This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+8 more
Affected surfaces
Summary
AI summaryBroad release touches https://github.com/deluan, UI, Subsonic API, and Smart Playlists.
Full changelog
Navidrome 0.63 brings a long-awaited upgrade to lyrics: full support for synced sidecar lyrics in multiple formats (TTML, ELRC, SRT, YAML and LRC), including word-by-word karaoke timing and multi-voice (agent) layers, exposed to clients through the new OpenSubsonic v2 lyrics extensions. A huge shoutout to @ranokay, who not only contributed the code for these lyrics enhancements, but also helped shape the OpenSubsonic extension specification behind them. Search also gets noticeably smarter: exact matches now rank above prefix matches (searching for "MØ" brings MØ to the top instead of burying it), and artists with short or non-ASCII names that were previously unfindable now show up correctly.
The other big theme of this release is performance for large libraries and offline-first clients. Full-library synchronization via search3 (the way clients like Symfonium mirror the whole library) is now flat at every offset instead of degrading with depth, roughly 30-50x faster at deep offsets and about 20x faster for a complete sync on a ~1M-track library, and a related pagination-integrity fix eliminates the duplicate and short pages that could corrupt those syncs. Alongside it, getRandomSongs is about 13x faster on the same library size, and a batch of database improvements (annotation-index-friendly smart playlist filters, leaner list-count queries, and new composite indexes for album/artist song sorts) makes everyday operations anywhere from ~9x to ~160x faster. Finally, a heads-up on a behavior change: sharing is now enabled by default, and can be turned off with EnableSharing=false.
Security
- Enforce per-library access on playlist import and sharing paths. In multi-library setups, three read paths did not consistently apply per-library restrictions: M3U import path resolution, shared-playlist track loading, and public share-scoped streams. A user with access to only some libraries could resolve or be served tracks from libraries they weren't assigned to. All three now respect the user's (or share owner's) library access. (#5640 by @deluan)
- Resolve symlinks to their real target when classifying files during scan, preventing symlinked entries from being misclassified. (ecba19a08 by @deluan)
Configuration Changes
| Status | Option | Description | Default |
|--------|--------|-------------|---------|
| New | Scanner.ArtistSplitExceptions | List of artist names that must never be split by tag separators (e.g. "Tyler, The Creator"). (#5701) | [] (empty) |
| New | Scanner.IgnoreDotFolders | Whether to skip folders whose name starts with a dot when scanning. Set to false to index dot-prefixed folders. (#5568) | true |
| Changed | EnableSharing | Sharing is now enabled by default. Set to false to restore the previous behavior. (#5714) | true |
| Changed | LyricsPriority | New sidecar lyrics formats added to the default priority list. (#5076) | .ttml,.yaml,.yml,.elrc,.lrc,.srt,.txt,embedded |
For a complete list of all configuration options, see the Configuration Options documentation.
Lyrics
- Add structured sidecar lyrics support with OpenSubsonic v2 karaoke cues and agent layers: TTML, ELRC, SRT and YAML sidecar files are now parsed with word-by-word timing and multi-voice information. (#5076 by @ranokay)
- Allow lyrics plugins to return lyrics in any supported format, not just LRC. (#5632 by @deluan)
- Keep the player's lyrics in sync on track change and seek, so the previous song's lyrics no longer linger. (7303c9ca4 by @deluan)
Search
- Rank exact matches above prefix matches in search results. (#5704 by @deluan)
- Fix artists with short or non-ASCII names being unfindable after the FTS5 search migration. (#5703 by @deluan)
UI
- Add Rosé Pine themes. (#5664 by @draconivis)
- Fix transient jump to a wrong song when switching tracks in the web player. (#5676 by @deluan)
- Fix profile self-edits not reporting success or failure. (#5699 by @deluan)
- Fix Nautiline theme font and width on mobile devices. (#5590 by @devBoi76)
- Fix
DefaultLanguagenot being applied on app startup. (#4000 by @deluan)
Scanner
- Add
Scanner.ArtistSplitExceptionsto protect artist names from being split by tag separators. (#5701 by @deluan) - Add
