music-assistant/server 2.10.0.dev2026070906

2.10.0 NIGHTLY 2026070906

on GitHub

📦 Nightly Release

Changes since 2.10.0.dev2026070805

🚀 New Providers

• Add Profiler provider for on-demand performance diagnostics (by @marcelveldt in #4653)

🚀 Features and enhancements

• Add diagnostics feature (by @marcelveldt in #4652)
• Add fixed genres to Phish.in tracks (by @OzGav in #4659)
• Add join code expiry lookup to auth controller (by @marcelveldt in #4663)
• Add virtual player support to the Sendspin provider (by @marcelveldt in #4666)
• Add support for sound effect media items (by @marcelveldt in #4669)
• Add convenience API for providers to send custom events to clients (by @marcelveldt in #4670)

🐛 Bugfixes

• Improve global search reliability and database query parameter logic (by @SyedaAnshrahGillani in #4207)
• Fix XSS and cross-host request issues in MSX Bridge web player (by @MarvinSchenkel in #4562)
• Advertise both IP families via mDNS and respect a specific bind IP when publishing (by @OzGav in #4646)
• Prevent admin token leak to untrusted return_url during first-run setup (by @MarvinSchenkel in #4649)
• Fix several bugs in the Jellyfin provider (by @OzGav in #4654)
• Fix Plex artist albums not loading on servers without filter metadata (by @OzGav in #4657)
• Don't auto-sync all Phish.in playlists to the library (by @OzGav in #4660)
• Block long-lived token creation for guest accounts (by @MarvinSchenkel in #4661)
• Harden MSX bridge against host-header XSS and cross-origin fetches (by @MarvinSchenkel in #4662)

🎨 Frontend Changes

• Show track BPM and musical key on the track details page (by @MarvinSchenkel in #2034)

Other Changes

• Add CodSpeed performance benchmarks and CI integration (by @codspeed-hq[bot] in #4656)

🧰 Maintenance and dependency bumps

🙇 Thanks to our contributors

Special thanks to the following contributors who helped with this release:

@MarvinSchenkel, @OzGav, @SyedaAnshrahGillani, @codspeed-hq[bot], @marcelveldt