ops/homelab

Fork 0

chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.2 #136

Open

renovate-bot wants to merge 1 commit from renovate/ghcr.io-navidrome-navidrome-0.x into main

renovate-bot commented

2026-09-21 21:10:05 +00:00

Member

This PR contains the following updates:

Package	Update	Change
ghcr.io/navidrome/navidrome	minor	`0.63.2` → `0.64.2`

Release Notes

navidrome/navidrome (ghcr.io/navidrome/navidrome)

`v0.64.2`

Compare Source

This is a bug fix release. The main fix is for users on slow storage (USB disks, remote drives), who have seen floods of database is locked errors, UI freezes and failed full scans since 0.64.0. Scans now cause much less lock contention: the artwork worker pauses while a scan runs, and ANALYZE no longer holds the write lock for a long time. It also fixes scans that always failed on 32-bit builds (armv5/6/7, 386) when a file had a broken track or disc number.

Security

Sanitize user-controlled names (playlists, albums, artists, track titles) in the Content-Disposition header of downloads, so a crafted name cannot change the name of the downloaded file. (#5895 by @zapisanchez)
Stop writing the admin password to the log when the initial admin user cannot be created. (#5897 by @zapisanchez)

Scanner

Fix database is locked errors, UI freezes and failed scans on slow storage. The artwork worker now pauses during scans, ANALYZE runs one index at a time, @eaDir thumbnail folders are ignored, and folder saves are retried when the database is busy. (#6201 by @deluan)
Fix scans failing with value out of range on 32-bit builds when a file has an invalid track number, disc number or BPM. A migration resets existing invalid values. (#6202 by @deluan)

Server

Fix a failed initial admin creation that marked the initial setup as done, leaving the server without an admin user. Also fix invalid JSON in some delete responses and the missing Content-Type on shared playlist (M3U) downloads. (#5897 by @zapisanchez)

Jellyfin API

Honor the IsPublic flag when creating a playlist. Before, all playlists created through the Jellyfin API were private. (#6204 by @deluan)

New Contributors

@zapisanchez made their first contribution in #5895

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.64.1...v0.64.2

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them?
You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

Read installation instructions on our website.
Host Navidrome on PikaPods or Zenith for a simple cloud solution.
Reach out on Discord, Reddit and Twitter!

`v0.64.1`: - Security Fixes

Compare Source

This is a security release. It fixes five vulnerabilities reported through our GitHub Security Advisory program, covering Subsonic authentication, artwork fetching, playlist cover images, player ownership, and per-user library filtering. Upgrade as soon as you can. Thanks to the researchers credited below for reporting them privately.

The release also improves Jellyfin client support, with both Manet and JellyBox tested and validated against live servers. Manet used to abort its entire library sync on a single missing field and show an empty library. It now syncs end to end. JellyBox got stuck on the login screen. It now signs in and plays, confirmed on Android. Navidrome also reports itself as Jellyfin 12.1.0, accepts Quick Connect sign-in, and can announce itself on your local network so clients find it without you typing an address.

Smart playlists can reference another playlist by path, and the web UI now formats dates using the language you picked in Personal settings.

Security

Unauthenticated password brute-force through the Subsonic API. Failed Subsonic logins were never throttled, so an attacker could guess passwords at full speed. Navidrome now rate limits failed authentication attempts. High, CVSS 7.4. (GHSA-p994-r776-mw52, #6185) Reported by @osageling.
Authenticated SSRF through M3U external album artwork. A playlist could point #EXTALBUMARTURL at a private or loopback address, turning the server into a probe for internal network services. Navidrome now blocks private and loopback addresses in remote image fetches. Medium, CVSS 6.5. (GHSA-8hjf-6h34-82hr, #6181) Reported by @kaardeco.
Cross-library file read through the M3U playlist cover. #EXTALBUMARTURL also accepted a local path, so a playlist could serve any file the server can read as its cover image. Only real image files are accepted as local artwork sources now. Medium, CVSS 6.5. (GHSA-vwq6-xrw5-phpg, #6180) Reported by @qrn12580.
Player takeover by any authenticated user. Creating a player could overwrite an existing record and reassign its owner, and device registration reused another user's player without an ownership check. Both paths now check the owner. Medium, CVSS 6.4. (GHSA-37h4-53gj-cw8m, #6184) Reported by @RealFakeAccount and @qrn12580.
Library filter skipped on bookmarks, playlist tracks and now-playing. These three endpoints ignored the libraries a user is allowed to see, leaking track metadata from other libraries. The filter now applies to all of them. Medium, CVSS 4.3. (GHSA-pcjv-h48m-833g, #6179) Reported by @sondt99.

Configuration Changes

Status	Option	Description	Default
New	`Jellyfin.AutoDiscovery`	Answers Jellyfin's UDP discovery broadcasts, so clients find the server on the local network. (#6169)	`false`
New	`Jellyfin.QuickConnect`	Allows Quick Connect sign-in, where a client shows a code you approve from a session that is already signed in. (#6174)	`true`

For a complete list of all configuration options, see the Configuration Options documentation.

Jellyfin API

Add Quick Connect sign-in. The client shows a short code, and you approve it from a session that is already signed in, so the client never sees your password. (#6174 by @deluan)
Add opt-in LAN auto-discovery, so Jellyfin clients find the server without you typing its address. Docker users need host networking for the UDP broadcast to reach the container. (#6169 by @deluan)
Report Jellyfin 12.1.0 and add the 12.x features clients check for, including fillWidth and fillHeight image sizing. (#6163 by @deluan)
Match Jellyfin's item payloads, so clients that decode strictly can finish a sync instead of erroring out. (#6151 by @deluan)
Match Jellyfin on login SessionInfo, item types and universal streams. (#6161 by @deluan)

UI

Format dates using the language selected in Personal settings, instead of always following the browser locale. (#6160 by @deluan)

Smart Playlists

Reference another playlist by its path in a smart playlist rule, instead of by id. (#5187 by @davidvedvick)

Subsonic API

Log a warning when a nowPlaying scrobble sends more than one id, which the API does not allow. (6b3938b5b by @deluan)

Server

Fix the ExtAuth logout redirect on unauthenticated page loads, and stop the warning spam from untrusted sources. (#6176 by @deluan)
Return 404 instead of 500 when a native API resource does not exist. (#6131 by @deluan)

Artwork

Report a failure when the Last.fm artist page has no image. Last.fm now answers non-browser clients with a bot challenge page, which Navidrome read as "this artist has no image" and recorded as final, with nothing in the log. It now logs a warning and retries, and the other image agents still get their turn. (#6198 by @deluan)
Store artwork files as group-readable (mode 0640) instead of owner-only, so other services on the same host can read the image cache. (#6189 by @kwo)

Scanner

Update go-taglib to fix "permission denied" errors on shared hosts. (d00c84716 by @deluan)

