfails to build in my environment without cgo, identically on unmodifiedmaster.)master.Type of Change
Checklist
Deliberately not done
The parked AAC decision in
server/subsonic/transcode.gois unchanged. This PR only corrects the label on output Navidrome already produces.