Software-update: Navidrome 0.64.0

Versie 0.64.0 van Navidrome is uitgekomen. Navidrome is wat ze zelf noemen een personal streaming service, en is een opensource mediaserver die je persoonlijke muziekcollectie van overal benaderbaar kan maken. Het is snel, gebruikt weinig resources, heeft geen moeite met hele grote collecties en elke gebruiker kan zijn eigen playlists en favorieten aanmaken. Navidrome is compatibel met Subsonic, dus je hebt een grote keuze uit mediaspelers om naar de muziek te luisteren. Downloads en installatie-instructies zijn beschikbaar voor Docker, Windows, Linux, macOS en FreeBSD. In deze uitgave zijn de volgende verbeteringen doorgevoerd:

Navidrome 0.64.0

This release brings an experimental Jellyfin Music API, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a new background pipeline with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a uniform canonical 128-bit format, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling.

Breaking Changes / Migration Notes

• All internal IDs are re-encoded to a single canonical 128-bit base62 format. The migration touches every table, so back up your database before upgrading. Clients that cache item IDs (for example, offline downloads) may need to re-sync. (#5824)
• Plugin authors: Extism's built-in HTTP is disabled. Calls through pdk.NewHTTPRequest (Go), http::request (Rust) or the equivalent in other PDKs now fail with HTTP request ... is not allowed. Plugins must use the host HTTP service instead: host.HTTPSend (Go) or nd_pdk::host::http::send (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's requiredHosts, or use a bare "*". (1a8463f7d, 276d767ce)
• Shares are always owned by the user who creates them. Admins can no longer create shares on behalf of another user via userId. (1a8463f7d)
• Configuration durations are now validated. Negative values are rejected at startup. (#6002)
• Navidrome now warns about unrecognized options in the config file, so typos no longer fail silently. (#5870)

Security

This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them.

• Fix SQL injection via the artist role sort and filter parameters in the Native API by validating the role against the known list. (4168377b6, GHSA-hm54-32q6-3rcr, reported and fixed)
• Fix share-ownership spoofing (IDOR) that let a client-supplied userId on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. (1a8463f7d, GHSA-82gh-4ggp-gfg5, reported)
• Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. (276d767ce, GHSA-pr2j-mfc8-qjcc, reported)
• Fix login rate limit bypass via spoofed X-Forwarded-For, X-Real-IP and True-Client-IP headers by keying the limit on the trust-aware client IP. (#6124, GHSA-f295-6wp9-qqfg, reported)
• Fix memory exhaustion via a negative size parameter on getCoverArt and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. (#5847, GHSA-f22h-6qxh-rqq2, reported)
• Enforce track membership on public share streams so a share can only stream the tracks it contains. (#5769)
• Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. (#6098)
• Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. (#5881, #5886)
• Redact sensitive auth headers from request logs. (82b9a44a1)

Note: Several of the advisories linked above are still in draft on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release.

Configuration Changes

Status	Option	Description	Default
New	Jellyfin.Enabled	Enable the experimental Jellyfin Music API. (#5730)	false
New	Jellyfin.ServerName	Server name advertised to Jellyfin clients. (#5730)	Navidrome <version>
New	Jellyfin.ExposedPublicUsers	Comma-separated usernames advertised on the unauthenticated public users endpoint. (#5730)	""
New	Jellyfin.MaxConcurrentStreams	Bounds how many Jellyfin collection responses can stream at once. (#5783)	max(2, MaxOpenConns/2)
New	EnableNaturalSorting	Sort names and titles naturally (e.g. "Track 2" before "Track 10"). (#6015)	false
New	MaxImageSize	Cap on the size of artwork images Navidrome will decode. (#5931)	20MB
New	EnableScheduledDBAnalyze	Periodically run a full ANALYZE to keep query planner statistics fresh. (#5740)	true

For a complete list of all configuration options, see the Configuration Options documentation.

Jellyfin API (Experimental)

• Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with Jellyfin.Enabled = true. (#5730)
• Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. (#5791, #5948, #5815, #5817)
• Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. (#5782)
• Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. (#6013)

Artwork

• New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. (#5847)
• Make the artwork image size cap configurable. (#5931)
• Fix artist folder being promoted to album folder. (#5856)
• Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. (#5808, #6068)