Scrobbling

Double-encode plus signs in artist and track names sent to Last.fm, so tracks with a + in the name scrobble correctly. (#6158 by @deluan)

Packaging

Repair root-owned artwork and plugins folders on upgrade. Installs affected by this could not write their own cache. (#6143 by @deluan)

Translations

Update Finnish and Dutch translations from POEditor. (#6148 by @deluan)
Update missing German translations. (#6146 by @strecke)
Improve the Swedish translation. (#6177 by @NickWick13)
Update Chinese Simplified translations. (#6152 by @fxj368)
Update Portuguese (Brazil) translations from POEditor. (#6197 by @deluan)

New Contributors

@davidvedvick made their first contribution in #5187
@strecke made their first contribution in #6146
@NickWick13 made their first contribution in #6177
@kwo made their first contribution in #6189
@aerusso made their first contribution in #6190

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.64.0...v0.64.1

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them?
You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

Read installation instructions on our website.
Host Navidrome on PikaPods or Zenith for a simple cloud solution.
Reach out on Discord, Reddit and Twitter!

`v0.64.0`

Compare Source

This release brings an experimental Jellyfin Music API, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a new background pipeline with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a uniform canonical 128-bit format, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling.

⚠️ Breaking Changes / Migration Notes

All internal IDs are re-encoded to a single canonical 128-bit base62 format. The migration touches every table, so back up your database before upgrading. Clients that cache item IDs (for example, offline downloads) may need to re-sync. (#5824)
Plugin authors: Extism's built-in HTTP is disabled. Calls through pdk.NewHTTPRequest (Go), http::request (Rust) or the equivalent in other PDKs now fail with HTTP request ... is not allowed. Plugins must use the host HTTP service instead: host.HTTPSend (Go) or nd_pdk::host::http::send (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's requiredHosts, or use a bare "*". (1a8463f7d, 276d767ce)
Shares are always owned by the user who creates them. Admins can no longer create shares on behalf of another user via userId. (1a8463f7d)
Configuration durations are now validated. Negative values are rejected at startup. (#6002)
Navidrome now warns about unrecognized options in the config file, so typos no longer fail silently. (#5870)

Security

This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them.

Fix SQL injection via the artist role sort and filter parameters in the Native API by validating the role against the known list. (4168377b6, GHSA-hm54-32q6-3rcr, reported and fixed by @Sudo-Ivan)
Fix share-ownership spoofing (IDOR) that let a client-supplied userId on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. (1a8463f7d, GHSA-82gh-4ggp-gfg5, reported by @gigioneggiando)
Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. (276d767ce, GHSA-pr2j-mfc8-qjcc, reported by @qrn12580)
Fix login rate limit bypass via spoofed X-Forwarded-For, X-Real-IP and True-Client-IP headers by keying the limit on the trust-aware client IP. (#6124, GHSA-f295-6wp9-qqfg, reported by @gehan-psbc and @skarn958)
Fix memory exhaustion via a negative size parameter on getCoverArt and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. (#5847, GHSA-f22h-6qxh-rqq2, reported by @arpitjain099)
Enforce track membership on public share streams so a share can only stream the tracks it contains. (#5769 by @deluan)
Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. (#6098 by @deluan)
Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. (#5881, #5886 by @deluan)
Redact sensitive auth headers from request logs. (82b9a44a1 by @deluan)

Note: Several of the advisories linked above are still in draft on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release.

Configuration Changes

Status	Option	Description	Default
New	`Jellyfin.Enabled`	Enable the experimental Jellyfin Music API. (#5730)	`false`
New	`Jellyfin.ServerName`	Server name advertised to Jellyfin clients. (#5730)	`Navidrome <version>`
New	`Jellyfin.ExposedPublicUsers`	Comma-separated usernames advertised on the unauthenticated public users endpoint. (#5730)	`""`
New	`Jellyfin.MaxConcurrentStreams`	Bounds how many Jellyfin collection responses can stream at once. (#5783)	`max(2, MaxOpenConns/2)`
New	`EnableNaturalSorting`	Sort names and titles naturally (e.g. "Track 2" before "Track 10"). (#6015)	`false`
New	`MaxImageSize`	Cap on the size of artwork images Navidrome will decode. (#5931)	`20MB`
New	`EnableScheduledDBAnalyze`	Periodically run a full `ANALYZE` to keep query planner statistics fresh. (#5740)	`true`

For a complete list of all configuration options, see the Configuration Options documentation.

Jellyfin API (Experimental)

Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with Jellyfin.Enabled = true. (#5730 by @deluan)
Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. (#5791, #5948, #5815, #5817 by @deluan, #5809 by @kgarner7)
Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. (#5782 by @deluan)
Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. (#6013 by @deluan)

Artwork

New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. (#5847 by @deluan)
Make the artwork image size cap configurable. (#5931 by @deluan)
Fix artist folder being promoted to album folder. (#5856 by @kgarner7)
Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. (#5808, #6068 by @deluan)

UI

Add Refresh Metadata action to album and artist pages and context menus. (#6036, #6078 by @deluan)
Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. (#5805 by @deluan)
Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. (#5835 by @cmyksoda)
Add Artists, Songs, Playlists and Radio to the Default View options. (#5754, #5801 by @deluan)
Add Share and Download actions to the Artist detail page. (#5944 by @deluan)
Show translation completion percentage in the language selector. (#5979 by @deluan)
Remember the "items per page" selection across sessions. (#5819 by @deluan)
Give visual feedback when downloading from a share. (#5865 by @deluan)
Fix logins sometimes showing the wrong user. (#5882 by @deluan, #5767 by @apkatsikas)
Fix each page's scroll position not being restored when navigating back. (#5892 by @deluan)
Fix playback starting when closing the disc cover lightbox. (#5901 by @deluan)
Fix playlist not reloading after rating or loving a track. (#6009 by @polybjorn)
Fix the album grid resizing in Safari when top menus open. (#6125 by @york9675)
Fix the album grid hover overlay corners in the Nautiline theme. (#6115 by @deluan)
Fix transcoding Default Bit Rate not accepting 0. (8d77a49b3 by @deluan)
Fix the Last.fm link not always showing on the artist details page. (b0e1943d8 by @deluan)

Playlists & Smart Playlists

Add album-level fields for sorting and filtering in smart playlists. (#5899 by @deluan)
Add per-playlist refreshDelay for stable daily or weekly smart playlists. (#5790 by @deluan)
Store playlist stars and ratings per user. (#5749 by @deluan)
Make playlist import much faster on large libraries. (#6055 by @deluan)
Fix in-place playlist edits not being detected by the scanner. (#5914 by @junkerderprovinz)
Fix track edits being allowed on synced playlists via some APIs. (#5984 by @deluan)
Fix smart playlist song count being lost on re-import. (#5908 by @deluan)
Fix deleting many tracks from a playlist at once failing. (#5977 by @deluan)
Fix the changed timestamp not being updated when renaming a smart playlist. (#6082 by @deluan)

