From 56b1ce3422706baa8012257060648a2c9ece7875 Mon Sep 17 00:00:00 2001 From: TrueCharts Bot Date: Tue, 9 Jun 2026 09:52:36 +0200 Subject: [PATCH] =?UTF-8?q?feat(navidrome):=20update=20image=20docker.io/d?= =?UTF-8?q?eluan/navidrome=200.61.2=20=E2=86=92=200.62.0=20(#48909)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker.io/deluan/navidrome](https://redirect.github.com/navidrome/navidrome) | minor | `9fa40b3` → `c4b5cb3` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/18710) for more information. Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies. --- ### Release Notes
navidrome/navidrome (docker.io/deluan/navidrome) ### [`v0.62.0`](https://redirect.github.com/navidrome/navidrome/releases/tag/v0.62.0) [Compare Source](https://redirect.github.com/navidrome/navidrome/compare/v0.61.2...v0.62.0) This release introduces support for the OpenSubsonic **`sonicSimilarity`** extension, enabling audio-based similarity through the plugin system: when a plugin provides the capability, the new `getSonicSimilarTracks` and `findSonicPath` endpoints unlock smarter, sound-based recommendations and playlists. One plugin that implements it is [AudioMuse-AI](https://redirect.github.com/NeptuneHub/AudioMuse-AI-NV-plugin). It also brings a major overhaul to playback reporting and the **Now Playing** experience — the UI now uses the new OpenSubsonic `playbackReport` extension, replacing the old scrobble flow with a redesigned panel and configurable reporting interval. On the security front, it hardens the server with stronger ownership and authorization checks across shares, players, and transcoding endpoints, caps concurrent transcodes to prevent ffmpeg-based denial of service, and adds an option to refuse to run as root. Smart playlists gain ReplayGain fields and new `isMissing`/`isPresent` operators, and there are five new UI themes to choose from. #### Security This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them. - Fix cross-account disclosure of other users' shares (incl. share tokens) by enforcing per-user ownership on share reads. ([1e7996f5d](https://redirect.github.com/navidrome/navidrome/commit/1e7996f5d), [GHSA-3g4p-jhv2-xrxf](https://redirect.github.com/navidrome/navidrome/security/advisories/GHSA-3g4p-jhv2-xrxf), reported by [@​Wernerina](https://redirect.github.com/Wernerina)) - Fix cross-tenant player takeover and share-update IDOR by enforcing ownership atomically on player and share updates. ([#​5563](https://redirect.github.com/navidrome/navidrome/pull/5563), [GHSA-x65f-m8x9-pjxm](https://redirect.github.com/navidrome/navidrome/security/advisories/GHSA-x65f-m8x9-pjxm) reported by [@​tonghuaroot](https://redirect.github.com/tonghuaroot); [GHSA-58gr-c777-g23p](https://redirect.github.com/navidrome/navidrome/security/advisories/GHSA-58gr-c777-g23p) reported by [@​lighthousekeeper1212](https://redirect.github.com/lighthousekeeper1212); [GHSA-wx2c-q8g7-4q5p](https://redirect.github.com/navidrome/navidrome/security/advisories/GHSA-wx2c-q8g7-4q5p) reported by [@​CE2Sec](https://redirect.github.com/CE2Sec)) - Fix unauthenticated Last.fm scrobble session hijack (IDOR) by requiring a signed state token on the link callback. ([#​5521](https://redirect.github.com/navidrome/navidrome/pull/5521), [GHSA-8jrh-w926-8rvw](https://redirect.github.com/navidrome/navidrome/security/advisories/GHSA-8jrh-w926-8rvw), reported by [@​geo-chen](https://redirect.github.com/geo-chen)) - Fix JWT expiration bypass on public share stream endpoints by validating token expiration and share existence. ([#​5426](https://redirect.github.com/navidrome/navidrome/pull/5426), [GHSA-3rfj-qx9q-jghx](https://redirect.github.com/navidrome/navidrome/security/advisories/GHSA-3rfj-qx9q-jghx), reported by [@​wooseokdotkim](https://redirect.github.com/wooseokdotkim)) - Fix disclosure of admin-only transcoding configuration to non-admin users by restricting transcoding config reads to admins. ([#​5564](https://redirect.github.com/navidrome/navidrome/pull/5564), [GHSA-4p3r-6362-833w](https://redirect.github.com/navidrome/navidrome/security/advisories/GHSA-4p3r-6362-833w), reported by [@​DavidCarliez](https://redirect.github.com/DavidCarliez)) - Fix missing admin authorization on internet radio station management endpoints by requiring admin access for Subsonic management endpoints. ([#​5510](https://redirect.github.com/navidrome/navidrome/pull/5510), [GHSA-jw24-qqrj-633c](https://redirect.github.com/navidrome/navidrome/security/advisories/GHSA-jw24-qqrj-633c), reported by [@​osageling](https://redirect.github.com/osageling)) - Cap concurrent transcodes to prevent an ffmpeg-based denial of service, with new per-server and per-user limits. ([#​5522](https://redirect.github.com/navidrome/navidrome/pull/5522) by [@​deluan](https://redirect.github.com/deluan)) - Add `EnforceNonRootUser` option to exit early if Navidrome is started as root. ([#​5373](https://redirect.github.com/navidrome/navidrome/pull/5373) by [@​kopf](https://redirect.github.com/kopf)) - Split HTML sanitization from plaintext handling. ([7e083e079](https://redirect.github.com/navidrome/navidrome/commit/7e083e079) by [@​deluan](https://redirect.github.com/deluan)) > **Note:** Several of the advisories linked above are still in **draft/triage** on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release. #### Configuration Changes | Status | Option | Description | Default | | ---------- | ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- | ------- | | New | `EnforceNonRootUser` | Exit early on startup if Navidrome is running as root (ignored on Windows). ([#​5373](https://redirect.github.com/navidrome/navidrome/pull/5373)) | `false` | | New | `Transcoding.MaxConcurrent` | Maximum number of concurrent transcodes server-wide (0 = unlimited). ([#​5522](https://redirect.github.com/navidrome/navidrome/pull/5522)) | `0` | | New | `Transcoding.MaxConcurrentPerUser` | Maximum number of concurrent transcodes per user (0 = unlimited). ([#​5522](https://redirect.github.com/navidrome/navidrome/pull/5522)) | `0` | | New | `Matcher.PreferStarred` | Bias the fuzzy matcher toward starred/high-rated tracks. ([#​5387](https://redirect.github.com/navidrome/navidrome/pull/5387)) | `true` | | New | `UIPlaybackReportInterval` | How often the UI reports playback progress. ([#​5448](https://redirect.github.com/navidrome/navidrome/pull/5448)) | `1m` | | Deprecated | `EnableTranscodingCancellation` → `Transcoding.EnableCancellation` | Renamed and moved under the new `Transcoding` section. ([#​5523](https://redirect.github.com/navidrome/navidrome/pull/5523)) | `false` | | Deprecated | `SimilarSongsMatchThreshold` → `Matcher.FuzzyThreshold` | Renamed and moved under the new `Matcher` section. ([#​5387](https://redirect.github.com/navidrome/navidrome/pull/5387)) | `85` | For a complete list of all configuration options, see the [Configuration Options](https://www.navidrome.org/docs/usage/configuration-options/) documentation. #### UI - Replace UI scrobble with `reportPlayback` and redesign the Now Playing panel. ([#​5448](https://redirect.github.com/navidrome/navidrome/pull/5448) by [@​deluan](https://redirect.github.com/deluan)) - Add Tokyo Night theme. ([#​5497](https://redirect.github.com/navidrome/navidrome/pull/5497) by [@​Metalhearf](https://redirect.github.com/Metalhearf)) - Add Catppuccin Latte theme. ([#​5250](https://redirect.github.com/navidrome/navidrome/pull/5250) by [@​lov3b](https://redirect.github.com/lov3b)) - Add Moonbase themes (Alpha light + Bravo dark). ([#​5243](https://redirect.github.com/navidrome/navidrome/pull/5243) by [@​craiglush](https://redirect.github.com/craiglush)) - Add a "Not Starred" filter option. ([#​5362](https://redirect.github.com/navidrome/navidrome/pull/5362) by [@​danielbanariba](https://redirect.github.com/danielbanariba)) - Add a Rescan button to the plugin list empty state. ([#​5471](https://redirect.github.com/navidrome/navidrome/pull/5471) by [@​deluan](https://redirect.github.com/deluan)) - Suppress capitalization and autocorrection for login on mobile keyboards. ([#​3783](https://redirect.github.com/navidrome/navidrome/pull/3783) by [@​bdefore](https://redirect.github.com/bdefore)) - Show album tile actions on keyboard focus. ([#​5434](https://redirect.github.com/navidrome/navidrome/pull/5434) by [@​danielbanariba](https://redirect.github.com/danielbanariba)) - Start a new album from track 1 after closing the player. ([#​5441](https://redirect.github.com/navidrome/navidrome/pull/5441) by [@​deluan](https://redirect.github.com/deluan)) - Prevent autoplay when clearing the play queue. ([#​5430](https://redirect.github.com/navidrome/navidrome/pull/5430) by [@​deluan](https://redirect.github.com/deluan)) - Fix Gruvbox Dark colors. ([#​5553](https://redirect.github.com/navidrome/navidrome/pull/5553) by [@​Tal0na](https://redirect.github.com/Tal0na)) - Update the AMusic theme to use the correct text color for primary confirmation buttons. ([#​5509](https://redirect.github.com/navidrome/navidrome/pull/5509) by [@​VirtualWolf](https://redirect.github.com/VirtualWolf)) #### Smart Playlists - Add ReplayGain fields to the criteria system. ([d9dac4445](https://redirect.github.com/navidrome/navidrome/commit/d9dac4445) by [@​deluan](https://redirect.github.com/deluan)) - Add `isMissing` and `isPresent` operators. ([#​5436](https://redirect.github.com/navidrome/navidrome/pull/5436) by [@​deluan](https://redirect.github.com/deluan)) - Relax playlist visibility in `inPlaylist`/`notInPlaylist` rules. ([#​5411](https://redirect.github.com/navidrome/navidrome/pull/5411) by [@​deluan](https://redirect.github.com/deluan)) - Optimize smart playlist performance for role and tag criteria. ([#​5515](https://redirect.github.com/navidrome/navidrome/pull/5515) by [@​deluan](https://redirect.github.com/deluan)) - Coerce string booleans in smart playlist rules. ([#​5450](https://redirect.github.com/navidrome/navidrome/pull/5450) by [@​deluan](https://redirect.github.com/deluan)) #### Subsonic API - Implement the `playbackReport` OpenSubsonic extension. ([#​5442](https://redirect.github.com/navidrome/navidrome/pull/5442) by [@​deluan](https://redirect.github.com/deluan)) - Add the `sonicSimilarity` extension as a plugin capability. ([#​5419](https://redirect.github.com/navidrome/navidrome/pull/5419) by [@​deluan](https://redirect.github.com/deluan)) - Add a `groupings` field to the OpenSubsonic Child response. ([f12e75aa1](https://redirect.github.com/navidrome/navidrome/commit/f12e75aa1) by [@​deluan](https://redirect.github.com/deluan)) - Use SQLite `RANDOM()` sorting in `getRandomSongs` for faster results. ([cf1f190bb](https://redirect.github.com/navidrome/navidrome/commit/cf1f190bb) by [@​deluan](https://redirect.github.com/deluan)) - Mark `AlbumID3` `songCount` and `created` as required. ([8897ec918](https://redirect.github.com/navidrome/navidrome/commit/8897ec918) by [@​deluan](https://redirect.github.com/deluan)) - Normalize non-NFKD Unicode letters (ø, æ, œ, ß) in search. ([#​5413](https://redirect.github.com/navidrome/navidrome/pull/5413) by [@​deluan](https://redirect.github.com/deluan)) #### Transcoding - Place `-ss` before `-i` for fast input seeking. ([#​5492](https://redirect.github.com/navidrome/navidrome/pull/5492) by [@​deluan](https://redirect.github.com/deluan)) - Don't apply server-side override on `getTranscodeDecision`. ([#​5473](https://redirect.github.com/navidrome/navidrome/pull/5473) by [@​deluan](https://redirect.github.com/deluan)) - Log a warning for invalid or stale transcode tokens. ([9a2eb483e](https://redirect.github.com/navidrome/navidrome/commit/9a2eb483e) by [@​deluan](https://redirect.github.com/deluan)) #### Scanner - Respect tag-split config when multiple frames map to the same tag. ([#​5193](https://redirect.github.com/navidrome/navidrome/pull/5193) by [@​trek-e](https://redirect.github.com/trek-e)) - Fix error when importing playlists without an admin user. ([5b85b2839](https://redirect.github.com/navidrome/navidrome/commit/5b85b2839) by [@​deluan](https://redirect.github.com/deluan)) #### Artwork - Fix stale cache and top-level album artwork for multi-disc albums. ([#​5457](https://redirect.github.com/navidrome/navidrome/pull/5457) by [@​deluan](https://redirect.github.com/deluan)) - Prefer album-root images over disc-subfolder images for multi-disc albums. ([#​5451](https://redirect.github.com/navidrome/navidrome/pull/5451) by [@​deluan](https://redirect.github.com/deluan)) - Return the correct timestamp when disc or album cover art changes. ([#​5378](https://redirect.github.com/navidrome/navidrome/pull/5378) by [@​bobo-xxx](https://redirect.github.com/bobo-xxx)) #### Server - Prevent artwork throttle token starvation on slow clients. ([#​5472](https://redirect.github.com/navidrome/navidrome/pull/5472) by [@​deluan](https://redirect.github.com/deluan)) - Proxy NowPlaying even when `ignoreScrobble` is set. ([#​5559](https://redirect.github.com/navidrome/navidrome/pull/5559) by [@​deluan](https://redirect.github.com/deluan)) - Make the `/api/song` path filter work and use `startsWith`. ([#​5566](https://redirect.github.com/navidrome/navidrome/pull/5566) by [@​deluan](https://redirect.github.com/deluan)) - Preserve unchanged fields on partial REST playlist updates. ([#​5542](https://redirect.github.com/navidrome/navidrome/pull/5542) by [@​deluan](https://redirect.github.com/deluan)) - Allow toggling playlist auto-import and avoid unnecessary artwork reloads. ([#​5421](https://redirect.github.com/navidrome/navidrome/pull/5421) by [@​deluan](https://redirect.github.com/deluan)) #### Matcher - Add `Matcher.PreferStarred` option to bias the fuzzy matcher toward starred/high-rated tracks. ([#​5387](https://redirect.github.com/navidrome/navidrome/pull/5387) by [@​deluan](https://redirect.github.com/deluan)) #### Plugins - Add `PlaybackReport` to the scrobbler capability. ([#​5452](https://redirect.github.com/navidrome/navidrome/pull/5452) by [@​deluan](https://redirect.github.com/deluan)) - Add `LibraryID` to `TrackInfo`. ([fd930eefd](https://redirect.github.com/navidrome/navidrome/commit/fd930eefd) by [@​deluan](https://redirect.github.com/deluan)) #### CLI - Add `pls export`/`import` subcommands for bulk playlist management. ([#​5412](https://redirect.github.com/navidrome/navidrome/pull/5412) by [@​deluan](https://redirect.github.com/deluan)) - Restore int cast for `syscall.Stdin` on Windows. ([e75ab3b03](https://redirect.github.com/navidrome/navidrome/commit/e75ab3b03) by [@​deluan](https://redirect.github.com/deluan)) #### Build & Dependencies - Improve Windows support: the Go test suite now runs on Windows CI, with previously-skipped Subsonic, artwork, watcher, and scheduler tests enabled and fixed. ([#​5380](https://redirect.github.com/navidrome/navidrome/pull/5380), [#​5427](https://redirect.github.com/navidrome/navidrome/pull/5427), [#​5416](https://redirect.github.com/navidrome/navidrome/pull/5416) by [@​deluan](https://redirect.github.com/deluan)) - Upgrade Go to 1.26. ([#​5361](https://redirect.github.com/navidrome/navidrome/pull/5361) by [@​deluan](https://redirect.github.com/deluan)) - Enable native libwebp encoding in the Docker image. ([#​5350](https://redirect.github.com/navidrome/navidrome/pull/5350) by [@​deluan](https://redirect.github.com/deluan)) - Update TagLib to 2.3. ([e55a35544](https://redirect.github.com/navidrome/navidrome/commit/e55a35544) by [@​deluan](https://redirect.github.com/deluan)) #### Translations - Add Estonian translation. ([725f6ab34](https://redirect.github.com/navidrome/navidrome/commit/725f6ab34) by [@​deluan](https://redirect.github.com/deluan)) - Update Indonesian translations from POEditor. ([#​5575](https://redirect.github.com/navidrome/navidrome/pull/5575) by [@​deluan](https://redirect.github.com/deluan)) - Update Spanish translations and add missing gain keys. ([#​5433](https://redirect.github.com/navidrome/navidrome/pull/5433) by [@​danielbanariba](https://redirect.github.com/danielbanariba)) - Update Basque localisation. ([#​5364](https://redirect.github.com/navidrome/navidrome/pull/5364) by [@​xabirequejo](https://redirect.github.com/xabirequejo)) - Update German, Finnish, Galician, Dutch, Slovak, Thai, and Chinese (traditional) translations from POEditor. ([#​5351](https://redirect.github.com/navidrome/navidrome/pull/5351) by [@​deluan](https://redirect.github.com/deluan)) - Update Serbian translation. ([#​5444](https://redirect.github.com/navidrome/navidrome/pull/5444) by [@​nenadjokic](https://redirect.github.com/nenadjokic)) - Update Traditional