UI

• Add Refresh Metadata action to album and artist pages and context menus. (#6036, #6078)
• Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. (#5805)
• Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. (#5835)
• Add Artists, Songs, Playlists and Radio to the Default View options. (#5754, #5801)
• Add Share and Download actions to the Artist detail page. (#5944)
• Show translation completion percentage in the language selector. (#5979)
• Remember the "items per page" selection across sessions. (#5819)
• Give visual feedback when downloading from a share. (#5865)
• Fix logins sometimes showing the wrong user. (#5882)
• Fix each page's scroll position not being restored when navigating back. (#5892)
• Fix playback starting when closing the disc cover lightbox. (#5901)
• Fix playlist not reloading after rating or loving a track. (#6009)
• Fix the album grid resizing in Safari when top menus open. (#6125)
• Fix the album grid hover overlay corners in the Nautiline theme. (#6115)
• Fix transcoding Default Bit Rate not accepting 0. (8d77a49b3)
• Fix the Last.fm link not always showing on the artist details page. (b0e1943d8)

Playlists & Smart Playlists

• Add album-level fields for sorting and filtering in smart playlists. (#5899)
• Add per-playlist refreshDelay for stable daily or weekly smart playlists. (#5790)
• Store playlist stars and ratings per user. (#5749)
• Make playlist import much faster on large libraries. (#6055)
• Fix in-place playlist edits not being detected by the scanner. (#5914)
• Fix track edits being allowed on synced playlists via some APIs. (#5984)
• Fix smart playlist song count being lost on re-import. (#5908)
• Fix deleting many tracks from a playlist at once failing. (#5977)
• Fix the changed timestamp not being updated when renaming a smart playlist. (#6082)

Scanner

• Add optional natural sort order for names and titles. (#6015)
• Support the [bg:] tag and skip unknown tags in LRC lyrics files. (#5966)
• Fix album tags being sorted alphabetically instead of keeping the order from the files. (#5872)
• Fix file creation time not being read on Linux. (#6046)

Subsonic API

• Implement the OpenSubsonic topSongsByArtistId extension. (#5853)
• Expose album-level ReplayGain. (#5816)
• Fix createShare ignoring DefaultDownloadableShare. (#6121)
• Fix double brackets when appending subtitle or version to titles. (#5832)

Transcoding & Streaming

• Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. (#6105)
• Fix truncated transcoded streams being delivered as complete. (#6035)
• Fix AAC streams being reported as audio/mp4 instead of audio/aac. (#5998)
• Fix bit depth being reported for lossy transcode targets. (#5768)

Scrobbling

• Add a per-user scrobble filter. (#5964)
• Add a scrobble history Native API. (#5761)
• Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. (#5818, #6028)
• Fix out-of-order playback reports being rejected. (#5793)

Plugins

• Add plugin-specific storage. (#5839)
• Add scrobble access to the plugin SDK. (#5795)
• Surface the valid agent names in logs and the Plugins UI. (#5910)
• Fix plugin agents not being loaded in CLI commands. (#5959)
• Fix public URLs built by plugins pointing at localhost instead of the caller's address. (#6059)

CLI

• Add an artwork command group (explain, refresh, cancel) for diagnosing and re-driving artwork resolution. (#5957)
• Add missing list and missing fix subcommands to deal with files that moved. (#5928)
• Add doctor and search rebuild commands to detect and recover from search index corruption. (#6069)
• Fix restore wiping the database when the backup file does not exist. (#6085)
• Fix selective scan --target rejecting absolute paths. (#5947)
• Fix pls -p writing playlist output to stderr instead of stdout. (#5996)

Server

• Make genre and artist filtering much faster across all APIs by using indexed join tables. (#5940, #5930)
• Report the app store or hosting platform via ND_PLATFORM in insights. (#5956)
• Send the Navidrome User-Agent in all outgoing requests. (#6020)
• Fix getScanStatus reporting count=0 for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when MusicFolder contains a single quote. (#6098)

Database

• Periodically run a full ANALYZE to keep query planner statistics trustworthy. (#5740)

Packaging & Build

• Upgrade to Go 1.27. (#5990)
• Upgrade the Docker base image to Alpine 3.22, and add curl to the container image. (#6048)
• Bump TagLib to 2.3.2. (#6088)
• Windows MSI: remember install properties across upgrades. (#5333)
• Fix a missing hyphen in the OpenRC script that caused crashes on startup. (#5906)
• Fix a typo in the --prometheus.enabled description. (#5878)

Translations

• Update Chinese (Simplified) translation. (#5779, #5873)
• Update Italian translation. (#5848)
• Update Japanese translation. (#6080)
• Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. (#5833, #6128)

Versienummer	0.64.0
Releasestatus	Final
Besturingssystemen	Linux, BSD, macOS, Windows 10, Windows 11
Website	Navidrome
Download	https://github.com/navidrome/navidrome/releases/tag/v0.64.0
Licentietype	GPL

Reacties (1)

[witchdoc]

Dit kan neit simpelweg een http stream beschikbaar maken van mijn eigen muziek? Moet altijd via hun gui gaan?