Skip to content

ampache

v7.10.0 Breaking

This release includes 3 breaking changes for platform teams planning a safe upgrade.

Published 5d Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

auth deps

Summary

AI summary

Broad release touches 7.10.0, https://ampache.org/docs/information/which-zip, https://github.com/Gregwar/Captcha, and update_art.

Full changelog

7.10.0

php8.5
23a901b397e9958c6b942e81a17896da ./ampache-7.10.0_all_php8.5.zip
580306d1e28473d5ba824d89215d0934 ./ampache-7.10.0_all_php8.5_squashed.zip
151af1b0d34c8a6a5709ed50112f95d1 ./ampache-7.10.0_all_php8.5_client.zip

php8.4
93bac7bd4774a6d2498c8c7e29c23b77 ./ampache-7.10.0_all_php8.4.zip
ad9477ee9705ef2c47ccff70a056ccd6 ./ampache-7.10.0_all_php8.4_squashed.zip
8672f7c6c414539f1dd830e971be4d3d ./ampache-7.10.0_all_php8.4_client.zip

php8.3
a3ad7a88e5447d630b17bf4e1a319aa6 ./ampache-7.10.0_all_php8.3.zip
4b2952728060c87aa886d6333930fb41 ./ampache-7.10.0_all_php8.3_squashed.zip
8bf6a8009a6b8b01419d632a3b910abc ./ampache-7.10.0_all_php8.3_client.zip

php8.2
086476c2e67eae060e86b002cd9184eb ./ampache-7.10.0_all_php8.2.zip
e5ca4d4aed53cd61bbbc3b63fd4b44ce ./ampache-7.10.0_all_php8.2_squashed.zip
568d7856bf49c8a44e35b61f4f887feb ./ampache-7.10.0_all_php8.2_client.zip

UNSUPPORTED Code only release. (Requires composer and npm install)
7cfd3ac2360d0b1ceb2b46764fb1843c ./ampache-7.10.0_public.zip
08d6ce4801d1448959f7f2eb52a04ec3 ./ampache-7.10.0_squashed.zip
82a189ebdf56b26a21ba6ed7b6f4c425 ./ampache-7.10.0_client.zip

Zip Version information

If you aren't familiar which the project make sure you know which zip you need to download.

Ampache 7.10.0

This release replaces the old captcha implementation (including OCR/image testing behavior) with the new gregwar/captcha library.

See: Gregwar/Captcha

Added (7.10.0)

  • Database
    • Allow downgrade path from Ampache8
  • Search
    • Allow filtering by Catalog ID outside of search rules
  • Ampache Remote Catalogs
    • Added support for Ampache8 servers
    • Default remote API version set to API6
  • API
    • Allow API key authorization via request headers
    • Backport strict typing in API classes

Changed (7.10.0)

  • Backport gregwar/captcha from Ampache8 to replace legacy easy_captcha
  • Update Composer and NPM packages
  • Update Vite to address known security issues
  • Rename function get_artist_fullname to get_parent_fullname
  • Updated REST htaccess rules
  • Rework the media deletion process to speed up Catalog cleaning
  • Log playback attempts for disabled media
  • Ampache Remote Catalogs
    • Don't verify remote songs on every catalog update
  • Subsonic
    • Search3 rules and grouping behavior updated to better match Subsonic client expectations
  • API
    • REST command/path handling updates
    • Validation for flag now uses UserFlag::is_valid()
    • Validation for rate now uses Rating::is_valid()
    • update_art: Existing art is replaced unless you send overwrite=0
    • Parameters sent with an empty value (e.g. filter=) are treated as missing

Removed (7.10.0)

  • Remove easy_captcha classes and files
  • Remove API8 from Ampache 7 codebase
  • Do not count map tables in Catalog::update_counts() calls
  • Delete scrutinizer.yml and other external integration remnants

Fixed (7.10.0)

  • AlbumDisk::check() returned the album id instead of the new album_disk id, so new songs stored the wrong song.album_disk
  • AlbumDisk::check() read disk from a collision lookup that never selected it, so songs kept the old disk number when edited
  • AlbumDisk::check() matched disksubtitle in the collision lookup, which never matches a null and returned the wrong id
  • Beets catalog clean deleted the first song of the list even though the file still existed
  • Art export truncated art files that had already been exported
  • Album art export left an empty art file in the album folder when there was no image to write
  • Skips were not counted on media that had never been fully played
  • Debug page printed secret_key, api secrets and additional passwords in plain text
  • Last.fm error responses were treated as a success, causing a runtime error when reading artist or album info
  • Web player controls were clipped out of view and unclickable outside the embedded player
  • Browser notifications stopped the play handler outside the embedded player, skipping media session and ReplayGain
  • Share Public URL column was empty for shares that only allow streaming
  • Broadcasts could not play because broadcasts are not Media
  • Throw login exception on missing auth when authentication is required
  • Potential error during filesystem scan
  • Missing closing HTML tags in templates
  • Validate Podcast URL is HTTP(S) when set
  • SQL error in Playlist::get_items() when the playlist contains non-song objects
  • Set stream type and handle missing catalog when building stream URLs
  • Database
    • Database update 794004: handle additional leftover bad data
  • CLI
    • Fix table-check column typo in DatabaseCharsetUpdater
  • Search
    • Fix joins where catalog_id was not set for some search paths
  • Upload
    • Check upload Artist against the upload user and create the Artist when missing
  • Ampache Remote Catalogs
    • Scan tags correctly on new file import
    • Fix playback for songs using stream action
    • Catch XML parsing/object resolution errors when Song cannot be found
  • Subsonic
    • Fix errors when fromYear and toYear are missing
    • Remove HTML encoding in ArtistInfo calls
    • HTML decode image URLs in OpenSubsonic responses
  • API
    • API6: Correct version bump handling
    • List responses were not sliced by offset and limit in some XML/JSON methods
    • Version and response inconsistencies between API versions
    • Backport API3-6 fixes from Ampache8 (REST path resolution, user_preference, localplay and version rollover)

API 6.9.2 Build 2

This version is being released for Ampache7 only

To ensure that there are no issues with clients checking for single int versions
we will keep on 6.9.x and resume build number versioning until Ampache 8

NOTE API8 has been removed from the codebase for Ampache 7.

Added (692002)

  • ALL
    • Allow APIKey Authorization header
    • REST command and path changes
  • REST
    • catalogs/{catalog_id}/add, clean, update and verify as aliases of catalog_action with the matching task
  • API6
    • Add time to all Playlist and Smartlist responses

Changed (692002)

  • ALL
    • flag: Use the UserFlag::is_valid() function for object type validation
    • rate: Use the Rating::is_valid() function for object type validation
    • parameter_exists: Parameters sent with an empty value (e.g. filter=) are treated as missing
  • update_art (API4, API5 and API6)
    • Existing art is replaced unless you send overwrite=0
  • API6
    • Error messages are no longer translated

Removed (692002)

  • API8 will not be used in Ampache 7 releases

Fixed (692002)

  • ALL
    • Version and docstring inconsistencies between API versions
    • Empty object lookups now report the parameter that failed instead of empty
    • A version lower than 3 (e.g. version=2) rolled up to no version at all instead of the oldest enabled one
    • democratic: vote returns the real vote count for each song. It was counted from the item's position in the response instead of its track_id, so the number was meaningless
    • friends_timeline: An empty result returned a total_count/md5 envelope that neither the populated response nor timeline uses. It now returns activity: []
  • API5 and API6
    • labels, label: XML serialised each item as <license> instead of <label>
    • search_rules: XML emitted an empty <widget/> for every rule that isn't a select, dropping the control type the JSON response carries
  • REST
    • preferences/{preference_name} returned the whole preference list and ignored the name
    • POST {type}/{id}/share resolved to share (fetch a share) instead of share_create
  • API4
    • update_from_tags: Not found check was inverted so valid objects returned an error
    • XML list responses were not sliced by offset and limit (e.g. users)
  • API5
    • get_bookmark: Not found check was inverted so valid objects returned an error
    • XML list responses were not sliced by offset and limit (e.g. bookmarks, users)
    • album: A missing or empty filter reported an empty Bad Request: message with the wrong error type
  • API6
    • Version wasn't bumped
    • podcast_episode: JSON response was missing the full episode object
    • XML and JSON list responses were not sliced by offset and limit
    • user_preference: Returned the system value instead of the calling user's preference
    • catalog_action: Not found error didn't name the catalog id
    • localplay: status could fail on controllers that don't report repeat and random
    • playlists, smartlists: api_hidden_playlists was ignored when set to 0
    • playlists: JSON time could be a string instead of an integer
    • shares: An empty result was keyed shares instead of share like the populated response (API5 was already correct)
    • last_shouts: An empty result returned a total_count/md5 envelope the populated response does not use. It now returns shout: [] (API5 was already correct)

Breaking Changes

  • Removed `easy_captcha` classes and files
  • Renamed function `get_artist_fullname` to `get_parent_fullname`
  • Removed API8 from Ampache 7 codebase

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track ampache

Get notified when new releases ship.

Sign up free

About ampache

A web based audio/video streaming application and file manager allowing you to access your music & videos from anywhere, using almost any internet enabled device.

All releases →

Beta — feedback welcome: [email protected]