Chinese translation. ([#​5470](https://redirect.github.com/navidrome/navidrome/pull/5470) by [@​IEEE-754](https://redirect.github.com/IEEE-754)) - Complete Italian translation. ([#​5407](https://redirect.github.com/navidrome/navidrome/pull/5407) by [@​DanieleMassa](https://redirect.github.com/DanieleMassa)) #### New Contributors - [@​bdefore](https://redirect.github.com/bdefore) made their first contribution in [#​3783](https://redirect.github.com/navidrome/navidrome/pull/3783) - [@​craiglush](https://redirect.github.com/craiglush) made their first contribution in [#​5243](https://redirect.github.com/navidrome/navidrome/pull/5243) - [@​lov3b](https://redirect.github.com/lov3b) made their first contribution in [#​5250](https://redirect.github.com/navidrome/navidrome/pull/5250) - [@​danielbanariba](https://redirect.github.com/danielbanariba) made their first contribution in [#​5362](https://redirect.github.com/navidrome/navidrome/pull/5362) - [@​kopf](https://redirect.github.com/kopf) made their first contribution in [#​5373](https://redirect.github.com/navidrome/navidrome/pull/5373) - [@​bobo-xxx](https://redirect.github.com/bobo-xxx) made their first contribution in [#​5378](https://redirect.github.com/navidrome/navidrome/pull/5378) - [@​DanieleMassa](https://redirect.github.com/DanieleMassa) made their first contribution in [#​5407](https://redirect.github.com/navidrome/navidrome/pull/5407) - [@​nenadjokic](https://redirect.github.com/nenadjokic) made their first contribution in [#​5444](https://redirect.github.com/navidrome/navidrome/pull/5444) - [@​IEEE-754](https://redirect.github.com/IEEE-754) made their first contribution in [#​5470](https://redirect.github.com/navidrome/navidrome/pull/5470) - [@​Metalhearf](https://redirect.github.com/Metalhearf) made their first contribution in [#​5497](https://redirect.github.com/navidrome/navidrome/pull/5497) - [@​VirtualWolf](https://redirect.github.com/VirtualWolf) made their first contribution in [#​5509](https://redirect.github.com/navidrome/navidrome/pull/5509) - [@​Tal0na](https://redirect.github.com/Tal0na) made their first contribution in [#​5553](https://redirect.github.com/navidrome/navidrome/pull/5553) **Full Changelog**: #### Helping out This release is only possible thanks to the support of some **awesome people**! Want to be one of them? You can [sponsor](https://redirect.github.com/sponsors/deluan), pay me a [Ko-fi](https://ko-fi.com/deluan), or [contribute with code](https://www.navidrome.org/docs/developers/). #### Where to go next? - Read installation instructions on our [website](https://www.navidrome.org/docs/installation/). - Host Navidrome on [PikaPods](https://www.pikapods.com/pods/navidrome) for a simple cloud solution. - Reach out on [Discord](https://discord.gg/xh7j7yF), [Reddit](https://www.reddit.com/r/navidrome/) and [Twitter](https://twitter.com/navidrome)!
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). --- charts/stable/navidrome/Chart.yaml | 4 ++-- charts/stable/navidrome/values.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/stable/navidrome/Chart.yaml b/charts/stable/navidrome/Chart.yaml index 3f2f54901b9..09332c33e5d 100644 --- a/charts/stable/navidrome/Chart.yaml +++ b/charts/stable/navidrome/Chart.yaml @@ -9,7 +9,7 @@ annotations: trueforge.org/min_helm_version: "3.14" trueforge.org/train: stable apiVersion: v2 -appVersion: 0.61.2 +appVersion: 0.62.0 dependencies: - name: common version: 29.3.4 @@ -37,5 +37,5 @@ sources: - https://github.com/trueforge-org/truecharts/tree/master/charts/stable/navidrome - https://hub.docker.com/r/deluan/navidrome type: application -version: 23.4.0 +version: 23.5.0 diff --git a/charts/stable/navidrome/values.yaml b/charts/stable/navidrome/values.yaml index fb5ddd476fe..3d634271ce6 100644 --- a/charts/stable/navidrome/values.yaml +++ b/charts/stable/navidrome/values.yaml @@ -2,7 +2,7 @@ image: repository: docker.io/deluan/navidrome pullPolicy: IfNotPresent - tag: 0.61.2@sha256:9fa40b3d8dec43ceb2213d1fa551da3dcfef6ac6d19c2e534efb92527c2bafd2 + tag: 0.62.0@sha256:c4b5cb36a790b3eb63ca6a68bbe2fe149c2d7fa2e586f7a480e61db630e6664b workload: main: podSpec: