Navidrome Daily: Closing the Security and Identity Gaps
Today's merges tackle two security holes — a cache bug that could show one user's login to another, and a plugin sandbox escape that could reach the database file — alongside a sweeping overhaul that puts every database ID on one canonical format.
Duration: PT2M22S
Episode overview
This episode is a short developer briefing from Navidrome Daily.
It explains recent repository work in plain language.
- Show: Navidrome Daily
- Published: 2026-08-03T10:00:47Z
- Audio duration: PT2M22S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good evening. It's August 3rd, 2026, and this is Navidrome Daily.
The clear throughline today is security hardening, with a side of long-overdue cleanup that touches nearly every table in the database.
Start with PR 5882. Deluan fixed a caching bug where the app's index page was being stored in the browser's cache before the login check ran. Under reverse-proxy authentication, that meant a stale cached page could show a completely different user's identity and their Subsonic token after a login swap. The fix…
Second, PR 5881 closes a filesystem sandbox escape in the plugin system. A plugin with write access could create a symlink inside its own mount and use it to write anywhere the server process can, including the main database file. The fix wraps plugin mounts in a jailed filesystem layer that blocks symlink creation…
The biggest single change is PR 5824: a full migration of every ID in the database — random IDs, legacy hash IDs, and playlist UUIDs — to one canonical 128-bit, base62 format. This is foundational maintenance: it removes years of inconsistent ID shapes, includes safeguards against schema drift, and was verified…
Rounding things out, Kendall Garner's PR 5853 adds the…
Nearby episodes from Navidrome Daily
- Weekly Recap - Trust, Security, and the Foundations Beneath Your Library
- Closing the Gaps in Metadata and Integrations
- Trust Your Metadata, Trust Your Config
- Fixing Silent Share Downloads
- Tagging Gets a Read API, Artist Folders Get a Fix
- Top Songs by Artist, and Cleaner Error Handling
- Weekly Recap - The Artwork Pipeline Overhaul
- A New Way to Handle Artwork