Navidrome Daily: Weekly Recap - Trust, Security, and the Foundations Beneath Your Library
Navidrome shipped a major identifier overhaul and closed several trust gaps this week, from a plugin sandbox escape to a login cache bug, while also cleaning up long-standing metadata and sorting quirks. Fifteen pull requests landed, with no additional standalone commits.
Duration: PT2M56S
Episode overview
This episode is a short developer briefing from Navidrome Daily.
It explains recent repository work in plain language.
- Show: Navidrome Daily
- Published: 2026-08-03T09:38:45Z
- Audio duration: PT2M56S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Welcome to Navidrome Daily, covering July 27th through August 3rd, 2026. Fifteen pull request activity items this week, and zero additional commits — all the movement came through reviewed, merged changes.
The headline is a foundational one. PR 5824 migrates every id in the database — random ids, legacy hash-based ids, and playlist ids — into one uniform 22-character format that can always be converted losslessly to a standard GUID. That's a broad, structural change, and it sets up cleaner tooling and fewer edge cases…
That structural work paired with a week focused heavily on trust and security. PR 5881 closes a real sandbox escape: a plugin with filesystem access could use a symlink trick to write outside its own mount, potentially reaching the server's database. PR 5882 fixes a login bug where the app's cached homepage could…
A third theme is correctness in everyday listening and library data. PR 5872 fixes genre ordering so albums show the genre as tagged in the file, not just the alphabetically first tie-breaker. PR 5877 restores embedded cover art that was getting dropped during MP3 and FLAC transcoding. PR 5867 fixes a timestamp…
Rounding out the week: PR 5865 gives users…
Next…
Nearby episodes from Navidrome Daily
- Closing the Security and Identity Gaps
- Closing the Gaps in Metadata and Integrations
- Trust Your Metadata, Trust Your Config
- Fixing Silent Share Downloads
- Tagging Gets a Read API, Artist Folders Get a Fix
- Top Songs by Artist, and Cleaner Error Handling
- Weekly Recap - The Artwork Pipeline Overhaul
- A New Way to Handle Artwork