jellyfin/jellyfin-mpv-shim v3.3.0

v3.3: [Security] Fix eMudhra TLS bypass, add special features support

on GitHub

This release updates the certificate bundles to distrust the compromised eMudhra CA. Without it, anyone could intercept HTTPS requests to your Jellyfin server until 2039. The release was tested against mitmproxy --emudhra to confirm both mpv and python reject the certificate.

Security:

• Fix eMudhra TLS bypass via compromised CA.
  • For PyPI users, jellyfin-mpv-shim takes a hard dependency against certifi>=2026.10.19, to ensure you also get the fix.

Additional Changes:

• Add Special Features for movies and TV shows (#759)
• Fixed a second player window opening when restoring from minimized (#828)
• The app now exits cleanly if the player cannot be restarted.
• The Trailer button only appears when the server has a trailer.
• Add a More menu to detail pages with Refresh Metadata (#764)
• Delete from Disk moved into the More menu.
• Improve button UX and update Elegance theme (#839, #840)
• Fix invalid regex throwing, windows direct paths, credential file perms, handle nullable settings (pokke#1)

When upgrading/installing on Linux via PyPI, use:

pip install --upgrade "jellyfin-mpv-shim[all]"

You can also install on Linux via Flathub.

About testing: The end-to-end test suite now has a faster light tier for use during development, and the release gate still runs the full suite on both mpv backends on Linux and Windows.

About Windows Downloads:

• If your CPU is older than roughly 2013 or you get a 0xc0000142 error you need to use the LEGACY64 build.
• You do not need administrator rights to install the software.
• You can avoid warnings on files by unblocking the file in the properties dialog.
• You may need to disable Smart App Control if unblocking via Properties does not work.

Development was assisted using AI.