navidrome/navidrome v0.44.0

on GitHub

As promised, more security improvements: Passwords are now encrypted in the DB. The encryption key used can be overridden by the new config option PasswordEncryptionKey. See more details here: https://www.navidrome.org/docs/usage/security/#encrypted-passwords

ATTENTION: Please backup your DB before upgrading, as passwords will be encrypted when first running 0.44.0, and if you need to downgrade for any reason, old versions of Navidrome won't be able to read the passwords!

Also, you can now use a SSO/OAuth/OIDC proxy (like Authelia or Vouch) in front of Navidrome, to handle authentication. Thanks @ajgon!

And last but not least: Last.fm scrobbling is here! Users can opt-in by going to their Personal menu in the UI, and it can also be disabled for specific players if needed. Thanks @srichter!

Navidrome now uses a shared API-Key for Last.fm, so now Last.fm integrations (including scrobbling) work out of the box, but you can still override the API-Key with your own if you want to.

BREAKING CHANGE: The Native API URLs were changed:

/app/login => /auth/login
/app/createAdmin => /auth/createAdmin
/app/api/* => /api/*

If you use a script that connects directly with Navidrome, please check/change the URLs.

Highlights

• [UI] Auto update current view when there are changes in the DB (new albums, ratings/playCount changes, etc) (#1025)
• [UI] Prompt the user to refresh the page if server is using a version different then the UI, to keep both in sync after an upgrade
• [UI] Move Artists/Songs/Playlist to top level, removing "Library" submenu
• [UI] Show Disc Subtitles even if the album has only one disc (#947)
• [UI] Allow themes to override the React Player styling. Fixed colors for Dark, ExtraDark and Light themes
• [UI] New option to disable album cover animation in UI (save a few CPU cycles): EnableCoverAnimation (#1185)
• [Server] Last.fm scrobbling! Must be authorized by the user, and can be disable by player (or completely disabled) (#1202) Thanks @srichter!
• [Server] Last.fm integration now uses a shared API-Key, so Artist's bios, TopSongs, SimilarArtists and scrobbling work out of the box
• [Server] New option LastFM.Enabled (default true) allows disabling Last.fm integration completely
• [Server] Passwords are encrypted in the DB, with an option to override the encryption key used (#1187)
• [Server] Reverse Proxy Authentication, allowing setting up SSO, OAuth and other authentication schemas (#1152) Thanks @ajgon!
• [Server] Better SimilarSongs algorithm, prioritizing songs per popularity
• [Subsonic API] Fix /rest/updatePlaylist not updating fields comment and public.
• [Subsonic API] Fix /rest/getNowPlaying endpoint only returning one player/user
• [Subsonic API] GetCoverArt returns placeholder if id is missing, mimicking Subsonic behaviour

