mysticalsoap/docker

Watch

Fork 0

chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.0 #223

Merged

mysticalsoap merged 1 commit from renovate/ghcr.io-navidrome-navidrome-0.x into trunk

2026-09-18 17:46:11 -04:00

renovate-bot commented

2026-09-13 08:00:47 -04:00

Collaborator

This PR contains the following updates:

Package	Update	Change
ghcr.io/navidrome/navidrome	minor	`0.63.2` → `0.64.0`

Release Notes

navidrome/navidrome (ghcr.io/navidrome/navidrome)

`v0.64.0`

Compare Source

This release brings an experimental Jellyfin Music API, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a new background pipeline with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a uniform canonical 128-bit format, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling.

⚠️ Breaking Changes / Migration Notes

All internal IDs are re-encoded to a single canonical 128-bit base62 format. The migration touches every table, so back up your database before upgrading. Clients that cache item IDs (for example, offline downloads) may need to re-sync. (#5824)
Plugin authors: Extism's built-in HTTP is disabled. Calls through pdk.NewHTTPRequest (Go), http::request (Rust) or the equivalent in other PDKs now fail with HTTP request ... is not allowed. Plugins must use the host HTTP service instead: host.HTTPSend (Go) or nd_pdk::host::http::send (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's requiredHosts, or use a bare "*". (1a8463f7d, 276d767ce)
Shares are always owned by the user who creates them. Admins can no longer create shares on behalf of another user via userId. (1a8463f7d)
Configuration durations are now validated. Negative values are rejected at startup. (#6002)
Navidrome now warns about unrecognized options in the config file, so typos no longer fail silently. (#5870)

Security

This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them.

Fix SQL injection via the artist role sort and filter parameters in the Native API by validating the role against the known list. (4168377b6, GHSA-hm54-32q6-3rcr, reported and fixed by @Sudo-Ivan)
Fix share-ownership spoofing (IDOR) that let a client-supplied userId on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. (1a8463f7d, GHSA-82gh-4ggp-gfg5, reported by @gigioneggiando)
Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. (276d767ce, GHSA-pr2j-mfc8-qjcc, reported by @qrn12580)
Fix login rate limit bypass via spoofed X-Forwarded-For, X-Real-IP and True-Client-IP headers by keying the limit on the trust-aware client IP. (#6124, GHSA-f295-6wp9-qqfg, reported by @gehan-psbc and @skarn958)
Fix memory exhaustion via a negative size parameter on getCoverArt and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. (#5847, GHSA-f22h-6qxh-rqq2, reported by @arpitjain099)
Enforce track membership on public share streams so a share can only stream the tracks it contains. (#5769 by @deluan)
Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. (#6098 by @deluan)
Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. (#5881, #5886 by @deluan)
Redact sensitive auth headers from request logs. (82b9a44a1 by @deluan)

Note: Several of the advisories linked above are still in draft on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release.

Configuration Changes

Status	Option	Description	Default
New	`Jellyfin.Enabled`	Enable the experimental Jellyfin Music API. (#5730)	`false`
New	`Jellyfin.ServerName`	Server name advertised to Jellyfin clients. (#5730)	`Navidrome <version>`
New	`Jellyfin.ExposedPublicUsers`	Comma-separated usernames advertised on the unauthenticated public users endpoint. (#5730)	`""`
New	`Jellyfin.MaxConcurrentStreams`	Bounds how many Jellyfin collection responses can stream at once. (#5783)	`max(2, MaxOpenConns/2)`
New	`EnableNaturalSorting`	Sort names and titles naturally (e.g. "Track 2" before "Track 10"). (#6015)	`false`
New	`MaxImageSize`	Cap on the size of artwork images Navidrome will decode. (#5931)	`20MB`
New	`EnableScheduledDBAnalyze`	Periodically run a full `ANALYZE` to keep query planner statistics fresh. (#5740)	`true`

For a complete list of all configuration options, see the Configuration Options documentation.

Jellyfin API (Experimental)

Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with Jellyfin.Enabled = true. (#5730 by @deluan)
Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. (#5791, #5948, #5815, #5817 by @deluan, #5809 by @kgarner7)
Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. (#5782 by @deluan)
Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. (#6013 by @deluan)

Artwork

New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. (#5847 by @deluan)
Make the artwork image size cap configurable. (#5931 by @deluan)
Fix artist folder being promoted to album folder. (#5856 by @kgarner7)
Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. (#5808, #6068 by @deluan)

UI

Add Refresh Metadata action to album and artist pages and context menus. (#6036, #6078 by @deluan)
Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. (#5805 by @deluan)
Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. (#5835 by @cmyksoda)
Add Artists, Songs, Playlists and Radio to the Default View options. (#5754, #5801 by @deluan)
Add Share and Download actions to the Artist detail page. (#5944 by @deluan)
Show translation completion percentage in the language selector. (#5979 by @deluan)
Remember the "items per page" selection across sessions. (#5819 by @deluan)
Give visual feedback when downloading from a share. (#5865 by @deluan)
Fix logins sometimes showing the wrong user. (#5882 by @deluan, #5767 by @apkatsikas)
Fix each page's scroll position not being restored when navigating back. (#5892 by @deluan)
Fix playback starting when closing the disc cover lightbox. (#5901 by @deluan)
Fix playlist not reloading after rating or loving a track. (#6009 by @polybjorn)
Fix the album grid resizing in Safari when top menus open. (#6125 by @york9675)
Fix the album grid hover overlay corners in the Nautiline theme. (#6115 by @deluan)
Fix transcoding Default Bit Rate not accepting 0. (8d77a49b3 by @deluan)
Fix the Last.fm link not always showing on the artist details page. (b0e1943d8 by @deluan)

Playlists & Smart Playlists

Add album-level fields for sorting and filtering in smart playlists. (#5899 by @deluan)
Add per-playlist refreshDelay for stable daily or weekly smart playlists. (#5790 by @deluan)
Store playlist stars and ratings per user. (#5749 by @deluan)
Make playlist import much faster on large libraries. (#6055 by @deluan)
Fix in-place playlist edits not being detected by the scanner. (#5914 by @junkerderprovinz)
Fix track edits being allowed on synced playlists via some APIs. (#5984 by @deluan)
Fix smart playlist song count being lost on re-import. (#5908 by @deluan)
Fix deleting many tracks from a playlist at once failing. (#5977 by @deluan)
Fix the changed timestamp not being updated when renaming a smart playlist. (#6082 by @deluan)

Scanner

Add optional natural sort order for names and titles. (#6015 by @deluan)
Support the [bg:] tag and skip unknown tags in LRC lyrics files. (#5966 by @deluan)
Fix album tags being sorted alphabetically instead of keeping the order from the files. (#5872 by @deluan)
Fix file creation time not being read on Linux. (#6046 by @deluan)

Subsonic API

Implement the OpenSubsonic topSongsByArtistId extension. (#5853 by @kgarner7)
Fix createShare ignoring DefaultDownloadableShare. (#6121 by @deluan)
Fix double brackets when appending subtitle or version to titles. (#5832 by @deluan)

Transcoding & Streaming

Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. (#6105 by @deluan)
Fix truncated transcoded streams being delivered as complete. (#6035 by @deluan)
Fix AAC streams being reported as audio/mp4 instead of audio/aac. (#5998 by @justadityaraj)
Fix bit depth being reported for lossy transcode targets. (#5768 by @deluan)

Scrobbling

Add a per-user scrobble filter. (#5964 by @deluan)
Add a scrobble history Native API. (#5761 by @kgarner7)
Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. (#5818, #6028 by @deluan)
Fix out-of-order playback reports being rejected. (#5793 by @deluan)

Plugins

Add plugin-specific storage. (#5839 by @kgarner7)
Add scrobble access to the plugin SDK. (#5795 by @kgarner7)
Surface the valid agent names in logs and the Plugins UI. (#5910 by @deluan)
Fix plugin agents not being loaded in CLI commands. (#5959 by @deluan)
Fix public URLs built by plugins pointing at localhost instead of the caller's address. (#6059 by @deluan)

CLI

Add an artwork command group (explain, refresh, cancel) for diagnosing and re-driving artwork resolution. (#5957 by @deluan)
Add missing list and missing fix subcommands to deal with files that moved. (#5928 by @zerovox)
Add doctor and search rebuild commands to detect and recover from search index corruption. (#6069 by @deluan)
Fix restore wiping the database when the backup file does not exist. (#6085 by @Huang-404-Q)
Fix selective scan --target rejecting absolute paths. (#5947 by @deluan)
Fix pls -p writing playlist output to stderr instead of stdout. (#5996 by @deluan)

Server

Make genre and artist filtering much faster across all APIs by using indexed join tables. (#5940, #5930 by @deluan)
Report the app store or hosting platform via ND_PLATFORM in insights. (#5956 by @deluan)
Send the Navidrome User-Agent in all outgoing requests. (#6020 by @mintsoft)
Fix getScanStatus reporting count=0 for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when MusicFolder contains a single quote. (#6098 by @deluan)

Database

Periodically run a full ANALYZE to keep query planner statistics trustworthy. (#5740 by @deluan)

Packaging & Build

Upgrade to Go 1.27. (#5990 by @deluan)
Upgrade the Docker base image to Alpine 3.22, and add curl to the container image. (#6048 by @deluan, #6116 by @miguelallopes)
Bump TagLib to 2.3.2. (#6088 by @deluan)
Windows MSI: remember install properties across upgrades. (#5333 by @mintsoft)
Fix a missing hyphen in the OpenRC script that caused crashes on startup. (#5906 by @alinxviso)
Fix a typo in the --prometheus.enabled description. (#5878 by @0mp)

Translations

Update Chinese (Simplified) translation. (#5779, #5873 by @fxj368)
Update Italian translation. (#5848 by @McCio)
Update Japanese translation. (#6080 by @karigane-cha)
Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. (#5833, #6128 by @deluan)

New Contributors

@McCio made their first contribution in #5848
@0mp made their first contribution in #5878
@alinxviso made their first contribution in #5906
@IgorPolyakov made their first contribution in #5867
@junkerderprovinz made their first contribution in #5916
@justadityaraj made their first contribution in #5998
@polybjorn made their first contribution in #6009
@karigane-cha made their first contribution in #6080
@Shxiao101 made their first contribution in #6097
@cmyksoda made their first contribution in #5835
@miguelallopes made their first contribution in #6116
@Huang-404-Q made their first contribution in #6085
@zerovox made their first contribution in #5928
@Sudo-Ivan made their first contribution in 4168377b6

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.63.2...v0.64.0

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them?
You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

Read installation instructions on our website.
Host Navidrome on PikaPods or Zenith for a simple cloud solution.
Reach out on Discord, Reddit and Twitter!

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/navidrome/navidrome](https://github.com/navidrome/navidrome) | minor | `0.63.2` → `0.64.0` | --- ### Release Notes <details> <summary>navidrome/navidrome (ghcr.io/navidrome/navidrome)</summary> ### [`v0.64.0`](https://github.com/navidrome/navidrome/releases/tag/v0.64.0) [Compare Source](https://github.com/navidrome/navidrome/compare/v0.63.2...v0.64.0) This release brings an **experimental Jellyfin Music API**, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a **new background pipeline** with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a **uniform canonical 128-bit format**, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling. #### ⚠️ Breaking Changes / Migration Notes - **All internal IDs are re-encoded** to a single canonical 128-bit base62 format. The migration touches every table, so **back up your database before upgrading**. Clients that cache item IDs (for example, offline downloads) may need to re-sync. ([#5824](https://github.com/navidrome/navidrome/pull/5824)) - **Plugin authors: Extism's built-in HTTP is disabled.** Calls through `pdk.NewHTTPRequest` (Go), `http::request` (Rust) or the equivalent in other PDKs now fail with `HTTP request ... is not allowed`. Plugins must use the host HTTP service instead: `host.HTTPSend` (Go) or `nd_pdk::host::http::send` (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's `requiredHosts`, or use a bare `"*"`. ([1a8463f7d](https://github.com/navidrome/navidrome/commit/1a8463f7d), [276d767ce](https://github.com/navidrome/navidrome/commit/276d767ce)) - **Shares are always owned by the user who creates them.** Admins can no longer create shares on behalf of another user via `userId`. ([1a8463f7d](https://github.com/navidrome/navidrome/commit/1a8463f7d)) - **Configuration durations are now validated.** Negative values are rejected at startup. ([#6002](https://github.com/navidrome/navidrome/pull/6002)) - Navidrome now **warns about unrecognized options** in the config file, so typos no longer fail silently. ([#5870](https://github.com/navidrome/navidrome/pull/5870)) #### Security This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them. - Fix SQL injection via the artist `role` sort and filter parameters in the Native API by validating the role against the known list. ([4168377b6](https://github.com/navidrome/navidrome/commit/4168377b6), [GHSA-hm54-32q6-3rcr](https://github.com/navidrome/navidrome/security/advisories/GHSA-hm54-32q6-3rcr), reported and fixed by [@Sudo-Ivan](https://github.com/Sudo-Ivan)) - Fix share-ownership spoofing (IDOR) that let a client-supplied `userId` on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. ([1a8463f7d](https://github.com/navidrome/navidrome/commit/1a8463f7d), [GHSA-82gh-4ggp-gfg5](https://github.com/navidrome/navidrome/security/advisories/GHSA-82gh-4ggp-gfg5), reported by [@gigioneggiando](https://github.com/gigioneggiando)) - Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. ([276d767ce](https://github.com/navidrome/navidrome/commit/276d767ce), [GHSA-pr2j-mfc8-qjcc](https://github.com/navidrome/navidrome/security/advisories/GHSA-pr2j-mfc8-qjcc), reported by [@qrn12580](https://github.com/qrn12580)) - Fix login rate limit bypass via spoofed `X-Forwarded-For`, `X-Real-IP` and `True-Client-IP` headers by keying the limit on the trust-aware client IP. ([#6124](https://github.com/navidrome/navidrome/pull/6124), [GHSA-f295-6wp9-qqfg](https://github.com/navidrome/navidrome/security/advisories/GHSA-f295-6wp9-qqfg), reported by [@gehan-psbc](https://github.com/gehan-psbc) and [@skarn958](https://github.com/skarn958)) - Fix memory exhaustion via a negative `size` parameter on `getCoverArt` and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. ([#5847](https://github.com/navidrome/navidrome/pull/5847), [GHSA-f22h-6qxh-rqq2](https://github.com/navidrome/navidrome/security/advisories/GHSA-f22h-6qxh-rqq2), reported by [@arpitjain099](https://github.com/arpitjain099)) - Enforce track membership on public share streams so a share can only stream the tracks it contains. ([#5769](https://github.com/navidrome/navidrome/pull/5769) by [@deluan](https://github.com/deluan)) - Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. ([#6098](https://github.com/navidrome/navidrome/pull/6098) by [@deluan](https://github.com/deluan)) - Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. ([#5881](https://github.com/navidrome/navidrome/pull/5881), [#5886](https://github.com/navidrome/navidrome/pull/5886) by [@deluan](https://github.com/deluan)) - Redact sensitive auth headers from request logs. ([82b9a44a1](https://github.com/navidrome/navidrome/commit/82b9a44a1) by [@deluan](https://github.com/deluan)) > **Note:** Several of the advisories linked above are still in **draft** on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release. #### Configuration Changes | Status | Option | Description | Default | | ------ | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | New | `Jellyfin.Enabled` | Enable the experimental Jellyfin Music API. ([#5730](https://github.com/navidrome/navidrome/pull/5730)) | `false` | | New | `Jellyfin.ServerName` | Server name advertised to Jellyfin clients. ([#5730](https://github.com/navidrome/navidrome/pull/5730)) | `Navidrome <version>` | | New | `Jellyfin.ExposedPublicUsers` | Comma-separated usernames advertised on the unauthenticated public users endpoint. ([#5730](https://github.com/navidrome/navidrome/pull/5730)) | `""` | | New | `Jellyfin.MaxConcurrentStreams` | Bounds how many Jellyfin collection responses can stream at once. ([#5783](https://github.com/navidrome/navidrome/pull/5783)) | `max(2, MaxOpenConns/2)` | | New | `EnableNaturalSorting` | Sort names and titles naturally (e.g. "Track 2" before "Track 10"). ([#6015](https://github.com/navidrome/navidrome/pull/6015)) | `false` | | New | `MaxImageSize` | Cap on the size of artwork images Navidrome will decode. ([#5931](https://github.com/navidrome/navidrome/pull/5931)) | `20MB` | | New | `EnableScheduledDBAnalyze` | Periodically run a full `ANALYZE` to keep query planner statistics fresh. ([#5740](https://github.com/navidrome/navidrome/pull/5740)) | `true` | For a complete list of all configuration options, see the [Configuration Options](https://www.navidrome.org/docs/usage/configuration-options/) documentation. #### Jellyfin API (Experimental) - Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with `Jellyfin.Enabled = true`. ([#5730](https://github.com/navidrome/navidrome/pull/5730) by [@deluan](https://github.com/deluan)) - Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. ([#5791](https://github.com/navidrome/navidrome/pull/5791), [#5948](https://github.com/navidrome/navidrome/pull/5948), [#5815](https://github.com/navidrome/navidrome/pull/5815), [#5817](https://github.com/navidrome/navidrome/pull/5817) by [@deluan](https://github.com/deluan), [#5809](https://github.com/navidrome/navidrome/pull/5809) by [@kgarner7](https://github.com/kgarner7)) - Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. ([#5782](https://github.com/navidrome/navidrome/pull/5782) by [@deluan](https://github.com/deluan)) - Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. ([#6013](https://github.com/navidrome/navidrome/pull/6013) by [@deluan](https://github.com/deluan)) #### Artwork - New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. ([#5847](https://github.com/navidrome/navidrome/pull/5847) by [@deluan](https://github.com/deluan)) - Make the artwork image size cap configurable. ([#5931](https://github.com/navidrome/navidrome/pull/5931) by [@deluan](https://github.com/deluan)) - Fix artist folder being promoted to album folder. ([#5856](https://github.com/navidrome/navidrome/pull/5856) by [@kgarner7](https://github.com/kgarner7)) - Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. ([#5808](https://github.com/navidrome/navidrome/pull/5808), [#6068](https://github.com/navidrome/navidrome/pull/6068) by [@deluan](https://github.com/deluan)) #### UI - Add Refresh Metadata action to album and artist pages and context menus. ([#6036](https://github.com/navidrome/navidrome/pull/6036), [#6078](https://github.com/navidrome/navidrome/pull/6078) by [@deluan](https://github.com/deluan)) - Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. ([#5805](https://github.com/navidrome/navidrome/pull/5805) by [@deluan](https://github.com/deluan)) - Add Catppuccin Mocha and Frappé themes, and update Macchiato to match the official palette. ([#5835](https://github.com/navidrome/navidrome/pull/5835) by [@cmyksoda](https://github.com/cmyksoda)) - Add Artists, Songs, Playlists and Radio to the Default View options. ([#5754](https://github.com/navidrome/navidrome/pull/5754), [#5801](https://github.com/navidrome/navidrome/pull/5801) by [@deluan](https://github.com/deluan)) - Add Share and Download actions to the Artist detail page. ([#5944](https://github.com/navidrome/navidrome/pull/5944) by [@deluan](https://github.com/deluan)) - Show translation completion percentage in the language selector. ([#5979](https://github.com/navidrome/navidrome/pull/5979) by [@deluan](https://github.com/deluan)) - Remember the "items per page" selection across sessions. ([#5819](https://github.com/navidrome/navidrome/pull/5819) by [@deluan](https://github.com/deluan)) - Give visual feedback when downloading from a share. ([#5865](https://github.com/navidrome/navidrome/pull/5865) by [@deluan](https://github.com/deluan)) - Fix logins sometimes showing the wrong user. ([#5882](https://github.com/navidrome/navidrome/pull/5882) by [@deluan](https://github.com/deluan), [#5767](https://github.com/navidrome/navidrome/pull/5767) by [@apkatsikas](https://github.com/apkatsikas)) - Fix each page's scroll position not being restored when navigating back. ([#5892](https://github.com/navidrome/navidrome/pull/5892) by [@deluan](https://github.com/deluan)) - Fix playback starting when closing the disc cover lightbox. ([#5901](https://github.com/navidrome/navidrome/pull/5901) by [@deluan](https://github.com/deluan)) - Fix playlist not reloading after rating or loving a track. ([#6009](https://github.com/navidrome/navidrome/pull/6009) by [@polybjorn](https://github.com/polybjorn)) - Fix the album grid resizing in Safari when top menus open. ([#6125](https://github.com/navidrome/navidrome/pull/6125) by [@york9675](https://github.com/york9675)) - Fix the album grid hover overlay corners in the Nautiline theme. ([#6115](https://github.com/navidrome/navidrome/pull/6115) by [@deluan](https://github.com/deluan)) - Fix transcoding Default Bit Rate not accepting 0. ([8d77a49b3](https://github.com/navidrome/navidrome/commit/8d77a49b3) by [@deluan](https://github.com/deluan)) - Fix the Last.fm link not always showing on the artist details page. ([b0e1943d8](https://github.com/navidrome/navidrome/commit/b0e1943d8) by [@deluan](https://github.com/deluan)) #### Playlists & Smart Playlists - Add album-level fields for sorting and filtering in smart playlists. ([#5899](https://github.com/navidrome/navidrome/pull/5899) by [@deluan](https://github.com/deluan)) - Add per-playlist `refreshDelay` for stable daily or weekly smart playlists. ([#5790](https://github.com/navidrome/navidrome/pull/5790) by [@deluan](https://github.com/deluan)) - Store playlist stars and ratings per user. ([#5749](https://github.com/navidrome/navidrome/pull/5749) by [@deluan](https://github.com/deluan)) - Make playlist import much faster on large libraries. ([#6055](https://github.com/navidrome/navidrome/pull/6055) by [@deluan](https://github.com/deluan)) - Fix in-place playlist edits not being detected by the scanner. ([#5914](https://github.com/navidrome/navidrome/pull/5914) by [@junkerderprovinz](https://github.com/junkerderprovinz)) - Fix track edits being allowed on synced playlists via some APIs. ([#5984](https://github.com/navidrome/navidrome/pull/5984) by [@deluan](https://github.com/deluan)) - Fix smart playlist song count being lost on re-import. ([#5908](https://github.com/navidrome/navidrome/pull/5908) by [@deluan](https://github.com/deluan)) - Fix deleting many tracks from a playlist at once failing. ([#5977](https://github.com/navidrome/navidrome/pull/5977) by [@deluan](https://github.com/deluan)) - Fix the `changed` timestamp not being updated when renaming a smart playlist. ([#6082](https://github.com/navidrome/navidrome/pull/6082) by [@deluan](https://github.com/deluan)) #### Scanner - Add optional natural sort order for names and titles. ([#6015](https://github.com/navidrome/navidrome/pull/6015) by [@deluan](https://github.com/deluan)) - Support the `[bg:]` tag and skip unknown tags in LRC lyrics files. ([#5966](https://github.com/navidrome/navidrome/pull/5966) by [@deluan](https://github.com/deluan)) - Fix album tags being sorted alphabetically instead of keeping the order from the files. ([#5872](https://github.com/navidrome/navidrome/pull/5872) by [@deluan](https://github.com/deluan)) - Fix file creation time not being read on Linux. ([#6046](https://github.com/navidrome/navidrome/pull/6046) by [@deluan](https://github.com/deluan)) #### Subsonic API - Implement the OpenSubsonic `topSongsByArtistId` extension. ([#5853](https://github.com/navidrome/navidrome/pull/5853) by [@kgarner7](https://github.com/kgarner7)) - Fix `createShare` ignoring `DefaultDownloadableShare`. ([#6121](https://github.com/navidrome/navidrome/pull/6121) by [@deluan](https://github.com/deluan)) - Fix double brackets when appending subtitle or version to titles. ([#5832](https://github.com/navidrome/navidrome/pull/5832) by [@deluan](https://github.com/deluan)) #### Transcoding & Streaming - Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. ([#6105](https://github.com/navidrome/navidrome/pull/6105) by [@deluan](https://github.com/deluan)) - Fix truncated transcoded streams being delivered as complete. ([#6035](https://github.com/navidrome/navidrome/pull/6035) by [@deluan](https://github.com/deluan)) - Fix AAC streams being reported as `audio/mp4` instead of `audio/aac`. ([#5998](https://github.com/navidrome/navidrome/pull/5998) by [@justadityaraj](https://github.com/justadityaraj)) - Fix bit depth being reported for lossy transcode targets. ([#5768](https://github.com/navidrome/navidrome/pull/5768) by [@deluan](https://github.com/deluan)) #### Scrobbling - Add a per-user scrobble filter. ([#5964](https://github.com/navidrome/navidrome/pull/5964) by [@deluan](https://github.com/deluan)) - Add a scrobble history Native API. ([#5761](https://github.com/navidrome/navidrome/pull/5761) by [@kgarner7](https://github.com/kgarner7)) - Use exponential backoff for scrobble retries during provider outages, and honor a provider's request to back off. ([#5818](https://github.com/navidrome/navidrome/pull/5818), [#6028](https://github.com/navidrome/navidrome/pull/6028) by [@deluan](https://github.com/deluan)) - Fix out-of-order playback reports being rejected. ([#5793](https://github.com/navidrome/navidrome/pull/5793) by [@deluan](https://github.com/deluan)) #### Plugins - Add plugin-specific storage. ([#5839](https://github.com/navidrome/navidrome/pull/5839) by [@kgarner7](https://github.com/kgarner7)) - Add scrobble access to the plugin SDK. ([#5795](https://github.com/navidrome/navidrome/pull/5795) by [@kgarner7](https://github.com/kgarner7)) - Surface the valid agent names in logs and the Plugins UI. ([#5910](https://github.com/navidrome/navidrome/pull/5910) by [@deluan](https://github.com/deluan)) - Fix plugin agents not being loaded in CLI commands. ([#5959](https://github.com/navidrome/navidrome/pull/5959) by [@deluan](https://github.com/deluan)) - Fix public URLs built by plugins pointing at localhost instead of the caller's address. ([#6059](https://github.com/navidrome/navidrome/pull/6059) by [@deluan](https://github.com/deluan)) #### CLI - Add an `artwork` command group (`explain`, `refresh`, `cancel`) for diagnosing and re-driving artwork resolution. ([#5957](https://github.com/navidrome/navidrome/pull/5957) by [@deluan](https://github.com/deluan)) - Add `missing list` and `missing fix` subcommands to deal with files that moved. ([#5928](https://github.com/navidrome/navidrome/pull/5928) by [@zerovox](https://github.com/zerovox)) - Add `doctor` and `search rebuild` commands to detect and recover from search index corruption. ([#6069](https://github.com/navidrome/navidrome/pull/6069) by [@deluan](https://github.com/deluan)) - Fix `restore` wiping the database when the backup file does not exist. ([#6085](https://github.com/navidrome/navidrome/pull/6085) by [@Huang-404-Q](https://github.com/Huang-404-Q)) - Fix selective scan `--target` rejecting absolute paths. ([#5947](https://github.com/navidrome/navidrome/pull/5947) by [@deluan](https://github.com/deluan)) - Fix `pls -p` writing playlist output to stderr instead of stdout. ([#5996](https://github.com/navidrome/navidrome/pull/5996) by [@deluan](https://github.com/deluan)) #### Server - Make genre and artist filtering much faster across all APIs by using indexed join tables. ([#5940](https://github.com/navidrome/navidrome/pull/5940), [#5930](https://github.com/navidrome/navidrome/pull/5930) by [@deluan](https://github.com/deluan)) - Report the app store or hosting platform via `ND_PLATFORM` in insights. ([#5956](https://github.com/navidrome/navidrome/pull/5956) by [@deluan](https://github.com/deluan)) - Send the Navidrome User-Agent in all outgoing requests. ([#6020](https://github.com/navidrome/navidrome/pull/6020) by [@mintsoft](https://github.com/mintsoft)) - Fix `getScanStatus` reporting `count=0` for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when `MusicFolder` contains a single quote. ([#6098](https://github.com/navidrome/navidrome/pull/6098) by [@deluan](https://github.com/deluan)) #### Database - Periodically run a full `ANALYZE` to keep query planner statistics trustworthy. ([#5740](https://github.com/navidrome/navidrome/pull/5740) by [@deluan](https://github.com/deluan)) #### Packaging & Build - Upgrade to Go 1.27. ([#5990](https://github.com/navidrome/navidrome/pull/5990) by [@deluan](https://github.com/deluan)) - Upgrade the Docker base image to Alpine 3.22, and add `curl` to the container image. ([#6048](https://github.com/navidrome/navidrome/pull/6048) by [@deluan](https://github.com/deluan), [#6116](https://github.com/navidrome/navidrome/pull/6116) by [@miguelallopes](https://github.com/miguelallopes)) - Bump TagLib to 2.3.2. ([#6088](https://github.com/navidrome/navidrome/pull/6088) by [@deluan](https://github.com/deluan)) - Windows MSI: remember install properties across upgrades. ([#5333](https://github.com/navidrome/navidrome/pull/5333) by [@mintsoft](https://github.com/mintsoft)) - Fix a missing hyphen in the OpenRC script that caused crashes on startup. ([#5906](https://github.com/navidrome/navidrome/pull/5906) by [@alinxviso](https://github.com/alinxviso)) - Fix a typo in the `--prometheus.enabled` description. ([#5878](https://github.com/navidrome/navidrome/pull/5878) by [@0mp](https://github.com/0mp)) #### Translations - Update Chinese (Simplified) translation. ([#5779](https://github.com/navidrome/navidrome/pull/5779), [#5873](https://github.com/navidrome/navidrome/pull/5873) by [@fxj368](https://github.com/fxj368)) - Update Italian translation. ([#5848](https://github.com/navidrome/navidrome/pull/5848) by [@McCio](https://github.com/McCio)) - Update Japanese translation. ([#6080](https://github.com/navidrome/navidrome/pull/6080) by [@karigane-cha](https://github.com/karigane-cha)) - Update German, Greek, Finnish, Galician, Polish, Portuguese (BR), Thai, Ukrainian and Chinese (Traditional) translations from POEditor. ([#5833](https://github.com/navidrome/navidrome/pull/5833), [#6128](https://github.com/navidrome/navidrome/pull/6128) by [@deluan](https://github.com/deluan)) #### New Contributors - [@McCio](https://github.com/McCio) made their first contribution in [#5848](https://github.com/navidrome/navidrome/pull/5848) - [@0mp](https://github.com/0mp) made their first contribution in [#5878](https://github.com/navidrome/navidrome/pull/5878) - [@alinxviso](https://github.com/alinxviso) made their first contribution in [#5906](https://github.com/navidrome/navidrome/pull/5906) - [@IgorPolyakov](https://github.com/IgorPolyakov) made their first contribution in [#5867](https://github.com/navidrome/navidrome/pull/5867) - [@junkerderprovinz](https://github.com/junkerderprovinz) made their first contribution in [#5916](https://github.com/navidrome/navidrome/pull/5916) - [@justadityaraj](https://github.com/justadityaraj) made their first contribution in [#5998](https://github.com/navidrome/navidrome/pull/5998) - [@polybjorn](https://github.com/polybjorn) made their first contribution in [#6009](https://github.com/navidrome/navidrome/pull/6009) - [@karigane-cha](https://github.com/karigane-cha) made their first contribution in [#6080](https://github.com/navidrome/navidrome/pull/6080) - [@Shxiao101](https://github.com/Shxiao101) made their first contribution in [#6097](https://github.com/navidrome/navidrome/pull/6097) - [@cmyksoda](https://github.com/cmyksoda) made their first contribution in [#5835](https://github.com/navidrome/navidrome/pull/5835) - [@miguelallopes](https://github.com/miguelallopes) made their first contribution in [#6116](https://github.com/navidrome/navidrome/pull/6116) - [@Huang-404-Q](https://github.com/Huang-404-Q) made their first contribution in [#6085](https://github.com/navidrome/navidrome/pull/6085) - [@zerovox](https://github.com/zerovox) made their first contribution in [#5928](https://github.com/navidrome/navidrome/pull/5928) - [@Sudo-Ivan](https://github.com/Sudo-Ivan) made their first contribution in [4168377b6](https://github.com/navidrome/navidrome/commit/4168377b6) **Full Changelog**: <https://github.com/navidrome/navidrome/compare/v0.63.2...v0.64.0> #### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). #### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods?run=navidrome) or [Zenith](https://zenith.hosting/host/navidrome?ref=navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)! </details> --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added the

renovate

label

2026-09-13 08:00:47 -04:00

renovate-bot added 1 commit

2026-09-13 08:00:47 -04:00

Update ghcr.io/navidrome/navidrome Docker tag to v0.64.0 ceae8018a7

renovate-bot changed title from ~~Update ghcr.io/navidrome/navidrome Docker tag to v0.64.0~~ to chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.0

2026-09-17 08:01:13 -04:00

mysticalsoap referenced this pull request

2026-09-18 17:24:26 -04:00

metadata: 1200px CAA thumbnails, stable art change-detection key #269

mysticalsoap commented

2026-09-18 17:24:39 -04:00

Owner

Live-verified on 2026-09-18 by applying this one-line bump to the trunk working tree (branch is 126 behind trunk; checking it out would have rolled back lidarr/qbittorrent) and just up media.

DB copied to media/navidrome/navidrome.db.pre-0.64.0 (sha256 verified) while stopped, then goose ran 14 migrations incl. uniform_canonical_ids in 53 ms with no errors.
Row counts identical before/after (3 users, 1216 media_file, 107 album, 92 artist, 384 annotation, play_count sum 2187). IDs were already 22-char base62 here so the re-encode was a no-op; the JWT secret still rotated, so the web UI needs a re-login.
knock navidrome.py libraries admin login smoke test passes. Plugins dir empty, no config file, no duration options set, no shares-by-userId: none of the other breaking changes apply.
New MaxImageSize (20 MB) rejected three covers the art sync had pulled as full-size CAA scans (28-36 MB). Fixed in #269, already applied live: all covers under 2 MB, the three albums serve art again.
Open question, not changed: the login rate limiter now keys on the peer address unless ExtAuth.TrustedSources lists the proxy, so behind Traefik every public client shares one 5-per-20s bucket.

Working tree carries this bump uncommitted until merge; git pull afterwards leaves it identical.

Live-verified on 2026-09-18 by applying this one-line bump to the trunk working tree (branch is 126 behind trunk; checking it out would have rolled back lidarr/qbittorrent) and `just up media`. - DB copied to `media/navidrome/navidrome.db.pre-0.64.0` (sha256 verified) while stopped, then goose ran 14 migrations incl. `uniform_canonical_ids` in 53 ms with no errors. - Row counts identical before/after (3 users, 1216 media_file, 107 album, 92 artist, 384 annotation, play_count sum 2187). IDs were already 22-char base62 here so the re-encode was a no-op; the JWT secret still rotated, so the web UI needs a re-login. - knock `navidrome.py libraries` admin login smoke test passes. Plugins dir empty, no config file, no duration options set, no shares-by-userId: none of the other breaking changes apply. - New `MaxImageSize` (20 MB) rejected three covers the art sync had pulled as full-size CAA scans (28-36 MB). Fixed in #269, already applied live: all covers under 2 MB, the three albums serve art again. - Open question, not changed: the login rate limiter now keys on the peer address unless `ExtAuth.TrustedSources` lists the proxy, so behind Traefik every public client shares one 5-per-20s bucket. Working tree carries this bump uncommitted until merge; `git pull` afterwards leaves it identical.

mysticalsoap merged commit 02b3542dac into trunk

2026-09-18 17:46:11 -04:00

mysticalsoap deleted branch renovate/ghcr.io-navidrome-navidrome-0.x

2026-09-18 17:46:11 -04:00

mysticalsoap referenced this pull request from a commit

2026-09-18 17:46:11 -04:00

Merge pull request 'chore(deps): update ghcr.io/navidrome/navidrome docker tag to v0.64.0' (#223) from renovate/ghcr.io-navidrome-navidrome-0.x into trunk

mysticalsoap referenced this pull request

2026-09-19 13:02:56 -04:00

docs: how to verify a Renovate PR that is behind trunk #282