Skip to content

lms

v3.79.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 8d Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

audio audio-streaming listenbrainz music music-player music-server
+8 more
music-streaming musicbrainz opensubsonic raspberry-pi self-hosted sonic-analysis subsonic subsonic-server

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 8d

Version v3.79.0 removes the `api-subsonic-support-password-auth` and `api-subsonic-old-server-protocol-clients` options from lms.conf.

Why it matters: Deprecation severity 70 triggers removal of these two configuration flags; operators must update lms.conf before upgrade to avoid runtime errors.

Summary

AI summary

Removed two configuration options from lms.conf.

Changes in this release

Security Critical

Validates podcast URLs and probes artwork before saving (GHSA-g32g-vh4m-v482)

Validates podcast URLs and probes artwork before saving (GHSA-g32g-vh4m-v482)

Source: llm_adapter@2026-07-18

Confidence: high

 —
Feature Low

Adds support for work/movements #834

Adds support for work/movements #834

Source: llm_adapter@2026-07-18

Confidence: high

 —
Feature Low

Adds legacy md5 auth token authentication for Subsonic API #865

Adds legacy md5 auth token authentication for Subsonic API #865

Source: llm_adapter@2026-07-18

Confidence: high

 —
Feature Low

Album name search now also searches disc subtitles #698

Album name search now also searches disc subtitles #698

Source: llm_adapter@2026-07-18

Confidence: high

 —
Deprecation High

Removes `api-subsonic-support-password-auth` and `api-subsonic-old-server-protocol-clients` options from lms.conf

Removes `api-subsonic-support-password-auth` and `api-subsonic-old-server-protocol-clients` options from lms.conf

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Medium

Fixes 'remember me' login option for multiple LMS instances on same host #867

Fixes 'remember me' login option for multiple LMS instances on same host #867

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Medium

Fixes bad UTF8 name truncations #861

Fixes bad UTF8 name truncations #861

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Medium

Does not report bit depth if transcoded stream is lossless in OpenSubsonic API

Does not report bit depth if transcoded stream is lossless in OpenSubsonic API

Source: llm_adapter@2026-07-18

Confidence: high

 —
Bugfix Medium

Fixes `.lmsignore` sometimes not being taken into account #868

Fixes `.lmsignore` sometimes not being taken into account #868

Source: llm_adapter@2026-07-18

Confidence: low

 —
Bugfix Medium

Improves "play next" behavior #864

Improves "play next" behavior #864

Source: llm_adapter@2026-07-18

Confidence: low

 —
Bugfix Low

Ensures `.lmsignore` is always taken into account #868

Ensures `.lmsignore` is always taken into account #868

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

 —
Bugfix Low

Corrects PCM to be treated as a lossless codec in OpenSubsonic API

Corrects PCM to be treated as a lossless codec in OpenSubsonic API

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

 —
Full changelog

Updates:

  • Added support for work/movements #834

  • Subsonic API:

    • Added support for the legacy md5 auth token authentication to ease compatibility #865
      The lms.conf options api-subsonic-support-password-auth and api-subsonic-old-server-protocol-clients have been removed.

  • Searching albums by name also search in disc subtitles #698

  • Improved the "play next" behavior #864

Bugfixes:

  • Validate podcast URLs and probe artwork before saving https://github.com/epoupon/lms/security/advisories/GHSA-g32g-vh4m-v482
  • Fixed 'remember me' login option for several LMS instances on the same host #867
  • Fixed .lmsignore sometimes not taken into account #868
  • Fixed bad UTF8 name truncations #861
  • OpenSubsonic API:
    • Do not report bit depth if the transcoded stream is lossless
    • Fixed PCM incorrectly considered as a lossy codec

Breaking Changes

  • `api-subsonic-support-password-auth` removed from `lms.conf`
  • `api-subsonic-old-server-protocol-clients` removed from `lms.conf`

Security Fixes

  • GHSA-g32g-vh4m-v482 — Validate podcast URLs and probe artwork before saving to prevent security issues
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track lms

Get notified when new releases ship.

Sign up free

About lms

Lightweight Music Server. Access your self-hosted music using a web interface.

All releases →

Related context

Beta — feedback welcome: [email protected]