ampache

v7.9.6 Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 1d Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

deps breaking_upgrade

ReleasePort's take

Light signal

editorial:auto 20h

Release 7.9.6 updates Composer and NPM dependencies while adding new PHPStan rules, fixing several bugs, and expanding API8 capabilities.

Why it matters: Updating Composer and NPM dependencies addresses potential supply‑chain risks; added PHPStan rules raise analysis strictness by ~40 severity points.

Summary

AI summary

Broad release touches download, 7.9.6, update_art, and stream.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Add more rules to phpstan analysis Add more rules to phpstan analysis Source: llm_adapter@2026-06-03 Confidence: high	—
Feature	Medium	Add API8 method playlist_remove to remove items from a playlist Add API8 method playlist_remove to remove items from a playlist Source: llm_adapter@2026-06-03 Confidence: high	—
Feature	Medium	Introduce typing for `array<mixed>` JSON objects in API8 Introduce typing for `array<mixed>` JSON objects in API8 Source: llm_adapter@2026-06-03 Confidence: high	—
Feature	Medium	Allow `search_songs` to use `rule_1_input` across search methods in API6 and API8 Allow `search_songs` to use `rule_1_input` across search methods in API6 and API8 Source: llm_adapter@2026-06-03 Confidence: high	—
Dependency	Low	Update Composer and NPM dependencies Update Composer and NPM dependencies Source: llm_adapter@2026-06-03 Confidence: high	—
Deprecation	Medium	Deprecate playlist_remove_song method in API8 (use playlist_remove) Deprecate playlist_remove_song method in API8 (use playlist_remove) Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Deprecation	Medium	Mark several parameters for removal in future API9 version Mark several parameters for removal in future API9 version Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix
Bugfix	Medium	Fix missing `latest_version` parameter on debug page Fix missing `latest_version` parameter on debug page Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Correct handling of unset Art `id` error Correct handling of unset Art `id` error Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Fix playlist collaborator checks improperly exploding ints Fix playlist collaborator checks improperly exploding ints Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Ensure updatePlaylist ownership is checked in Subsonic integration Ensure updatePlaylist ownership is checked in Subsonic integration Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Handle missing `start` in StructuredLyrics XML properly Handle missing `start` in StructuredLyrics XML properly Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Low	Correct type listing of `format` parameter as int in download and stream APIs Correct type listing of `format` parameter as int in download and stream APIs Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix	Low	Fix docstring indicating `overwrite` mandatory for update_art Fix docstring indicating `overwrite` mandatory for update_art Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix	Low	Correct casting of preference object `id` to string Correct casting of preference object `id` to string Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix	Low	Prevent forced string prefix when null is expected Prevent forced string prefix when null is expected Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix	Low	Avoid inserting video objects into double video arrays Avoid inserting video objects into double video arrays Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix	Low	Fix incorrect double filtering of JSON lists in API6 causing result splicing issues Fix incorrect double filtering of JSON lists in API6 causing result splicing issues Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix	Low	Route album, albums, podcast_delete, and podcast_episodes outputs to appropriate JSON8 classes Route album, albums, podcast_delete, and podcast_episodes outputs to appropriate JSON8 classes Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix	Low	Correct type listing of `format` parameter as int in download endpoint for API6 Correct type listing of `format` parameter as int in download endpoint for API6 Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Bugfix	Low	Fix toggle_follow logic using incorrect username handling Fix toggle_follow logic using incorrect username handling Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Other	Medium	Remove `get_indexes` method from API8 Remove `get_indexes` method from API8 Source: granite4.1:30b@2026-06-03-audit Confidence: low	—
Other	Medium	Remove `user_update` method from API8 Remove `user_update` method from API8 Source: granite4.1:30b@2026-06-03-audit Confidence: low	—