Scanner

Add optional natural sort order for names and titles. (#6015 by @deluan)
Support the [bg:] tag and skip unknown tags in LRC lyrics files. (#5966 by @deluan)
Fix album tags being sorted alphabetically instead of keeping the order from the files. (#5872 by @deluan)
Fix file creation time not being read on Linux. (#6046 by @deluan)

Subsonic API

Implement the OpenSubsonic topSongsByArtistId extension. (#5853 by @kgarner7)
Fix createShare ignoring DefaultDownloadableShare. (#6121 by @deluan)
Fix double brackets when appending subtitle or version to titles. (#5832 by @deluan)

Transcoding & Streaming

Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. (#6105 by @deluan)
Fix truncated transcoded streams being delivered as complete. (#6035 by @deluan)
Fix AAC streams being reported as audio/mp4 instead of audio/aac. (#5998 by @justadityaraj)
Fix bit depth being reported for lossy transcode targets. (#5768 by @deluan)

Scrobbling

Add a per-user scrobble filter. (#5964 by @deluan)
Add a scrobble history Native API. (#5761 by @kgarner7)
Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. (#5818, #6028 by @deluan)
Fix out-of-order playback reports being rejected. (#5793 by @deluan)

Plugins

Add plugin-specific storage. (#5839 by @kgarner7)
Add scrobble access to the plugin SDK. (#5795 by @kgarner7)
Surface the valid agent names in logs and the Plugins UI. (#5910 by @deluan)
Fix plugin agents not being loaded in CLI commands. (#5959 by @deluan)
Fix public URLs built by plugins pointing at localhost instead of the caller's address. (#6059 by @deluan)

CLI

Add an artwork command group (explain, refresh, cancel) for diagnosing and re-driving artwork resolution. (#5957 by @deluan)
Add missing list and missing fix subcommands to deal with files that moved. (#5928 by @zerovox)
Add doctor and search rebuild commands to detect and recover from search index corruption. (#6069 by @deluan)
Fix restore wiping the database when the backup file does not exist. (#6085 by @Huang-404-Q)
Fix selective scan --target rejecting absolute paths. (#5947 by @deluan)
Fix pls -p writing playlist output to stderr instead of stdout. (#5996 by @deluan)

Server

Make genre and artist filtering much faster across all APIs by using indexed join tables. (#5940, #5930 by @deluan)
Report the app store or hosting platform via ND_PLATFORM in insights. (#5956 by @deluan)
Send the Navidrome User-Agent in all outgoing requests. (#6020 by @mintsoft)
Fix getScanStatus reporting count=0 for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when MusicFolder contains a single quote. (#6098 by @deluan)

Database

Periodically run a full ANALYZE to keep query planner statistics trustworthy. (#5740 by @deluan)

Packaging & Build

Upgrade to Go 1.27. (#5990 by @deluan)
Upgrade the Docker base image to Alpine 3.22, and add curl to the container image. (#6048 by @deluan, #6116 by @miguelallopes)
Bump TagLib to 2.3.2. (#6088 by @deluan)
Windows MSI: remember install properties across upgrades. (#5333 by @mintsoft)
Fix a missing hyphen in the OpenRC script that caused crashes on startup. (#5906 by @alinxviso)
Fix a typo in the --prometheus.enabled description. (#5878 by @0mp)

Translations

Update Chinese (Simplified) translation. (#5779, #5873 by @fxj368)
Update Italian translation. (#5848 by @McCio)
Update Japanese translation. (#6080 by @karigane-cha)
Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. (#5833, #6128 by @deluan)

New Contributors

@McCio made their first contribution in #5848
@0mp made their first contribution in #5878
@alinxviso made their first contribution in #5906
@IgorPolyakov made their first contribution in #5867
@junkerderprovinz made their first contribution in #5916
@justadityaraj made their first contribution in #5998
@polybjorn made their first contribution in #6009
@karigane-cha made their first contribution in #6080
@Shxiao101 made their first contribution in #6097
@cmyksoda made their first contribution in #5835
@miguelallopes made their first contribution in #6116
@Huang-404-Q made their first contribution in #6085
@zerovox made their first contribution in #5928
@Sudo-Ivan made their first contribution in 4168377b6

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.63.2...v0.64.0

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them?
You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

Read installation instructions on our website.
Host Navidrome on PikaPods or Zenith for a simple cloud solution.
Reach out on Discord, Reddit and Twitter!