Changelog

b16d473 Update es.json (POEditor.com)
fd82b8f Default for EnableCoverAnimation in dev mode is true
a73f885 Add option to disable album cover animation in the player. Closes #1185
167fe46 Addresses a bug that would prevent users from changing their own passwords, introduced as part of #1187. (#1214)
cb1827c Update translations (#1134)
25f0e11 Add 'AlbumArtist' column to SongList
292cf99 Add 'Year' column to Album and Playlists song list
d2fcab7 Fix ND_DEVFASTACCESSCOVERART flag not available as env var
94533e5 Add tests to /scrobble endpoint
6dd3837 Add referential integrity to remove user's props when user is deleted
26bcf0b Enable Last.fm scrobbling by default (still requires user's authorization)
92634a7 Only show message after 2 seconds, giving time for the browser to close it first
ee21f39 Pass userId explicitly to UserPropsRepository methods
a155107 Add a hacky way to style the react-player.
823fef8 Fix JS console error
82105c3 Remove React.Strict mode
b684a47 Show DiscSubtitle even if the album has only one disc.
da2334e Remove submenu "Library". Relates to #430
4853760 Suppress logs of successful DB migrations applied when running for the first time
0cbb0ac Skip songs with less than 31 seconds, as per Last.fm specification
5040f6f Fix label
abe8015 Add option to disable external scrobbling per player
5001518 Move user properties (like session keys) to their own table
265f33e Remove clearServiceWorkerCache, not needed anymore. (#1205)
99be844 Disable completely external scrobblers if feature is disabled (DevEnableScrobble)
f4ddd20 Send the time the track started playing when scrobbling
056f0b9 Refactor: Consolidate scrobbling logic in play_tracker
76acd7d Don't send scrobbles/nowPlaying updates to Last.fm if user has not authorized
8af7dab Fix wrong warning about ignored NowPlaying
a7509c9 Send NowPlaying and Scrobbles to Last.fm
d5461d0 Refactor Agents to be singleton
f9fa966 Show user-friendly message when error occurs in Last.fm callback endpoint
5fbfd9c Implement Last.fm account linking UI
8b62a58 Remove limitation of only scrobbling tracks longer than 30 seconds
743e469 Use singleton in other places as well
1f99735 Expose Last.fm's ApiKey to UI
143cde3 Implement Last.FM Web authentication flow
502a719 Implement Last.FM Desktop Auth flow endpoints
8ee5c1f Initial Last.fm UI implementation
0495e42 Fix Last.fm API method signature
ffa76bb Add flag to disable Scrobble config in the UI
a4f91b7 Add Last.FM Authentication methods
73e1a8f Remove false-positive on new version detection
877f01b Show notification if server is updated
47bcf71 Fix cookie warning
197d430 Fix lint error
4e1957c Update Go dependencies
25db2cb Add concurrency test for singleton
80b2c2f Try to register all playing music in GetNowPlaying
97434c1 Fix GetNowPlaying endpoint showing only the last play
f8ee6db New implementation of NowPlaying
0df0ac0 Add logos to badges
c09468e Option to allow auto-login during development.
cf553ce Don't show "logout" when authenticated by Header
31ea033 Fix subsonic token when authenticating by Header
66b74c8 Encrypt passwords in DB (#1187)
d42dfaf Add username to request.Context
84413b5 Bump @testing-library/jest-dom from 5.13.0 to 5.14.1 in /ui (#1176)
b590c31 Fix stream url, after changes to subsonic client api
c4623d7 Don't show "empty" dates
e0fd1c6 Add "Last Played" column to SongList
86271f0 Optimize refresh events for scrobble endpoint
fb7229a Refech using getMany, reducing the number of API calls
521d1ff Disable realip middleware when using the reverse proxy authentication feature
d3db41a Bump github.com/go-chi/httprate version
8bf0089 Bump github.com/ReneKroon/ttlcache/ and github.com/microcosm-cc/bluemonday versions
b65e762 Only send events to clients who need it
5f6f74f Always use httpClient to call APIs
8383527 Only refetch changed resources when receive a "refreshResource" event
8a56584 Removed the albumSong workaround, as React-Admin's cache seems to behave better now
667701b Less warning messages when first running it.
59b99d2 No need to check for first time when authenticating. One less SQL call per request
d54129e Rename app package to nativeapi
03efc48 Refactor routing, changes API URLs (#1171)
bed2f01 Fix index of songs in downloaded playlist
6bd4c0f Reverse proxy authentication support (#1152)
b445cdd Use a dedicated api-key/secret pair for Last.FM
e31802d Only send "refresh" event if SetRating was successful
cefc939 Trigger UI refresh on media annotation events: star, setRating and scrobble
2afb2db Refactor for readability
7f85ecd Trigger a UI refresh when the scanner finds changes.
cb6aa49 Bump github.com/lestrrat-go/jwx from 1.2.0 to 1.2.1 (#1167)
b7f47c8 Bump github.com/onsi/ginkgo from 1.16.3 to 1.16.4 (#1163)
adb09c9 Bump @testing-library/jest-dom from 5.12.0 to 5.13.0 in /ui (#1162)
0c9e0ff Bump prettier from 2.3.0 to 2.3.1 in /ui (#1161)
f9eec5e Refactored agents calling into its own struct
6c1ba8f Add tests to core.Share
110e17b Make MockRepo names more consistent
779571a go mod tidy
af210c8 Add Native Sharing REST API (#1150)
e80cf80 Move all Spotify and LastFM code into only one folder for each
182e3ec Update zh-Hans.json (#1160)
65ccd4c Parse ParamBool case-insensitively (#1151)
bebfe29 Allow updating only specific columns
9da9d73 Don't panic when taglib returns an error
cd24269 Foundational work to enable multi-valued tags
519c893 Omit empty fields from Native API responses
336d891 Bump github.com/ReneKroon/ttlcache/v2 from 2.5.0 to 2.6.0
9b4b28f Bump ginkgo/gomega versions
39c560a Remove unused web-vitals package
c5abdc1 Fix recursive bug in Last.FM calls without mbid
ead2095 Respect EnableLogRedacting config when pretty printing configuration
7b05c49 Add devEnableShare config option (#1141)
327c259 Create share table and repository. (#930)
675cbe1 Fix updatePlaylist not updating fields comment and public.
91a91f7 GetCoverArt returns placeholder if id is missing
7bbb09e Add tests for WeightedRandomChooser
dd56a77 Rename variable with conflicting name
a38e478 Better SimilarSongs algorithm
1940267 Handle functions with params in sort order.
01f3ce0 Add a timeout to background task
48b6fa7 Don't use request's context when refreshing artist info in background
25d62cd Set retention time for uploaded artifacts to 7 days
ed01946 Embed Last.FM error responses, making the tests faster
89b12b3 Retry calls to Last.FM without MBIDs when if returns artist invalid (#1138)
4e0177e Always update artist info, even if info is fresh
b398053 Include a shared Last.FM api key, providing zero conf ArtistInfo (bio/top songs/similar artists)
db11b6b Remove decoration from reflex output
60d50de Refactoring to make common components usage more uniform
0941fbc Fix lag on albumList toggling (#1136)
4217c75 Upgrade to Node v16
409020a Bump github.com/ReneKroon/ttlcache/v2 from 2.4.0 to 2.5.0
b4832c3 Bump github.com/golangci/golangci-lint from 1.40.0 to 1.40.1
1de7366 Bump @material-ui/lab from 4.0.0-alpha.57 to 4.0.0-alpha.58 in /ui
ab1bc61 Bump @testing-library dependencies
ad4db12 Bump hosted-git-info from 2.8.8 to 2.8.9 in /ui (#1111)
200b815 Bump url-parse from 1.4.7 to 1.5.1 in /ui (#1107)
5631493 Upgrade Web UI to Create-React-App 4 and React 17 (#1105)