Full changelog

7.9.6

php8.5
6c970e48d6773e905af5145d0067b304 ./ampache-7.9.6_all_php8.5.zip
19b6f4d4ffbfaf319cb5d32285870114 ./ampache-7.9.6_all_php8.5_squashed.zip
cf316930f61456d89225e66acb609d2d ./ampache-7.9.6_all_php8.5_client.zip

php8.4
d87d06fe3e4fc0355b7f36480fe3983d ./ampache-7.9.6_all_php8.4.zip
c801be48ae6e58f711f4d1428510a5ee ./ampache-7.9.6_all_php8.4_squashed.zip
c8fa083b4cd9839a2f6b836a558de542 ./ampache-7.9.6_all_php8.4_client.zip

php8.3
5e0ff4c2cb75417aad766b2cf6cf892c ./ampache-7.9.6_all_php8.3.zip
719fcc4689de1cebcb83ccabb8bc98ab ./ampache-7.9.6_all_php8.3_squashed.zip
d0252a1a7dad0bed7d333acc77ada2c0 ./ampache-7.9.6_all_php8.3_client.zip

php8.2
235c30c68a6544990b37da4955048246 ./ampache-7.9.6_all_php8.2.zip
0f6ca47a124fccac867f1ab25218ad0f ./ampache-7.9.6_all_php8.2_squashed.zip
1e109079b17f07dbfe1d181ef94d0e57 ./ampache-7.9.6_all_php8.2_client.zip

UNSUPPORTED Code only release. (Requires composer and npm install)
e17b32fbc32a7760386bf873ddf4d453 ./ampache-7.9.6_public.zip
afa0e3362a3296a17a707c52f86b210d ./ampache-7.9.6_squashed.zip
48b7adf5f137701df7b67c03bfbe4b1e ./ampache-7.9.6_client.zip

Zip Version information

If you aren't familiar which the project make sure you know which zip you need to download.

Ampache 7.9.6

Fixes to changes on the backend and a few issues found during code analysis

Changed (7.9.6)

Update Composer and NPM dependencies
Add more rules to phpstan

Fixed (7.9.6)

Parameter latest_version missing on debug page
Art id error when unset
Playlist collaborator checks not exploding ints properly
Subsonic
- updatePlaylist ownership not being checked
- StructuredLyrics value when missing start in XML

API 6.9.2 Build 1

This version is being released for Ampache7 only

To ensure that there are no issues with clients checking for single int versions
we will keep on 6.9.x and resume build number versioning until Ampache 8

NOTE API8 has been added to the code but is not enabled for use.

Added (692001)

API8
- New Method: playlist_remove (remove items from a playlist)
- Typing for array<mixed> JSON objects
- Let search_songs use rule_1_input to match other search methods
API6
- Let search_songs use rule_1_input to match other search methods

Changed (692001)

API8
- Method playlist_remove_song is deprecated and will be removed in API9 (Use playlist_remove)
- Deprecated parameters that will be removed in API9
  - catalog_action: parameter catalog, use filter
  - catalog_file: parameter catalog, use filter
  - catalog_folder: parameter catalog, use filter
  - flag: parameter id, use filter
  - rate: parameter id, use filter
  - record_play: parameter id, use filter
  - update_art: parameter id, use filter
  - update_artist:_info parameter id, use filter
  - update_from_tags: parameter id, use filter
  - url_to_song: parameter url, use filter
  - download: parameter id, use filter
  - get_art: parameter id, use filter
  - stream: parameter id, use filter
  - localplay: parameter oid, use filter
  - last_shouts: parameter username, use filter
  - timeline: parameter username, use filter
  - user_delete: parameter username, use filter
  - user_edit: parameter username, use filter
- Optional parameters
  - playlist_add: Use 'song' as default type

Fixed (692001)

ALL
- download: Type for format listed as int
- stream: Type for format listed as int
- update_art: Docstring had overwrite as mandatory
- preference object id not cast to string
- forced string for prefix when it should be null
- video objects being inserted into double video arrays
API6
- JSON lists could be doubl filtered incorrectly splicing results
- album, albums, podcast_delete and podcast_episodes output sent to JSON8 classes
- download: Type for format listed as int
- toggle_follow using incorrect logic for username

Removed (692001)

API8
- Remove get_indexes
- Remove playlist_add_song
- Remove user_update

Breaking Changes

API8 method playlist_add_song removed
API8 endpoint get_indexes removed

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ampache

Get notified when new releases ship.

About ampache

A web based audio/video streaming application and file manager allowing you to access your music & videos from anywhere, using almost any internet enabled device.

All releases →