Scanner.IgnoreDotFoldersto allow indexing dot-prefixed folders. (#5568 by @deluan) - Fix playlists not being imported when the first scan runs before any admin user exists. (#5609 by @deluan)
Subsonic API
- Add OpenSubsonic work and movement attributes, improving classical music metadata for compatible clients. (#5659 by @deluan)
- Speed up
getRandomSongson large libraries with two-phase random selection, about 13x faster on a 1M-track library. (#5618 by @deluan) - Speed up artist
search3pagination at deep offsets, roughly 5-8x faster on a 300K-artist library. (#5620 by @deluan) - Speed up
search3empty-query (browse-all) pagination: response times are now flat at any offset, 30-50x faster at deep offsets, making a full ~1M-track library sync about 20x faster overall. (#5601 by @deluan) - Make "recently added" album order reproducible and consistent with the
RecentlyAddedByModTimesetting. (#5678 by @deluan)
Smart Playlists
- Extend
isMissing/isPresentoperators to BPM, bit depth and many text fields. (#5603 by @deluan) - Speed up smart playlists that filter on play count, rating or loved status, up to ~14x faster end-to-end (the underlying query alone is over 300x faster). (#5662 by @deluan)
- Speed up smart playlists with many negated artist/tag rules, ~160x faster on a real-world case with 120 rules on a 323K-track library. (#5607 by @deluan)
- Fix
isMissing/isPresentoperators on ReplayGain fields. (#5585 by @deluan)
Recommendations
- Match similar and top songs across all artists credited on a track, improving results for collaborations. (#5668 by @deluan)
- Match ListenBrainz top songs for collaborations using all credited artist MBIDs. (#5670 by @deluan)
- Speed up top/similar song matching with batched lookups, up to ~14x faster on large batches. (#5635 by @deluan)
- Fix song matching to use artist credits, so artist-MBID specificity works and collaborators match correctly. (#5637 by @deluan)
Plugins
- Add a
navidrome pluginCLI for managing and inspecting plugins. (#5682 by @deluan) - Expose the song Matcher as a host service for plugins. (#5643 by @deluan)
- Share plugin DTOs via a common types package, simplifying plugin development. (#5655 by @deluan)
Artwork
- Speed up image resizing and WebP encoding/decoding, up to ~30% faster with far fewer allocations. (#5652 by @deluan)
- Fix artist folder images being incorrectly served as album art. (#5596 by @deluan)
- Fix WebP crash on 32-bit ARM; WebP encoding is now disabled by default in Docker images. (#5606 by @deluan)
Transcoding
- Preserve source metadata when transcoding downloads. (#5628 by @deluan)
- Enforce server-side player
MaxBitRateon all stream paths. (#5611 by @deluan) - Honor the player's forced transcoding format in the web UI playback flow. (#5613 by @deluan)
- Fix partially-written transcodes being served from the cache after a server crash. (#5657 by @deluan)
Server
- Enable sharing by default. (#5714 by @deluan)
- Fix direct
log.Logcalls not honoringDevLogLevels. (#5700 by @kgarner7)
Database
- Speed up song sorting by album and artist with new sort-order indexes, ~19x faster on large libraries on a cold cache. (#5706 by @deluan)
- Skip library filtering when a non-admin user has access to all libraries, making song counts ~19x faster on a 920K-track database. (#5696 by @deluan)
- Skip unnecessary annotation joins when counting items, up to ~9x faster list counts, with even larger gains on a cold cache. (#5694 by @deluan)
- Make
PRAGMA optimizeerrors non-fatal at startup. (bd3192be0 by @deluan)
Translations
New Contributors
- @ranokay made their first contribution in #5076
- @devBoi76 made their first contribution in #5590
- @draconivis made their first contribution in #5664
Full Changelog: https://github.com/navidrome/navidrome/compare/v0.62.0...v0.63.0
Helping out
This release is only possible thanks to the support of some awesome people!
Want to be one of them?
You can sponsor, pay me a Ko-fi, or contribute with code.
Where to go next?
Breaking Changes
- Sharing is now enabled by default; set `EnableSharing=false` to disable.
Security Fixes
- Enforce per‑library access on playlist import, shared‑playlist track loading, and public share‑scoped streams to prevent cross‑library data leakage (GHSA issue).
- Resolve symlinks during file classification to avoid misclassification of symlinked entries.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]