This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
Summary
AI summaryBroad release touches 7.10.0, https://ampache.org/docs/information/which-zip, https://github.com/Gregwar/Captcha, and update_art.
Full changelog
7.10.0
php8.5
23a901b397e9958c6b942e81a17896da ./ampache-7.10.0_all_php8.5.zip
580306d1e28473d5ba824d89215d0934 ./ampache-7.10.0_all_php8.5_squashed.zip
151af1b0d34c8a6a5709ed50112f95d1 ./ampache-7.10.0_all_php8.5_client.zip
php8.4
93bac7bd4774a6d2498c8c7e29c23b77 ./ampache-7.10.0_all_php8.4.zip
ad9477ee9705ef2c47ccff70a056ccd6 ./ampache-7.10.0_all_php8.4_squashed.zip
8672f7c6c414539f1dd830e971be4d3d ./ampache-7.10.0_all_php8.4_client.zip
php8.3
a3ad7a88e5447d630b17bf4e1a319aa6 ./ampache-7.10.0_all_php8.3.zip
4b2952728060c87aa886d6333930fb41 ./ampache-7.10.0_all_php8.3_squashed.zip
8bf6a8009a6b8b01419d632a3b910abc ./ampache-7.10.0_all_php8.3_client.zip
php8.2
086476c2e67eae060e86b002cd9184eb ./ampache-7.10.0_all_php8.2.zip
e5ca4d4aed53cd61bbbc3b63fd4b44ce ./ampache-7.10.0_all_php8.2_squashed.zip
568d7856bf49c8a44e35b61f4f887feb ./ampache-7.10.0_all_php8.2_client.zip
UNSUPPORTED Code only release. (Requires composer and npm install)
7cfd3ac2360d0b1ceb2b46764fb1843c ./ampache-7.10.0_public.zip
08d6ce4801d1448959f7f2eb52a04ec3 ./ampache-7.10.0_squashed.zip
82a189ebdf56b26a21ba6ed7b6f4c425 ./ampache-7.10.0_client.zip
Zip Version information
If you aren't familiar which the project make sure you know which zip you need to download.
Ampache 7.10.0
This release replaces the old captcha implementation (including OCR/image testing behavior) with the new gregwar/captcha library.
See: Gregwar/Captcha
Added (7.10.0)
- Database
- Allow downgrade path from Ampache8
- Search
- Allow filtering by Catalog ID outside of search rules
- Ampache Remote Catalogs
- Added support for Ampache8 servers
- Default remote API version set to API6
- API
- Allow API key authorization via request headers
- Backport strict typing in API classes
Changed (7.10.0)
- Backport
gregwar/captchafrom Ampache8 to replace legacyeasy_captcha - Update Composer and NPM packages
- Update Vite to address known security issues
- Rename function
get_artist_fullnametoget_parent_fullname - Updated REST htaccess rules
- Rework the media deletion process to speed up Catalog cleaning
- Log playback attempts for disabled media
- Ampache Remote Catalogs
- Don't verify remote songs on every catalog update
- Subsonic
- Search3 rules and grouping behavior updated to better match Subsonic client expectations
- API
- REST command/path handling updates
- Validation for
flagnow usesUserFlag::is_valid() - Validation for
ratenow usesRating::is_valid() - update_art: Existing art is replaced unless you send
overwrite=0 - Parameters sent with an empty value (e.g.
filter=) are treated as missing
Removed (7.10.0)
- Remove
easy_captchaclasses and files - Remove API8 from Ampache 7 codebase
- Do not count map tables in
Catalog::update_counts()calls - Delete
scrutinizer.ymland other external integration remnants
Fixed (7.10.0)
AlbumDisk::check()returned the album id instead of the new album_disk id, so new songs stored the wrongsong.album_diskAlbumDisk::check()readdiskfrom a collision lookup that never selected it, so songs kept the old disk number when editedAlbumDisk::check()matcheddisksubtitlein the collision lookup, which never matches a null and returned the wrong id- Beets catalog clean deleted the first song of the list even though the file still existed
- Art export truncated art files that had already been exported
- Album art export left an empty art file in the album folder when there was no image to write
- Skips were not counted on media that had never been fully played
- Debug page printed
secret_key, api secrets and additional passwords in plain text - Last.fm error responses were treated as a success, causing a runtime error when reading artist or album info
- Web player controls were clipped out of view and unclickable outside the embedded player
- Browser notifications stopped the play handler outside the embedded player, skipping media session and ReplayGain
- Share
Public URLcolumn was empty for shares that only allow streaming - Broadcasts could not play because broadcasts are not
Media - Throw login exception on missing auth when authentication is required
- Potential error during filesystem scan
- Missing closing HTML tags in templates
- Validate Podcast URL is HTTP(S) when set
- SQL error in
Playlist::get_items()when the playlist contains non-song objects - Set stream type and handle missing catalog when building stream URLs
- Database
- Database update
794004: handle additional leftover bad data
- Database update
- CLI
- Fix table-check column typo in
DatabaseCharsetUpdater
- Fix table-check column typo in
- Search
- Fix joins where
catalog_idwas not set for some search paths
- Fix joins where
- Upload
- Check upload Artist against the upload user and create the Artist when missing
- Ampache Remote Catalogs
- Scan tags correctly on new file import
- Fix playback for songs using stream action
- Catch XML parsing/object resolution errors when Song cannot be found
- Subsonic
- Fix errors when
fromYearandtoYearare missing - Remove HTML encoding in
ArtistInfocalls - HTML decode image URLs in OpenSubsonic responses
- Fix errors when
- API
- API6: Correct version bump handling
- List responses were not sliced by
offsetandlimitin some XML/JSON methods - Version and response inconsistencies between API versions
- Backport API3-6 fixes from Ampache8 (REST path resolution,
user_preference,localplayand version rollover)
API 6.9.2 Build 2
This version is being released for Ampache7 only
To ensure that there are no issues with clients checking for single int versions
we will keep on 6.9.x and resume build number versioning until Ampache 8
NOTE API8 has been removed from the codebase for Ampache 7.
Added (692002)
- ALL
- Allow APIKey Authorization header
- REST command and path changes
- REST
catalogs/{catalog_id}/add,clean,updateandverifyas aliases ofcatalog_actionwith the matchingtask
- API6
- Add
timeto all Playlist and Smartlist responses
- Add
Changed (692002)
- ALL
- flag: Use the
UserFlag::is_valid()function for object type validation - rate: Use the
Rating::is_valid()function for object type validation - parameter_exists: Parameters sent with an empty value (e.g.
filter=) are treated as missing
- flag: Use the
update_art(API4, API5 and API6)- Existing art is replaced unless you send
overwrite=0
- Existing art is replaced unless you send
- API6
- Error messages are no longer translated
Removed (692002)
- API8 will not be used in Ampache 7 releases
Fixed (692002)
- ALL
- Version and docstring inconsistencies between API versions
- Empty object lookups now report the parameter that failed instead of
empty - A
versionlower than 3 (e.g.version=2) rolled up to no version at all instead of the oldest enabled one - democratic:
votereturns the real vote count for each song. It was counted from the item's position in the response instead of itstrack_id, so the number was meaningless - friends_timeline: An empty result returned a
total_count/md5envelope that neither the populated response nortimelineuses. It now returnsactivity: []
- API5 and API6
- labels, label: XML serialised each item as
<license>instead of<label> - search_rules: XML emitted an empty
<widget/>for every rule that isn't a select, dropping the control type the JSON response carries
- labels, label: XML serialised each item as
- REST
preferences/{preference_name}returned the whole preference list and ignored the namePOST {type}/{id}/shareresolved toshare(fetch a share) instead ofshare_create
- API4
- update_from_tags: Not found check was inverted so valid objects returned an error
- XML list responses were not sliced by
offsetandlimit(e.g.users)
- API5
- get_bookmark: Not found check was inverted so valid objects returned an error
- XML list responses were not sliced by
offsetandlimit(e.g.bookmarks,users) - album: A missing or empty
filterreported an emptyBad Request:message with the wrong error type
- API6
- Version wasn't bumped
- podcast_episode: JSON response was missing the full episode object
- XML and JSON list responses were not sliced by
offsetandlimit - user_preference: Returned the system value instead of the calling user's preference
- catalog_action: Not found error didn't name the catalog id
- localplay:
statuscould fail on controllers that don't reportrepeatandrandom - playlists, smartlists:
api_hidden_playlistswas ignored when set to0 - playlists: JSON
timecould be a string instead of an integer - shares: An empty result was keyed
sharesinstead ofsharelike the populated response (API5 was already correct) - last_shouts: An empty result returned a
total_count/md5envelope the populated response does not use. It now returnsshout: [](API5 was already correct)
Breaking Changes
- Removed `easy_captcha` classes and files
- Renamed function `get_artist_fullname` to `get_parent_fullname`
- Removed API8 from Ampache 7 codebase
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About ampache
A web based audio/video streaming application and file manager allowing you to access your music & videos from anywhere, using almost any internet enabled device.
Related context
Related tools
Beta — feedback welcome: [email protected]