Skip to content

feat(container): update image ghcr.io/navidrome/navidrome ( 0.63.2 → 0.64.0 ) - #1843

Open
chaplain-grimaldus[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-navidrome-navidrome-0.x
Open

feat(container): update image ghcr.io/navidrome/navidrome ( 0.63.2 → 0.64.0 )#1843
chaplain-grimaldus[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-navidrome-navidrome-0.x

Conversation

@chaplain-grimaldus

@chaplain-grimaldus chaplain-grimaldus Bot commented Sep 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
ghcr.io/navidrome/navidrome minor 0.63.2 → 0.64.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

navidrome/navidrome (ghcr.io/navidrome/navidrome)

v0.64.0

Compare Source

This release brings an experimental Jellyfin Music API, so Jellyfin-compatible music clients like Finamp and Jellify can now connect to Navidrome. Artwork got a new background pipeline with blurred low-quality placeholders and a diagnostic CLI. Under the hood, all IDs move to a uniform canonical 128-bit format, genre and artist filtering is now index-backed, and playlist import on large libraries is dramatically faster. There is also natural sort order, playlist favourites, Refresh Metadata actions, new Catppuccin themes, and many fixes across scanning, transcoding and scrobbling.

⚠️ Breaking Changes / Migration Notes
  • All internal IDs are re-encoded to a single canonical 128-bit base62 format. The migration touches every table, so back up your database before upgrading. Clients that cache item IDs (for example, offline downloads) may need to re-sync. (#​5824)
  • Plugin authors: Extism's built-in HTTP is disabled. Calls through pdk.NewHTTPRequest (Go), http::request (Rust) or the equivalent in other PDKs now fail with HTTP request ... is not allowed. Plugins must use the host HTTP service instead: host.HTTPSend (Go) or nd_pdk::host::http::send (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's requiredHosts, or use a bare "*". (1a8463f7d, 276d767ce)
  • Shares are always owned by the user who creates them. Admins can no longer create shares on behalf of another user via userId. (1a8463f7d)
  • Configuration durations are now validated. Negative values are rejected at startup. (#​6002)
  • Navidrome now warns about unrecognized options in the config file, so typos no longer fail silently. (#​5870)
Security

This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them.

  • Fix SQL injection via the artist role sort and filter parameters in the Native API by validating the role against the known list. (4168377b6, GHSA-hm54-32q6-3rcr, reported and fixed by @​Sudo-Ivan)
  • Fix share-ownership spoofing (IDOR) that let a client-supplied userId on share creation expose other users' private libraries, and fix a plugin HTTP client SSRF guard bypass via DNS names and redirects by disabling Extism's built-in HTTP and checking the resolved IP at dial time. (1a8463f7d, GHSA-82gh-4ggp-gfg5, reported by @​gigioneggiando)
  • Fix the same SSRF bypass in the plugin WebSocket host service by adding the private-address guard it was missing. (276d767ce, GHSA-pr2j-mfc8-qjcc, reported by @​qrn12580)
  • Fix login rate limit bypass via spoofed X-Forwarded-For, X-Real-IP and True-Client-IP headers by keying the limit on the trust-aware client IP. (#​6124, GHSA-f295-6wp9-qqfg, reported by @​gehan-psbc and @​skarn958)
  • Fix memory exhaustion via a negative size parameter on getCoverArt and share images, which bypassed the artwork size clamp, by rejecting negative and oversized dimensions before decoding. (#​5847, GHSA-f22h-6qxh-rqq2, reported by @​arpitjain099)
  • Enforce track membership on public share streams so a share can only stream the tracks it contains. (#​5769 by @​deluan)
  • Validate every resource ID in a share, load share metadata as the owner, cap login request bodies, create the log file with mode 0600, and stop logging the Last.fm auth token. (#​6098 by @​deluan)
  • Confine plugin filesystem mounts to their root and reject plugin IDs that are unusable as directory names. (#​5881, #​5886 by @​deluan)
  • Redact sensitive auth headers from request logs. (82b9a44a1 by @​deluan)

Note: Several of the advisories linked above are still in draft on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release.

