Navidrome Daily: Trust, Streaming, and Server Hardening
Today's merges tighten how Navidrome trusts network input, from client IP spoofing in login rate limits to forced-format playback assumptions, alongside a Safari UI fix and routine dependency maintenance.
Duration: PT2M33S
Episode overview
This episode is a short developer briefing from Navidrome Daily.
It explains recent repository work in plain language.
- Show: Navidrome Daily
- Published: 2026-09-11T10:00:58Z
- Audio duration: PT2M33S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, and welcome to Navidrome Daily for September 11th, 2026.
The throughline today is trust — specifically, where Navidrome was trusting client-supplied data it shouldn't have, and two fixes closed that gap.
First, PR 6124 fixes a real security issue: Navidrome applied chi's RealIP middleware to every incoming request, rewriting the detected client address from headers like X-Forwarded-For, regardless of whether trusted sources were actually configured. That meant on a directly exposed instance, any client could fake…
Second, PR 6105 tackles a related trust problem in transcoding: when a client's forced output format matched the source file's format already, Navidrome was still re-encoding it instead of direct-playing it, because the direct-play profile logic was unconditionally cleared. This came from real user reports —…
Separately, PR 6125 fixes a Safari-specific layout bug where opening the Now Playing, Activity, or Settings menus caused the album grid to resize, traced to Material UI's default scroll-locking behavior conflicting with Safari's layout recalculation.
Two other items worth noting: PR 6127 adds a configurable instance name for the login screen, header, and…