This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
ReleasePort's take
Moderate signalVersion v9.3.0 adds a Guest role that permits playback while disallowing uploads.
Why it matters: The new Guest role directly impacts user access control; deployments of v9.3.0 must evaluate its effect on existing permission models.
Summary
AI summaryIntroduced a Guest role that can play but not upload.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
introduce a Guest role that can play but not upload introduce a Guest role that can play but not upload Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
support FrankenPHP, bump default upload limit to 512M support FrankenPHP, bump default upload limit to 512M Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
list only album artists on the Artists screen list only album artists on the Artists screen Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
save and load custom equalizer presets save and load custom equalizer presets Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
store user-generated images under storage/app/public/images store user-generated images under storage/app/public/images Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Deprecation | Medium |
drop select, local-storage, compare-versions, and md5 drop select, local-storage, compare-versions, and md5 Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Deprecation | Medium |
drop koel/dotenv-editor in favor of in-house service drop koel/dotenv-editor in favor of in-house service Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
cast favorite attribute to boolean across favoriteable models cast favorite attribute to boolean across favoriteable models Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
keep search index in sync with post-scan mass-deletes keep search index in sync with post-scan mass-deletes Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
redirect guests to / and log proxy-auth failure modes redirect guests to / and log proxy-auth failure modes Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
skip native draggable on touch devices for reliable context menu skip native draggable on touch devices for reliable context menu Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
show sensible error when upload response body is not JSON show sensible error when upload response body is not JSON Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
show newly uploaded songs in album and artist screens show newly uploaded songs in album and artist screens Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
collapse UserPreferences into polymorphic Preference hierarchy collapse UserPreferences into polymorphic Preference hierarchy Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Refactor | Medium |
organize Services/ into feature subfolders organize Services/ into feature subfolders Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Refactor | Medium |
collapse Util facade into App\Helpers\Encoding\Bom collapse Util facade into App\Helpers\Encoding\Bom Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Refactor | Medium |
reduce lodash usage in the frontend reduce lodash usage in the frontend Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
drop the color package in favor of isDarkColor helper drop the color package in favor of isDarkColor helper Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
consolidate window globals under window.KOEL consolidate window globals under window.KOEL Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Other | Medium |
move SongStorageType enum tests to tests/Unit move SongStorageType enum tests to tests/Unit Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Other | Medium |
silence two prod-build CSS warnings (tailwind-v4) silence two prod-build CSS warnings (tailwind-v4) Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
What's Changed
- refactor: reduce lodash usage in the frontend by @phanan in https://github.com/koel/koel/pull/2444
- chore: drop select, local-storage, compare-versions, and md5 by @phanan in https://github.com/koel/koel/pull/2445
- fix: cast favorite attribute to boolean across favoriteable models by @phanan in https://github.com/koel/koel/pull/2446
- chore: drop the color package in favor of a small isDarkColor helper by @phanan in https://github.com/koel/koel/pull/2447
- chore: drop koel/dotenv-editor in favor of an in-house service by @phanan in https://github.com/koel/koel/pull/2448
- feat: introduce a Guest role that can play but not upload by @phanan in https://github.com/koel/koel/pull/2450
- fix: keep search index in sync with post-scan mass-deletes by @phanan in https://github.com/koel/koel/pull/2452
- fix: skip native draggable on touch devices so context menu fires reliably by @phanan in https://github.com/koel/koel/pull/2453
- fix: redirect guests to / and log proxy-auth failure modes by @phanan in https://github.com/koel/koel/pull/2454
- feat: list only album artists on the Artists screen by @phanan in https://github.com/koel/koel/pull/2455
- feat: save and load custom equalizer presets by @phanan in https://github.com/koel/koel/pull/2456
- refactor: collapse UserPreferences into a polymorphic Preference hierarchy by @phanan in https://github.com/koel/koel/pull/2457
- refactor: organize Services/ into feature subfolders by @phanan in https://github.com/koel/koel/pull/2458
- test: move SongStorageType enum tests to tests/Unit by @phanan in https://github.com/koel/koel/pull/2459
- fix: show a sensible error when an upload's response body is not JSON by @phanan in https://github.com/koel/koel/pull/2461
- fix: show newly uploaded songs in their album and artist screens by @phanan in https://github.com/koel/koel/pull/2462
- refactor: consolidate window globals under window.KOEL by @phanan in https://github.com/koel/koel/pull/2464
- refactor: collapse Util facade into App\Helpers\Encoding\Bom by @phanan in https://github.com/koel/koel/pull/2465
- fix(tailwind-v4): silence two prod-build CSS warnings by @phanan in https://github.com/koel/koel/pull/2467
- feat: support FrankenPHP, bump default upload limit to 512M by @phanan in https://github.com/koel/koel/pull/2475
- feat: store user-generated images under storage/app/public/images by @phanan in https://github.com/koel/koel/pull/2479
Full Changelog: https://github.com/koel/koel/compare/v9.2.1...v9.3.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]