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/navidrome/navidrome](https://github.com/navidrome/navidrome) | minor | `0.63.2` → `0.64.2` | --- ### Release Notes <details> <summary>navidrome/navidrome (ghcr.io/navidrome/navidrome)</summary> ### [`v0.64.2`](https://github.com/navidrome/navidrome/releases/tag/v0.64.2) [Compare Source](https://github.com/navidrome/navidrome/compare/v0.64.1...v0.64.2) This is a bug fix release. The main fix is for users on slow storage (USB disks, remote drives), who have seen floods of `database is locked` errors, UI freezes and failed full scans since 0.64.0. Scans now cause much less lock contention: the artwork worker pauses while a scan runs, and `ANALYZE` no longer holds the write lock for a long time. It also fixes scans that always failed on 32-bit builds (armv5/6/7, 386) when a file had a broken track or disc number. #### Security - Sanitize user-controlled names (playlists, albums, artists, track titles) in the `Content-Disposition` header of downloads, so a crafted name cannot change the name of the downloaded file. ([#5895](https://github.com/navidrome/navidrome/pull/5895) by [@zapisanchez](https://github.com/zapisanchez)) - Stop writing the admin password to the log when the initial admin user cannot be created. ([#5897](https://github.com/navidrome/navidrome/pull/5897) by [@zapisanchez](https://github.com/zapisanchez)) #### Scanner - Fix `database is locked` errors, UI freezes and failed scans on slow storage. The artwork worker now pauses during scans, `ANALYZE` runs one index at a time, `@eaDir` thumbnail folders are ignored, and folder saves are retried when the database is busy. ([#6201](https://github.com/navidrome/navidrome/pull/6201) by [@deluan](https://github.com/deluan)) - Fix scans failing with `value out of range` on 32-bit builds when a file has an invalid track number, disc number or BPM. A migration resets existing invalid values. ([#6202](https://github.com/navidrome/navidrome/pull/6202) by [@deluan](https://github.com/deluan)) #### Server - Fix a failed initial admin creation that marked the initial setup as done, leaving the server without an admin user. Also fix invalid JSON in some delete responses and the missing `Content-Type` on shared playlist (M3U) downloads. ([#5897](https://github.com/navidrome/navidrome/pull/5897) by [@zapisanchez](https://github.com/zapisanchez)) #### Jellyfin API - Honor the `IsPublic` flag when creating a playlist. Before, all playlists created through the Jellyfin API were private. ([#6204](https://github.com/navidrome/navidrome/pull/6204) by [@deluan](https://github.com/deluan)) #### New Contributors - [@zapisanchez](https://github.com/zapisanchez) made their first contribution in [#5895](https://github.com/navidrome/navidrome/pull/5895) **Full Changelog**: <https://github.com/navidrome/navidrome/compare/v0.64.1...v0.64.2> #### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). #### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods?run=navidrome) or [Zenith](https://zenith.hosting/host/navidrome?ref=navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)! ### [`v0.64.1`](https://github.com/navidrome/navidrome/releases/tag/v0.64.1): - Security Fixes [Compare Source](https://github.com/navidrome/navidrome/compare/v0.64.0...v0.64.1) This is a security release. It fixes five vulnerabilities reported through our GitHub Security Advisory program, covering Subsonic authentication, artwork fetching, playlist cover images, player ownership, and per-user library filtering. Upgrade as soon as you can. Thanks to the researchers credited below for reporting them privately. The release also improves Jellyfin client support, with both Manet and JellyBox tested and validated against live servers. Manet used to abort its entire library sync on a single missing field and show an empty library. It now syncs end to end. JellyBox got stuck on the login screen. It now signs in and plays, confirmed on Android. Navidrome also reports itself as Jellyfin 12.1.0, accepts Quick Connect sign-in, and can announce itself on your local network so clients find it without you typing an address. Smart playlists can reference another playlist by path, and the web UI now formats dates using the language you picked in Personal settings. #### Security - **Unauthenticated password brute-force through the Subsonic API.** Failed Subsonic logins were never throttled, so an attacker could guess passwords at full speed. Navidrome now rate limits failed authentication attempts. High, CVSS 7.4. ([GHSA-p994-r776-mw52](https://github.com/navidrome/navidrome/security/advisories/GHSA-p994-r776-mw52), [#6185](https://github.com/navidrome/navidrome/pull/6185)) Reported by [@osageling](https://github.com/osageling). - **Authenticated SSRF through M3U external album artwork.** A playlist could point `#EXTALBUMARTURL` at a private or loopback address, turning the server into a probe for internal network services. Navidrome now blocks private and loopback addresses in remote image fetches. Medium, CVSS 6.5. ([GHSA-8hjf-6h34-82hr](https://github.com/navidrome/navidrome/security/advisories/GHSA-8hjf-6h34-82hr), [#6181](https://github.com/navidrome/navidrome/pull/6181)) Reported by [@kaardeco](https://github.com/kaardeco). - **Cross-library file read through the M3U playlist cover.** `#EXTALBUMARTURL` also accepted a local path, so a playlist could serve any file the server can read as its cover image. Only real image files are accepted as local artwork sources now. Medium, CVSS 6.5. ([GHSA-vwq6-xrw5-phpg](https://github.com/navidrome/navidrome/security/advisories/GHSA-vwq6-xrw5-phpg), [#6180](https://github.com/navidrome/navidrome/pull/6180)) Reported by [@qrn12580](https://github.com/qrn12580). - **Player takeover by any authenticated user.** Creating a player could overwrite an existing record and reassign its owner, and device registration reused another user's player without an ownership check. Both paths now check the owner. Medium, CVSS 6.4. ([GHSA-37h4-53gj-cw8m](https://github.com/navidrome/navidrome/security/advisories/GHSA-37h4-53gj-cw8m), [#6184](https://github.com/navidrome/navidrome/pull/6184)) Reported by [@RealFakeAccount](https://github.com/RealFakeAccount) and [@qrn12580](https://github.com/qrn12580). - **Library filter skipped on bookmarks, playlist tracks and now-playing.** These three endpoints ignored the libraries a user is allowed to see, leaking track metadata from other libraries. The filter now applies to all of them. Medium, CVSS 4.3. ([GHSA-pcjv-h48m-833g](https://github.com/navidrome/navidrome/security/advisories/GHSA-pcjv-h48m-833g), [#6179](https://github.com/navidrome/navidrome/pull/6179)) Reported by [@sondt99](https://github.com/sondt99). #### Configuration Changes | Status | Option | Description | Default | | ------ | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | | New | `Jellyfin.AutoDiscovery` | Answers Jellyfin's UDP discovery broadcasts, so clients find the server on the local network. ([#6169](https://github.com/navidrome/navidrome/pull/6169)) | `false` | | New | `Jellyfin.QuickConnect` | Allows Quick Connect sign-in, where a client shows a code you approve from a session that is already signed in. ([#6174](https://github.com/navidrome/navidrome/pull/6174)) | `true` | For a complete list of all configuration options, see the [Configuration Options](https://www.navidrome.org/docs/usage/configuration-options/) documentation. #### Jellyfin API - Add Quick Connect sign-in. The client shows a short code, and you approve it from a session that is already signed in, so the client never sees your password. ([#6174](https://github.com/navidrome/navidrome/pull/6174) by [@deluan](https://github.com/deluan)) - Add opt-in LAN auto-discovery, so Jellyfin clients find the server without you typing its address. Docker users need host networking for the UDP broadcast to reach the container. ([#6169](https://github.com/navidrome/navidrome/pull/6169) by [@deluan](https://github.com/deluan)) - Report Jellyfin 12.1.0 and add the 12.x features clients check for, including `fillWidth` and `fillHeight` image sizing. ([#6163](https://github.com/navidrome/navidrome/pull/6163) by [@deluan](https://github.com/deluan)) - Match Jellyfin's item payloads, so clients that decode strictly can finish a sync instead of erroring out. ([#6151](https://github.com/navidrome/navidrome/pull/6151) by [@deluan](https://github.com/deluan)) - Match Jellyfin on login `SessionInfo`, item types and universal streams. ([#6161](https://github.com/navidrome/navidrome/pull/6161) by [@deluan](https://github.com/deluan)) #### UI - Format