This release includes 1 security fix for security teams reviewing exposed deployments.
Affected surfaces
ReleasePort's take
Moderate signalThe release enforces login/PIN verification on websocket connections, eliminating a bypass vulnerability.
Why it matters: Security: severity 90 forces mandatory authentication for websockets; mitigates unauthorized access risk immediately.
Summary
AI summaryUpdates bug fixes, contributor PRs, and acoustid across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Enforces login/PIN check on websocket connections, closing bypass vulnerability. Enforces login/PIN check on websocket connections, closing bypass vulnerability. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Enables `&` as the artist separator for tag formatting (MusicBrainz/Picard style). Enables `&` as the artist separator for tag formatting (MusicBrainz/Picard style). Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Automatically selects Spotify when "spotify (no auth)" is the active metadata source. Automatically selects Spotify when "spotify (no auth)" is the active metadata source. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Adds download verification system with fingerprint checking (acoustid). Adds download verification system with fingerprint checking (acoustid). Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Feature | Low |
Persists verified/unverified status in database, file tag, and library history. Persists verified/unverified status in database, file tag, and library history. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Feature | Low |
Displays verification badge on Downloads completed list. Displays verification badge on Downloads completed list. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Feature | Low |
Introduces Unverified review queue for listening, approving, or deleting questionable downloads. Introduces Unverified review queue for listening, approving, or deleting questionable downloads. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Feature | Low |
Adds opt‑in import‑folder artist override with admin‑gated verification‑review endpoints. Adds opt‑in import‑folder artist override with admin‑gated verification‑review endpoints. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Performance | Low |
Caches artist→album lists for Deezer, iTunes, and Discogs, speeding up artist page reloads. Caches artist→album lists for Deezer, iTunes, and Discogs, speeding up artist page reloads. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Adds Relocate option to retag and move mismatched files to staging for correct re‑import. Adds Relocate option to retag and move mismatched files to staging for correct re‑import. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Makes cancel, reset, and delete operations on ListenBrainz weekly playlists idempotent to clear wedged states. Makes cancel, reset, and delete operations on ListenBrainz weekly playlists idempotent to clear wedged states. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Fixes torrent metadata stalls by correctly applying stall timeout despite DHT noise. Fixes torrent metadata stalls by correctly applying stall timeout despite DHT noise. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Low |
Allows `/` or `:` in titles to match sources that use `_` instead, fixing mismatched source lookup. Allows `/` or `:` in titles to match sources that use `_` instead, fixing mismatched source lookup. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Low |
Prevents service‑worker cover‑art cache from hard‑failing on first load. Prevents service‑worker cover‑art cache from hard‑failing on first load. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fixes Discogs master/release ID collision to fetch the correct album. Fixes Discogs master/release ID collision to fetch the correct album. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Handles interrupted Deezer fetches so partial discographies are not cached. Handles interrupted Deezer fetches so partial discographies are not cached. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Cleans out dead or timed‑out torrents from the client instead of orphaning them. Cleans out dead or timed‑out torrents from the client instead of orphaning them. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Refactor | Low |
Unifies import and scan processes to share core normalize() and evaluate() logic. Unifies import and scan processes to share core normalize() and evaluate() logic. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Refactor | Low |
Lifts history‑path resolver to a tested core for safer delete operations. Lifts history‑path resolver to a tested core for safer delete operations. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Refactor | Low |
Unifies import and scan to prevent disagreement between flagged paths and imported files. Unifies import and scan to prevent disagreement between flagged paths and imported files. Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
Full changelog
2.7.1
bug-fix + hardening pass on top of 2.7.0 — a download verification/review system, a real security fix for the login bypass, and a stack of issue fixes.
download verification & review (the headline)
every download now gets fingerprint-checked (acoustid) against what you actually asked for, and the result sticks:
- verified / unverified status persisted three ways — db, a
SOULSYNC_VERIFICATIONfile tag, andlibrary_history— and shown as a badge on the Downloads completed list. - import + scan share one core now (the same
normalize()+evaluate()PASS/SKIP/FAIL logic), so the two stop disagreeing — no more one path flagging what the other imported, and no false-flagging across scripts. - new Unverified review queue: listen, compare, approve, or delete the questionable downloads, with visible retry progress. mutating actions are admin-only.
security: login bypass closed (#852)
safari's "hide distracting items" (and devtools, curl, etc.) could remove the login/PIN overlay and get in — because the gate was http-only and the websocket handshake wasn't gated, so live data still streamed to an unauthenticated client. now the socket connection enforces the same login/PIN check the http side does. audited every other surface too (SSE, data, admin, search, audio-stream) — all already gated; the socket was the one hole. covers both the launch PIN and the native login.
bug fixes
- #704 — acoustid retag was ineffective: it fixed a mismatched file's tags but left it in the wrong artist/album folder. new Relocate option retags it and moves it to staging so auto-import re-files it correctly.
- #702 — listenbrainz weekly playlists could wedge in an unrecoverable sync state ("youtube playlist not found" on cancel). cancel / reset / delete are now idempotent, so a wedged playlist clears and you can re-sync.
- torrents — magnets stuck "downloading metadata" now actually hit the stall timeout (the byte counter's DHT noise was resetting the clock forever), and dead/timed-out torrents get cleaned out of the client instead of orphaned + re-grabbed as duplicates.
- #851 — a
/or:in a title now matches sources that use_(slash-title vs underscore-source mismatch). - #840 — you can pick
&as the artist separator for tags (musicbrainz/picard style). - search — auto-selects spotify when "spotify (no auth)" is your active metadata source (they're the same thing).
contributor PRs
- #845 — opt-in import-folder artist override (+ admin-gated the verification-review endpoints, lifted the history-path resolver to a tested core for delete-safety).
- #848 — discogs master/release ID collision was fetching the wrong album.
- #850 — service-worker cover-art cache no longer hard-fails on first load.
- #853 — artist pages load way faster on reopen: deezer / itunes / discogs now cache the artist→album list like spotify already did, instead of refetching the whole discography every time (+ follow-up: an interrupted deezer fetch can't cache a partial discography).
Security Fixes
- CVE‑SOU‑2025‑001 — Fixed login bypass by enforcing PIN/login check on websocket handshakes (issue #852)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]