Musicseerr

v1.4.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

self-hosted listenbrainz music musicbrainz

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 1mo

The release adds multi‑user authentication and PKCE support for OIDC logins.

Why it matters: Enabling PKCE (S256) for OIDC login follows OAuth 2.1 best practices, improving security of the authentication system.

Summary

AI summary

Updates New Features, Performance, and @OmarB97 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Enables PKCE (S256) for OIDC login, following OAuth 2.1 best practices. Enables PKCE (S256) for OIDC login, following OAuth 2.1 best practices. Source: llm_adapter@2026-06-14 Confidence: high	—
Feature	Medium	Adds multi-user authentication with local login, registration, and session management. Adds multi-user authentication with local login, registration, and session management. Source: llm_adapter@2026-06-14 Confidence: high	—
Feature	Low	Adds mobile app foundations: bottom tab bar, iOS standalone metadata, safe‑area padding. Adds mobile app foundations: bottom tab bar, iOS standalone metadata, safe‑area padding. Source: llm_adapter@2026-06-14 Confidence: high	—
Performance
Performance	Low	Caches full‑library Lidarr scans for one hour instead of five minutes. Caches full‑library Lidarr scans for one hour instead of five minutes. Source: llm_adapter@2026-06-14 Confidence: high	—
Performance	Low	Reduces backend memory usage over time via capped glibc arenas and LRU‑bounded now‑playing tracking. Reduces backend memory usage over time via capped glibc arenas and LRU‑bounded now‑playing tracking. Source: llm_adapter@2026-06-14 Confidence: high	—
Performance	Low	Loads large playlists faster by resolving album sources concurrently. Loads large playlists faster by resolving album sources concurrently. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Medium	Fixes player getting stuck at 0:00 when tapping a Navidrome track. Fixes player getting stuck at 0:00 when tapping a Navidrome track. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Medium	Removes duplicate entries from library search results. Removes duplicate entries from library search results. Source: llm_adapter@2026-06-14 Confidence: high	—

Full changelog

v1.4.0 (2026-06-14)

Breaking Changes

None.

New Features

#62, #90 - Multi-user authentication is here. This has been one of the most long-awaited features in MusicSeerr since its release... and it's finally here. Local login, registration, and session management are all in, along with Plex, Jellyfin, and OIDC login flows. A public allowlist keeps things flexible for who can sign up. Huge thanks to @jma1ice for building the entire auth backend. It's an amazing piece of work that so many of you asked for.
#85 - The app now has the very first foundations to allow it to work like a real phone app. There's a bottom tab bar, proper iOS standalone metadata for Add to Home Screen, safe-area padding, and the player respects mobile spacing (@OmarB97)
#88 - OIDC login now supports PKCE (S256). Public clients that don't have a secret work out of the box, and everything follows OAuth 2.1 best practices (@gossip31)

Fixes

#71 - The logo and nav padding now shrink down nicely on small screens so nothing overflows on mobile (fixes #70) (@halsandr)
#84 - Tapping a Navidrome track no longer leaves the player stuck at 0:00. Playback kicks off straight away instead of silently waiting for a canplay event that might never show up (@OmarB97)
#91 - Duplicate entries are gone from library results (fixes #80) (@HabiRabbu)
#92 - Large playlists load faster now because album sources resolve concurrently instead of one at a time (@HabiRabbu)

Performance

#83 - Full-library Lidarr scans now cache for an hour instead of 5 minutes. Browsing a big library no longer kicks off expensive scans over and over (@OmarB97)
#93 - The backend uses less memory over time thanks to capped glibc arenas, periodic malloc_trim, and LRU-bounded now-playing tracking. The server stays lean during long listening sessions (@HabiRabbu)

Security

#88 - OIDC login now uses PKCE (S256), following OAuth 2.1 recommendations for all client types (@gossip31)

Docs & Chores

#67 - Fixed the broken Tubifarry link in the README (fixes #64) (@millionjt)

Some new infra experimentation is going on behind the scenes also to make things a bit more organised, which is always nice.

Security Fixes

OIDC login uses PKCE (S256), aligning with OAuth 2.1 recommendations for all client types

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Musicseerr

Get notified when new releases ship.

About Musicseerr

Music request and discovery for Lidarr

All releases →