Navidrome Daily: Plugin Storage Lands, Then Gets Locked Down
Navidrome shipped plugin-specific storage in PR 5839, and within hours a follow-up fix in PR 5886 closed a directory-naming bug that could have let plugins collide with each other's private data.
Duration: PT2M13S
Episode overview
This episode is a short developer briefing from Navidrome Daily.
It explains recent repository work in plain language.
- Show: Navidrome Daily
- Published: 2026-08-04T10:00:58Z
- Audio duration: PT2M13S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's August 4th, and today's story is about how fast a new feature can expose an old assumption.
The headline is plugin storage. PR 5839, from Kendall Garner, gives plugins their own persistent, sandboxed read-write storage, guarded by a new permission and a host function to fetch the mapped path. Alongside the code, the team tightened up the plugin README - clarifying that library filesystem access isn't…
That documentation work turned out to be well-timed, because the very same day, Deluan merged PR 5886, a fix for how plugin IDs get turned into directory names. Plugin IDs come straight from the package filename. Deluan found that malformed names - things like a package installed as dot-dot-n-d-p - could produce an…
The throughline here: as soon as plugins got real persistent storage, the security surface of "what counts as a valid plugin identity" mattered a lot more, and the team caught it same-day rather than after it shipped broadly.
One small housekeeping commit rounds things out - excluding worktree folders from the lint checks, keeping CI noise down.
What to remember: if you're writing or reviewing plugin code, don't trust filenames as identifiers without…
Nearby episodes from Navidrome Daily
- Closing the Security and Identity Gaps
- Weekly Recap - Trust, Security, and the Foundations Beneath Your Library
- Closing the Gaps in Metadata and Integrations
- Trust Your Metadata, Trust Your Config
- Fixing Silent Share Downloads
- Tagging Gets a Read API, Artist Folders Get a Fix
- Top Songs by Artist, and Cleaner Error Handling
- Weekly Recap - The Artwork Pipeline Overhaul