dates using the language selected in Personal settings, instead of always following the browser locale. ([#6160](https://github.com/navidrome/navidrome/pull/6160) by [@deluan](https://github.com/deluan)) #### Smart Playlists - Reference another playlist by its path in a smart playlist rule, instead of by id. ([#5187](https://github.com/navidrome/navidrome/pull/5187) by [@davidvedvick](https://github.com/davidvedvick)) #### Subsonic API - Log a warning when a `nowPlaying` scrobble sends more than one id, which the API does not allow. ([6b3938b5b](https://github.com/navidrome/navidrome/commit/6b3938b5b) by [@deluan](https://github.com/deluan)) #### Server - Fix the ExtAuth logout redirect on unauthenticated page loads, and stop the warning spam from untrusted sources. ([#6176](https://github.com/navidrome/navidrome/pull/6176) by [@deluan](https://github.com/deluan)) - Return 404 instead of 500 when a native API resource does not exist. ([#6131](https://github.com/navidrome/navidrome/pull/6131) by [@deluan](https://github.com/deluan)) #### Artwork - Report a failure when the Last.fm artist page has no image. Last.fm now answers non-browser clients with a bot challenge page, which Navidrome read as "this artist has no image" and recorded as final, with nothing in the log. It now logs a warning and retries, and the other image agents still get their turn. ([#6198](https://github.com/navidrome/navidrome/pull/6198) by [@deluan](https://github.com/deluan)) - Store artwork files as group-readable (mode `0640`) instead of owner-only, so other services on the same host can read the image cache. ([#6189](https://github.com/navidrome/navidrome/pull/6189) by [@kwo](https://github.com/kwo)) #### Scanner - Update go-taglib to fix "permission denied" errors on shared hosts. ([d00c84716](https://github.com/navidrome/navidrome/commit/d00c84716) by [@deluan](https://github.com/deluan)) #### Scrobbling - Double-encode plus signs in artist and track names sent to Last.fm, so tracks with a `+` in the name scrobble correctly. ([#6158](https://github.com/navidrome/navidrome/pull/6158) by [@deluan](https://github.com/deluan)) #### Packaging - Repair root-owned artwork and plugins folders on upgrade. Installs affected by this could not write their own cache. ([#6143](https://github.com/navidrome/navidrome/pull/6143) by [@deluan](https://github.com/deluan)) #### Translations - Update Finnish and Dutch translations from POEditor. ([#6148](https://github.com/navidrome/navidrome/pull/6148) by [@deluan](https://github.com/deluan)) - Update missing German translations. ([#6146](https://github.com/navidrome/navidrome/pull/6146) by [@strecke](https://github.com/strecke)) - Improve the Swedish translation. ([#6177](https://github.com/navidrome/navidrome/pull/6177) by [@NickWick13](https://github.com/NickWick13)) - Update Chinese Simplified translations. ([#6152](https://github.com/navidrome/navidrome/pull/6152) by [@fxj368](https://github.com/fxj368)) - Update Portuguese (Brazil) translations from POEditor. ([#6197](https://github.com/navidrome/navidrome/pull/6197) by [@deluan](https://github.com/deluan)) #### New Contributors - [@davidvedvick](https://github.com/davidvedvick) made their first contribution in [#5187](https://github.com/navidrome/navidrome/pull/5187) - [@strecke](https://github.com/strecke) made their first contribution in [#6146](https://github.com/navidrome/navidrome/pull/6146) - [@NickWick13](https://github.com/NickWick13) made their first contribution in [#6177](https://github.com/navidrome/navidrome/pull/6177) - [@kwo](https://github.com/kwo) made their first contribution in [#6189](https://github.com/navidrome/navidrome/pull/6189) - [@aerusso](https://github.com/aerusso) made their first contribution in [#6190](https://github.com/navidrome/navidrome/pull/6190) **Full Changelog**: <https://github.com/navidrome/navidrome/compare/v0.64.0...v0.64.1> #### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). #### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods?run=navidrome) or [Zenith](https://zenith.hosting/host/navidrome?ref=navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)! ### [`v0.64.0`](https://github.com/navidrome/navidrome/releases/tag/v0.64.0) [Compare Source](https://github.com/navidrome/navidrome/compare/v0.63.2...v0.64.0) This release brings an **experimental Jellyfin Music API**, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a **new background pipeline** with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a **uniform canonical 128-bit format**, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling. #### ⚠️ Breaking Changes / Migration Notes - **All internal IDs are re-encoded** to a single canonical 128-bit base62 format. The migration touches every table, so **back up your database before upgrading**. Clients that cache item IDs (for example, offline downloads) may need to re-sync. ([#5824](https://github.com/navidrome/navidrome/pull/5824)) - **Plugin authors: Extism's built-in HTTP is disabled.** Calls through `pdk.NewHTTPRequest` (Go), `http::request` (Rust) or the equivalent in other PDKs now fail with `HTTP request ... is not allowed`. Plugins must use the host HTTP service instead: `host.HTTPSend` (Go) or `nd_pdk::host::http::send` (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's `requiredHosts`, or use a bare `"*"`. ([1a8463f7d](https://github.com/navidrome/navidrome/commit/1a8463f7d), [276d767ce](https://github.com/navidrome/navidrome/commit/276d767ce)) - **Shares are always owned by the user who creates them.** Admins can no longer create shares on behalf of another user via `userId`. ([1a8463f7d](https://github.com/navidrome/navidrome/commit/1a8463f7d)) - **Configuration durations are now validated.** Negative values are rejected at startup. ([#6002](https://github.com/navidrome/navidrome/pull/6002)) - Navidrome now **warns about unrecognized options** in the config file, so typos no longer fail silently. ([#5870](https://github.com/navidrome/navidrome/pull/5870)) #### Security This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them. - Fix SQL injection via the artist `role` sort and filter parameters in the Native API by validating the role against the known list. ([4168377b6](https://github.com/navidrome/navidrome/commit/4168377b6), [GHSA-hm54-32q6-3rcr](https://github.com/navidrome/navidrome/security/advisories/GHSA-hm54-32q6-3rcr), reported and fixed by [@Sudo-Ivan](https://github.com/Sudo-Ivan)) - Fix share-ownership spoofing (IDOR) that let a client-supplied `userId` on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. ([1a8463f7d](https://github.com/navidrome/navidrome/commit/1a8463f7d), [GHSA-82gh-4ggp-gfg5](https://github.com/navidrome/navidrome/security/advisories/GHSA-82gh-4ggp-gfg5), reported by [@gigioneggiando](https://github.com/gigioneggiando)) - Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. ([276d767ce](https://github.com/navidrome/navidrome/commit/276d767ce), [GHSA-pr2j-mfc8-qjcc](https://github.com/navidrome/navidrome/security/advisories/GHSA-pr2j-mfc8-qjcc), reported by [@qrn12580](https://github.com/qrn12580)) - Fix login rate limit bypass via spoofed `X-Forwarded-For`, `X-Real-IP` and `True-Client-IP` headers by keying the limit on the trust-aware client IP. ([#6124](https://github.com/navidrome/navidrome/pull/6124), [GHSA-f295-6wp9-qqfg](https://github.com/navidrome/navidrome/security/advisories/GHSA-f295-6wp9-qqfg), reported by [@gehan-psbc](https://github.com/gehan-psbc) and [@skarn958](https://github.com/skarn958)) - Fix memory exhaustion via a negative `size` parameter on `getCoverArt` and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. ([#5847](https://github.com/navidrome/navidrome/pull/5847), [GHSA-f22h-6qxh-rqq2](https://github.com/navidrome/navidrome/security/advisories/GHSA-f22h-6qxh-rqq2), reported by [@arpitjain099](https://github.com/arpitjain099)) - Enforce track membership on public share streams so a share can only stream the tracks it contains. ([#5769](https://github.com/navidrome/navidrome/pull/5769) by [@deluan](https://github.com/deluan)) - Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. ([#6098](https://github.com/navidrome/navidrome/pull/6098) by [@deluan](https://github.com/deluan)) - Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. ([#5881](https://github.com/navidrome/navidrome/pull/5881), [#5886](https://github.com/navidrome/navidrome/pull/5886) by [@deluan](https://github.com/deluan)) - Redact sensitive auth headers from request logs. ([82b9a44a1](https://github.com/navidrome/navidrome/commit/82b9a44a1) by [@deluan](https://github.com/deluan)) > **Note:** Several of the advisories linked above are still in **draft** on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release. #### Configuration Changes | Status | Option | Description | Default | | ------ | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | New | `Jellyfin.Enabled` | Enable the experimental Jellyfin Music API. ([#5730](https://github.com/navidrome/navidrome/pull/5730)) | `false` | | New | `Jellyfin.ServerName` | Server name advertised to Jellyfin clients. ([#5730](https://github.com/navidrome/navidrome/pull/5730)) | `Navidrome <version>` | | New | `Jellyfin.ExposedPublicUsers` | Comma-separated usernames advertised on the unauthenticated public users endpoint. ([#5730](https://github.com/navidrome/navidrome/pull/5730)) | `""` | | New | `Jellyfin.MaxConcurrentStreams` | Bounds how many Jellyfin collection responses can stream at once. ([#5783](https://github.com/navidrome/navidrome/pull/5783)) | `max(2, MaxOpenConns/2)` | | New | `EnableNaturalSorting` | Sort names and titles naturally (e.g. "Track 2" before "Track 10"). ([#6015](https://github.com/navidrome/navidrome/pull/6015)) | `false` | | New | `MaxImageSize` | Cap on the size of artwork images Navidrome will decode. ([#5931](https://github.com/navidrome/navidrome/pull/5931)) | `20MB` | | New | `EnableScheduledDBAnalyze` | Periodically run a full `ANALYZE` to keep query planner statistics fresh. ([#5740](https://github.com/navidrome/navidrome/pull/5740)) | `true` | For a complete list of all configuration options, see the [Configuration Options](https://www.navidrome.org/docs/usage/configuration-options/) documentation. #### Jellyfin API (Experimental) - Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with `Jellyfin.Enabled = true`. ([#5730](https://github.com/navidrome/navidrome/pull/5730) by [@deluan](https://github.com/deluan)) - Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. ([#5791](https://github.com/navidrome/navidrome/pull/5791), [#5948](https://github.com/navidrome/navidrome/pull/5948), [#5815](https://github.com/navidrome/navidrome/pull/5815), [#5817](https://github.com/navidrome/navidrome/pull/5817) by [@deluan](https://github.com/deluan), [#5809](https://github.com/navidrome/navidrome/pull/5809) by [@kgarner7](https://github.com/kgarner7)) - Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. ([#5782](https://github.com/navidrome/navidrome/pull/5782) by [@deluan](https://github.com/deluan)) - Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. ([#6013](https://github.com/navidrome/navidrome/pull/6013) by [@deluan](https://github.com/deluan)) #### Artwork - New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. ([#5847](https://github.com/navidrome/navidrome/pull/5847) by [@deluan](https://github.com/deluan)) - Make the artwork image size cap configurable. ([#5931](https://github.com/navidrome/navidrome/pull/5931) by [@deluan](https://github.com/deluan)) - Fix artist folder being promoted to album folder. ([#5856](https://github.com/navidrome/navidrome/pull/5856) by [@kgarner7](https://github.com/kgarner7)) - Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. ([#5808](https://github.com/navidrome/navidrome/pull/5808), [#6068](https://github.com/navidrome/navidrome/pull/6068) by [@deluan](https://github.com/deluan)) #### UI - Add Refresh Metadata action to album and artist pages and context menus. ([#6036](https://github.com/navidrome/navidrome/pull/6036), [#6078](https://github.com/navidrome/navidrome/pull/6078) by [@deluan](https://github.com/deluan)) - Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. ([#5805](https://github.com/navidrome/navidrome/pull/5805) by [@deluan](https://github.com/deluan)) - Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. ([#5835](https://github.com/navidrome/navidrome/pull/5835) by [@cmyksoda](https://github.com/cmyksoda)) - Add Artists, Songs, Playlists and Radio to the Default View options. ([#5754](https://github.com/navidrome/navidrome/pull/5754), [#5801](https://github.com/navidrome/navidrome/pull/5801) by [@deluan](https://github.com/deluan)) - Add Share and Download actions to the Artist detail page. ([#5944](https://github.com/navidrome/navidrome/pull/5944) by [@deluan](https://github.com/deluan)) - Show translation completion percentage in the language selector. ([#5979](https://github.com/navidrome/navidrome/pull/5979) by [@deluan](https://github.com/deluan)) - Remember the "items per page" selection across sessions. ([#5819](https://github.com/navidrome/navidrome/pull/5819) by [@deluan](https://github.com/deluan)) - Give visual feedback when downloading from a share. ([#5865](https://github.com/navidrome/navidrome/pull/5865) by [@deluan](https://github.com/deluan)) - Fix logins sometimes showing the wrong user. ([#5882](https://github.com/navidrome/navidrome/pull/5882) by [@deluan](https://github.com/deluan), [#5767](https://github.com/navidrome/navidrome/pull/5767) by [@apkatsikas](https://github.com/apkatsikas)) - Fix each page's scroll position not being restored when navigating back. ([#5892](https://github.com/navidrome/navidrome/pull/5892) by [@deluan](https://github.com/deluan)) - Fix playback starting when closing the disc cover lightbox. ([#5901](https://github.com/navidrome/navidrome/pull/5901) by [@deluan](https://github.com/deluan)) - Fix playlist not reloading after rating or loving a track. ([#6009](https://github.com/navidrome/navidrome/pull/6009) by [@polybjorn](https://github.com/polybjorn)) - Fix the album grid resizing in Safari when top menus open. ([#6125](https://github.com/navidrome/navidrome/pull/6125) by [@york9675](https://github.com/york9675)) - Fix the album grid hover overlay corners in the Nautiline theme. ([#6115](https://github.com/navidrome/navidrome/pull/6115) by [@deluan](https://github.com/deluan)) - Fix transcoding Default Bit Rate not accepting 0. ([8d77a49b3](https://github.com/navidrome/navidrome/commit/8d77a49b3) by [@deluan](https://github.com/deluan)) - Fix the Last.fm link not always showing on the artist details page. ([b0e1943d8](https://github.com/navidrome/navidrome/commit/b0e1943d8) by [@deluan](https://github.com/deluan)) #### Playlists & Smart Playlists - Add album-level fields for sorting and filtering in smart playlists. ([#5899](https://github.com/navidrome/navidrome/pull/5899) by [@deluan](https://github.com/deluan)) - Add per-playlist `refreshDelay` for stable daily or weekly smart playlists. ([#5790](https://github.com/navidrome/navidrome/pull/5790) by [@deluan](https://github.com/deluan)) - Store playlist stars and ratings per user. ([#5749](https://github.com/navidrome/navidrome/pull/5749) by [@deluan](https://github.com/deluan)) - Make playlist import much faster on large libraries. ([#6055](https://github.com/navidrome/navidrome/pull/6055) by [@deluan](https://github.com/deluan)) - Fix in-place playlist edits not being detected by the scanner. ([#5914](https://github.com/navidrome/navidrome/pull/5914) by [@junkerderprovinz](https://github.com/junkerderprovinz)) - Fix track edits being allowed on synced playlists via some APIs. ([#5984](https://github.com/navidrome/navidrome/pull/5984) by [@deluan](https://github.com/deluan)) - Fix smart playlist song count being lost on re-import. ([#5908](https://github.com/navidrome/navidrome/pull/5908) by [@deluan](https://github.com/deluan)) - Fix deleting many tracks from a playlist at once failing. ([#5977](https://github.com/navidrome/navidrome/pull/5977) by [@deluan](https://github.com/deluan)) - Fix the `changed` timestamp not being updated when renaming a smart playlist. ([#6082](https://github.com/navidrome/navidrome/pull/6082) by [@deluan](https://github.com/deluan)) #### Scanner - Add optional natural sort order for names and titles. ([#6015](https://github.com/navidrome/navidrome/pull/6015) by [@deluan](https://github.com/deluan)) - Support the `[bg:]` tag and skip unknown tags in LRC lyrics files. ([#5966](https://github.com/navidrome/navidrome/pull/5966) by [@deluan](https://github.com/deluan)) - Fix album tags being sorted alphabetically instead of keeping the order from the files. ([#5872](https://github.com/navidrome/navidrome/pull/5872) by [@deluan](https://github.com/deluan)) - Fix file creation time not being read on Linux. ([#6046](https://github.com/navidrome/navidrome/pull/6046) by [@deluan](https://github.com/deluan)) #### Subsonic API - Implement the OpenSubsonic `topSongsByArtistId` extension. ([#5853](https://github.com/navidrome/navidrome/pull/5853) by [@kgarner7](https://github.com/kgarner7)) - Fix `createShare` ignoring `DefaultDownloadableShare`. ([#6121](https://github.com/navidrome/navidrome/pull/6121) by [@deluan](https://github.com/deluan)) - Fix double brackets when appending subtitle or version to titles. ([#5832](https://github.com/navidrome/navidrome/pull/5832) by [@deluan](https://github.com/deluan)) #### Transcoding & Streaming - Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. ([#6105](https://github.com/navidrome/navidrome/pull/6105) by [@deluan](https://github.com/deluan)) - Fix truncated transcoded streams being delivered as complete. ([#6035](https://github.com/navidrome/navidrome/pull/6035) by [@deluan](https://github.com/deluan)) - Fix AAC streams being reported as `audio/mp4` instead of `audio/aac`. ([#5998](https://github.com/navidrome/navidrome/pull/5998) by [@justadityaraj](https://github.com/justadityaraj)) - Fix bit depth being reported for lossy transcode targets. ([#5768](https://github.com/navidrome/navidrome/pull/5768) by [@deluan](https://github.com/deluan)) #### Scrobbling - Add a per-user scrobble filter. ([#5964](https://github.com/navidrome/navidrome/pull/5964) by [@deluan](https://github.com/deluan)) - Add a scrobble history Native API. ([#5761](https://github.com/navidrome/navidrome/pull/5761) by [@kgarner7](https://github.com/kgarner7)) - Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. ([#5818](https://github.com/navidrome/navidrome/pull/5818), [#6028](https://github.com/navidrome/navidrome/pull/6028) by [@deluan](https://github.com/deluan)) - Fix out-of-order playback reports being rejected. ([#5793](https://github.com/navidrome/navidrome/pull/5793) by [@deluan](https://github.com/deluan)) #### Plugins - Add plugin-specific storage. ([#5839](https://github.com/navidrome/navidrome/pull/5839) by [@kgarner7](https://github.com/kgarner7)) - Add scrobble access to the plugin SDK. ([#5795](https://github.com/navidrome/navidrome/pull/5795) by [@kgarner7](https://github.com/kgarner7)) - Surface the valid agent names in logs and the Plugins UI. ([#5910](https://github.com/navidrome/navidrome/pull/5910) by [@deluan](https://github.com/deluan)) - Fix plugin agents not being loaded in CLI commands. ([#5959](https://github.com/navidrome/navidrome/pull/5959) by [@deluan](https://github.com/deluan)) - Fix public URLs built by plugins pointing at localhost instead of the caller's address. ([#6059](https://github.com/navidrome/navidrome/pull/6059) by [@deluan](https://github.com/deluan)) #### CLI - Add an `artwork` command group (`explain`, `refresh`, `cancel`) for diagnosing and re-driving artwork resolution. ([#5957](https://github.com/navidrome/navidrome/pull/5957) by [@deluan](https://github.com/deluan)) - Add `missing list` and `missing fix` subcommands to deal with files that moved. ([#5928](https://github.com/navidrome/navidrome/pull/5928) by [@zerovox](https://github.com/zerovox)) - Add `doctor` and `search rebuild` commands to detect and recover from search index corruption. ([#6069](https://github.com/navidrome/navidrome/pull/6069) by [@deluan](https://github.com/deluan)) - Fix `restore` wiping the database when the backup file does not exist. ([#6085](https://github.com/navidrome/navidrome/pull/6085) by [@Huang-404-Q](https://github.com/Huang-404-Q)) - Fix selective scan `--target` rejecting absolute paths. ([#5947](https://github.com/navidrome/navidrome/pull/5947) by [@deluan](https://github.com/deluan)) - Fix `pls -p` writing playlist output to stderr instead of stdout. ([#5996](https://github.com/navidrome/navidrome/pull/5996) by [@deluan](https://github.com/deluan)) #### Server - Make genre and artist filtering much faster across all APIs by using indexed join tables. ([#5940](https://github.com/navidrome/navidrome/pull/5940), [#5930](https://github.com/navidrome/navidrome/pull/5930) by [@deluan](https://github.com/deluan)) - Report the app store or hosting platform via `ND_PLATFORM` in insights. ([#5956](https://github.com/navidrome/navidrome/pull/5956) by [@deluan](https://github.com/deluan)) - Send the Navidrome User-Agent in all outgoing requests. ([#6020](https://github.com/navidrome/navidrome/pull/6020) by [@mintsoft](https://github.com/mintsoft)) - Fix `getScanStatus` reporting `count=0` for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when `MusicFolder` contains a single quote. ([#6098](https://github.com/navidrome/navidrome/pull/6098) by [@deluan](https://github.com/deluan)) #### Database - Periodically run a full `ANALYZE` to keep query planner statistics trustworthy. ([#5740](https://github.com/navidrome/navidrome/pull/5740) by [@deluan](https://github.com/deluan)) #### Packaging & Build - Upgrade to Go 1.27. ([#5990](https://github.com/navidrome/navidrome/pull/5990) by [@deluan](https://github.com/deluan)) - Upgrade the Docker base image to Alpine 3.22, and add `curl` to the container image. ([#6048](https://github.com/navidrome/navidrome/pull/6048) by [@deluan](https://github.com/deluan), [#6116](https://github.com/navidrome/navidrome/pull/6116) by [@miguelallopes](https://github.com/miguelallopes)) - Bump TagLib to 2.3.2. ([#6088](https://github.com/navidrome/navidrome/pull/6088) by [@deluan](https://github.com/deluan)) - Windows MSI: remember install properties across upgrades. ([#5333](https://github.com/navidrome/navidrome/pull/5333) by [@mintsoft](https://github.com/mintsoft)) - Fix a missing hyphen in the OpenRC script that caused crashes on startup. ([#5906](https://github.com/navidrome/navidrome/pull/5906) by [@alinxviso](https://github.com/alinxviso)) - Fix a typo in the `--prometheus.enabled` description. ([#5878](https://github.com/navidrome/navidrome/pull/5878) by [@0mp](https://github.com/0mp)) #### Translations - Update Chinese (Simplified) translation. ([#5779](https://github.com/navidrome/navidrome/pull/5779), [#5873](https://github.com/navidrome/navidrome/pull/5873) by [@fxj368](https://github.com/fxj368)) - Update Italian translation. ([#5848](https://github.com/navidrome/navidrome/pull/5848) by [@McCio](https://github.com/McCio)) - Update Japanese translation. ([#6080](https://github.com/navidrome/navidrome/pull/6080) by [@karigane-cha](https://github.com/karigane-cha)) - Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. ([#5833](https://github.com/navidrome/navidrome/pull/5833), [#6128](https://github.com/navidrome/navidrome/pull/6128) by [@deluan](https://github.com/deluan)) #### New Contributors - [@McCio](https://github.com/McCio) made their first contribution in [#5848](https://github.com/navidrome/navidrome/pull/5848) - [@0mp](https://github.com/0mp) made their first contribution in [#5878](https://github.com/navidrome/navidrome/pull/5878) - [@alinxviso](https://github.com/alinxviso) made their first contribution in [#5906](https://github.com/navidrome/navidrome/pull/5906) - [@IgorPolyakov](https://github.com/IgorPolyakov) made their first contribution in [#5867](https://github.com/navidrome/navidrome/pull/5867) - [@junkerderprovinz](https://github.com/junkerderprovinz) made their first contribution in [#5916](https://github.com/navidrome/navidrome/pull/5916) - [@justadityaraj](https://github.com/justadityaraj) made their first contribution in [#5998](https://github.com/navidrome/navidrome/pull/5998) - [@polybjorn](https://github.com/polybjorn) made their first contribution in [#6009](https://github.com/navidrome/navidrome/pull/6009) - [@karigane-cha](https://github.com/karigane-cha) made their first contribution in [#6080](https://github.com/navidrome/navidrome/pull/6080) - [@Shxiao101](https://github.com/Shxiao101) made their first contribution in [#6097](https://github.com/navidrome/navidrome/pull/6097) - [@cmyksoda](https://github.com/cmyksoda) made their first contribution in [#5835](https://github.com/navidrome/navidrome/pull/5835) - [@miguelallopes](https://github.com/miguelallopes) made their first contribution in [#6116](https://github.com/navidrome/navidrome/pull/6116) - [@Huang-404-Q](https://github.com/Huang-404-Q) made their first contribution in [#6085](https://github.com/navidrome/navidrome/pull/6085) - [@zerovox](https://github.com/zerovox) made their first contribution in [#5928](https://github.com/navidrome/navidrome/pull/5928) - [@Sudo-Ivan](https://github.com/Sudo-Ivan) made their first contribution in [4168377b6](https://github.com/navidrome/navidrome/commit/4168377b6) **Full Changelog**: <https://github.com/navidrome/navidrome/compare/v0.63.2...v0.64.0> #### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). #### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods?run=navidrome) or [Zenith](https://zenith.hosting/host/navidrome?ref=navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)! </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-09-21 21:10:05 +00:00

chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.0 fb104fa1e1

renovate-bot force-pushed renovate/ghcr.io-navidrome-navidrome-0.x from fb104fa1e1 to d510d13d29

2026-09-21 22:09:08 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.0~~ to chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.1

2026-09-21 22:09:11 +00:00

renovate-bot changed title from ~~chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.1~~ to chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.2

2026-09-29 00:09:27 +00:00

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/ghcr.io-navidrome-navidrome-0.x:renovate/ghcr.io-navidrome-navidrome-0.x

git switch renovate/ghcr.io-navidrome-navidrome-0.x

Merge

Merge the changes and update on Forgejo.

git switch main

git merge --no-ff renovate/ghcr.io-navidrome-navidrome-0.x

git switch renovate/ghcr.io-navidrome-navidrome-0.x

git rebase main

git switch main

git merge --ff-only renovate/ghcr.io-navidrome-navidrome-0.x

git switch renovate/ghcr.io-navidrome-navidrome-0.x

git rebase main

git switch main

git merge --no-ff renovate/ghcr.io-navidrome-navidrome-0.x

git switch main

git merge --squash renovate/ghcr.io-navidrome-navidrome-0.x

git switch main

git merge --ff-only renovate/ghcr.io-navidrome-navidrome-0.x

git switch main

git merge renovate/ghcr.io-navidrome-navidrome-0.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ops/homelab!136

No description provided.

Rows
Columns

chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.2 #136

Release Notes

v0.64.2

Security

Scanner

Server

Jellyfin API

New Contributors

Helping out

Where to go next?

v0.64.1: - Security Fixes

Security

Configuration Changes

Jellyfin API

UI

Smart Playlists

Subsonic API

Server

Artwork

Scanner

Scrobbling

Packaging

Translations

New Contributors

Helping out

Where to go next?

v0.64.0

⚠️ Breaking Changes / Migration Notes

Security

Configuration Changes

Jellyfin API (Experimental)

Artwork

UI

Playlists & Smart Playlists

Scanner

Subsonic API

Transcoding & Streaming

Scrobbling

Plugins

CLI

Server

Database

Packaging & Build

Translations

New Contributors

Helping out

Where to go next?

Configuration

Checkout

Merge

`v0.64.2`

`v0.64.1`: - Security Fixes

`v0.64.0`