Navidrome Daily: Plugin Security Hardening and Data-Safe Merges
This cycle's work centers on closing security gaps in the plugin system and preventing data loss during file and record merges, alongside a Windows installer fix and routine translation updates.
Duration: PT2M25S
Episode overview
This episode is a short developer briefing from Navidrome Daily.
It explains recent repository work in plain language.
- Show: Navidrome Daily
- Published: 2026-09-13T10:01:20Z
- Audio duration: PT2M25S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, it's September 13th, 2026, and this is Navidrome Daily.
The clearest thread today is security and data safety converging on the same problem: making sure operations that move or merge data don't leak access or lose history.
Start with plugins. A series of merged fixes closed off server-side request forgery paths where a plugin could reach private or internal addresses through a hostname that resolved to a hidden IP, including tricks like a trailing dot on "localhost" or DNS rebinding. The fix now checks the actual resolved address at…
A related fix in that same batch addressed share ownership - previously a request could specify any user ID as a share's owner, which in multi-library setups could let one user's access spill into another's. That's now locked to the authenticated user.
Second theme: the missing-file CLI in PR #5928 sounds like a small addition but turned into an extended data-integrity effort. Early fixes prevented remapping from silently dropping track participants, ratings, play counts, and scrobble history when one file's data was merged onto another - the same risk case that…
Smaller but notable: PR #5333 fixes the Windows installer so custom install paths…
Nearby episodes from Navidrome Daily
- Data Safety Gets Serious
- Trust, Streaming, and Server Hardening
- Share Settings Finally Honored
- A Small UI Cleanup
- Transcoding Fix Stops Redundant Re-encodes
- Artwork Gets Smarter, and Quieter Bug Fixes
- Weekly Recap - Artwork Reliability and a Safer Pipeline
- Jellyfin Client Fixes and a Leaner CI Pipeline