Navidrome Daily: Auth Overhaul and a Concurrency Fix
Deluan shipped a significant rework of Jellyfin authentication that replaces token expiry with real revocation, then followed up hours later with a fix for a data race in the plugin loader caught by the master branch's test pipeline.
Duration: PT2M21S
Episode overview
This episode is a short developer briefing from Navidrome Daily.
It explains recent repository work in plain language.
- Show: Navidrome Daily
- Published: 2026-08-23T10:01:06Z
- Audio duration: PT2M21S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's August 23rd, and this is Navidrome Daily.
Today's biggest story is a security and reliability rework of how Jellyfin clients authenticate — and a same-day race condition fix that shows the test suite doing its job.
Let's start with authentication. PR 6013 tackles a real user-facing bug: Jellyfin clients were losing their sessions roughly every two days because Jellyfin logins were minted as ordinary Navidrome session tokens with no refresh path — but real Jellyfin clients expect tokens that never expire. Deluan's fix, landed…
The second theme is concurrency safety. PR 6014, merged shortly after, fixes a data race caught by the master pipeline's race detector — all 640 specs passed, but the build failed because the plugin manager wrote to a shared plugin map under a lock, then read it back unlocked. Commit f-c-9-d-9-3-c fixes this by…
Two other items: a nix flake proposal from contributor owlenz for a reproducible dev environment, still open, and a minor housekeeping commit extending stale artwork cleanup to thirty days.
What to remember: if you're working with Jellyfin tokens or the plugin manager, both auth claims and plugin map access have new invariants worth…
Nearby episodes from Navidrome Daily
- Playing Nice With External Providers
- Natural Sorting Gets Hardened, Not Just Shipped
- Weekly Recap - Taming External Load and Client Compatibility
- Taming the Artwork Backfill
- When Output Doesn't Match What You Promised
- Data Integrity Meets Client Compatibility
- Trust the Stored State
- Playlist Sync Bug Squashed