Configuration Changes
Status Option Description Default
New Jellyfin.Enabled Enable the experimental Jellyfin Music API. (#​5730) false
New Jellyfin.ServerName Server name advertised to Jellyfin clients. (#​5730) Navidrome <version>
New Jellyfin.ExposedPublicUsers Comma-separated usernames advertised on the unauthenticated public users endpoint. (#​5730) ""
New Jellyfin.MaxConcurrentStreams Bounds how many Jellyfin collection responses can stream at once. (#​5783) max(2, MaxOpenConns/2)
New EnableNaturalSorting Sort names and titles naturally (e.g. "Track 2" before "Track 10"). (#​6015) false
New MaxImageSize Cap on the size of artwork images Navidrome will decode. (#​5931) 20MB
New EnableScheduledDBAnalyze Periodically run a full ANALYZE to keep query planner statistics fresh. (#​5740) true

For a complete list of all configuration options, see the Configuration Options documentation.

Jellyfin API (Experimental)
  • Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with Jellyfin.Enabled = true. (#​5730 by @​deluan)
  • Supports library browsing, search, favorites and ratings, playlists, lyrics, Instant Mix (album, playlist and genre sources), ReplayGain normalization, and filtering by year and record label. (#​5791, #​5948, #​5815, #​5817 by @​deluan, #​5809 by @​kgarner7)
  • Jellyfin clients get sonic similarity features (similar tracks, sonic path) when a sonic similarity plugin is installed, backed by the same engine already exposed over the Subsonic API. (#​5782 by @​deluan)
  • Jellyfin tokens never expire, are scoped to the Jellyfin API, and are revoked when the user changes their password. (#​6013 by @​deluan)
Artwork
  • New artwork pipeline: artwork resolves in the background and pages show a blurred Low Quality Image Placeholder until the real image arrives. External providers are rate-limited and guarded by a circuit breaker, and missing artwork is rechecked slowly instead of on every request. (#​5847 by @​deluan)
  • Make the artwork image size cap configurable. (#​5931 by @​deluan)
  • Fix artist folder being promoted to album folder. (#​5856 by @​kgarner7)
  • Fix Deezer picking the wrong artist among same-name matches, and treat an exhausted Deezer quota as a throttle instead of a missing artist. (#​5808, #​6068 by @​deluan)
UI
Playlists & Smart Playlists
Scanner
Subsonic API
Transcoding & Streaming
  • Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. (#​6105 by @​deluan)
  • Fix truncated transcoded streams being delivered as complete. (#​6035 by @​deluan)
  • Fix AAC streams being reported as audio/mp4 instead of audio/aac. (#​5998 by @​justadityaraj)
  • Fix bit depth being reported for lossy transcode targets. (#​5768 by @​deluan)
Scrobbling
Plugins
CLI
  • Add an artwork command group (explain, refresh, cancel) for diagnosing and re-driving artwork resolution. (#​5957 by @​deluan)
  • Add missing list and missing fix subcommands to deal with files that moved. (#​5928 by @​zerovox)
  • Add doctor and search rebuild commands to detect and recover from search index corruption. (#​6069 by @​deluan)
  • Fix restore wiping the database when the backup file does not exist. (#​6085 by @​Huang-404-Q)
  • Fix selective scan --target rejecting absolute paths. (#​5947 by @​deluan)
  • Fix pls -p writing playlist output to stderr instead of stdout. (#​5996 by @​deluan)
Server
  • Make genre and artist filtering much faster across all APIs by using indexed join tables. (#​5940, #​5930 by @​deluan)
  • Report the app store or hosting platform via ND_PLATFORM in insights. (#​5956 by @​deluan)
  • Send the Navidrome User-Agent in all outgoing requests. (#​6020 by @​mintsoft)
  • Fix getScanStatus reporting count=0 for scans not started through the API, fix the folder watcher hanging when it cannot start, and fix startup failing when MusicFolder contains a single quote. (#​6098 by @​deluan)
Database
  • Periodically run a full ANALYZE to keep query planner statistics trustworthy. (#​5740 by @​deluan)
Packaging & Build
Translations
New Contributors

Full Changelog: navidrome/navidrome@v0.63.2...v0.64.0

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them?
You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate/container type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants