This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
Affected surfaces
ReleasePort's take
Moderate signalVersion v2.3.0 introduces several new features (free music downloads, import purchases, where‑to‑buy links) and enhances security by removing the audio‑source plugin capability.
Why it matters: The removal of audio-source plugin capability (severity 80) eliminates a high‑risk vector for unauthorized acquisition sources; developers and SREs should audit existing plugins against this change.
Summary
AI summaryUpdates New Features, Docs & Chores, and v2.3.0 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Removes audio-source plugin capability to prevent plugins from being acquisition sources. Removes audio-source plugin capability to prevent plugins from being acquisition sources. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | Medium |
Enforces no-bundled-sources and no-P2P-protocol promises in CI. Enforces no-bundled-sources and no-P2P-protocol promises in CI. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | Medium |
Adds contributor licence agreement requirement for pull requests. Adds contributor licence agreement requirement for pull requests. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds free music feature downloading Creative Commons and public-domain releases. Adds free music feature downloading Creative Commons and public-domain releases. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds import purchases functionality for zip or loose files into library. Adds import purchases functionality for zip or loose files into library. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds where-to-buy links on album and artist pages, ordered by artist payout fairness. Adds where-to-buy links on album and artist pages, ordered by artist payout fairness. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds experimental plugin API for scrobblers and purchase-link providers. Adds experimental plugin API for scrobblers and purchase-link providers. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Updates repo URLs and Docker images to point at DroppedNeedle organisation. Updates repo URLs and Docker images to point at DroppedNeedle organisation. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Low |
Fixes YouTube player to stay within Google's embed policies as a 200x200 pop-out. Fixes YouTube player to stay within Google's embed policies as a 200x200 pop-out. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
v2.3.0 (2026-07-11)
Breaking Changes
None.
New Features
- Free Music. A lawful source that ships with the app. It downloads Creative Commons and public-domain releases from the Internet Archive, with the licence shown before anything downloads. No account or API key, on by default, one toggle in Settings turns it off. Requests now work out of the box even with no download client configured.
- Import your purchases. Drop a zip or loose files onto your home page or the Downloads Import tab. They're identified by the scanner's pipeline (MusicBrainz tags, then AcoustID), tagged, organised into your library, and any matching request is resolved. A better-quality copy upgrades in place; anything unidentified waits under "Needs a match". Admin and trusted users can import.
- Where to buy. Album and artist pages now list where to buy, from MusicBrainz purchase links with iTunes and Bandcamp fallbacks. Stores are ordered by how fairly they pay artists, Bandcamp first. Optional affiliate tags (Amazon, Apple, Qobuz) earn the project a small commission at no cost to you, with a disclosure line and a Settings toggle to turn it off.
- An experimental plugin API. Third parties can add scrobblers and purchase-link providers, installed from a GitHub URL or the plugins folder. Plugins run in-process with no sandbox, so read the code before enabling. No plugin can download music. Full reference in PLUGINS.md.
Fixes
- The YouTube player now stays inside Google's embed policies: a fixed 200x200 pop-out, visible while it plays, no background playback.
Security
- The no-bundled-sources and no-P2P-protocol promises are now enforced in CI, and the audio-source plugin capability was removed so plugins can't be an acquisition source.
- OIDC PKCE is now an independent implementation, and a contributor licence agreement was added for pull requests.
Docs & Chores
- Repo URLs and Docker images now point at the DroppedNeedle organisation, with legacy habirabbu tags kept on stable releases so older installs still update.
Security Fixes
- Enforced in CI that no bundled music sources or P2P protocols are included; removed audio‑source plugin capability to prevent acquisition via plugins.
- YouTube player now complies with Google's embed policies: fixed 200x200 pop‑out, visible during playback, no background play.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]