Navidrome Daily: Security Hardening Across Libraries, Players and Artwork
Five merged fixes tighten library isolation, player ownership, artwork handling and Subsonic login limits, alongside a fix for flaky Windows tests. The pattern is closing authorization and server-request gaps rather than adding features.
Duration: PT2M26S
Episode overview
This episode is a short developer briefing from Navidrome Daily.
It explains recent repository work in plain language.
- Show: Navidrome Daily
- Published: 2026-09-21T10:00:40Z
- Audio duration: PT2M26S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's Monday, September 21st, 2026, and this is Navidrome Daily.
The headline is a security hardening sweep: five fixes that close paths where users could see or overwrite data outside their permissions, or make the server request internal network addresses.
First, library isolation. On multi-library instances, bookmarks, playlist tracks, and now-playing were missing the per-user library filter that other media reads apply. As fixed in PR 6179, a user with access to only some libraries could see or store tracks from other libraries. Bookmarks are now filtered in the…
Second, playlist and remote artwork as an attack surface. PR 6180 requires local cover candidates to look like image files and ties uploaded playlist covers to libraries the owner can access, preventing an uploaded playlist from pulling arbitrary files under any library root as cover art. PR 6181 blocks private,…
Finally, authentication and test reliability. PR 6185 rate-limits failed Subsonic API logins per client address and username, using the same request limit and window settings as the UI login, counting only failures so normal clients that send credentials on every call are unaffected. And PR 6182…
What…
Nearby episodes from Navidrome Daily
- Weekly Recap - Jellyfin Compatibility and Security Hardening
- Jellyfin Onboarding Push and Portable Smart Playlists
- Jellyfin Catches Up, Last.fm Links Get Fixed
- Protocol Compatibility Cleanup
- Jellyfin Compatibility Gets Serious
- Compatibility and Architecture Cleanup
- Closing the 404 Gap
- Fixing What Users Actually Feel