Skip to content

SoulSync

v3.1.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 3d Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Affected surfaces

auth rbac

Summary

AI summary

Updates choose your discography source, search by musicbrainz id, and reported fixes across a mixed release.

Full changelog

soulsync 3.1.5 — devmain

chat goes best-in-class, you choose which source paints your discographies — and can see what the other sources know — the wishlist learns artists and smarter retries, fix all runs in the background, and multi-user gets a real security pass.


chat

  • join ANY public soulseek room: a rooms rail with a full room browser (search, sort by users, join/leave), not just the soulsync room
  • the user list grew up: roles, sorting, and a local mute for users you don't want to hear from
  • browse any user's shared files right from chat and download them in place
  • search your whole message history, copy any message, and a redesigned composer (fused panel, ghost icon toolbar)

choose your discography source (thanks @ragnarlotus, #1068)

  • a new Library Discography Source setting (Settings → Metadata): primary, automatic fallback, or pin a specific source — it decides what paints library artists' discography pages
  • built on a typed provider-outcome rework, so an artist a source genuinely doesn't know shows as empty instead of an error, and fallback decisions are explicit

see what other sources know (#1067)

  • an "Other sources" view option on artist pages: releases OTHER metadata sources know but your current view doesn't, slotted into the real albums/eps/singles sections with their source marked
  • each gap release is downloadable from its own source, and Download Discography includes them
  • conservative dedup (title + year) against what the page already shows, plus a final check against your library-merged view. off by default, purely additive
  • plays with #1068: whatever source the setting picks as your base, gap-fill diffs against exactly that

wishlist: artist selection + smarter retries

  • select, download, or remove a whole artist's wishlist entries at once (#1065)
  • failed tracks carry real attempt counts now (they used to reset), back off progressively instead of retrying every cycle, and the auto-ignore TTL is configurable (thanks @javiavid)

search by musicbrainz id (thanks Jordan H)

  • paste a bare musicbrainz release id into search and it resolves straight to the release — lidarr-style exact lookups

tools: fix all grew up

  • fix all runs in the background with live progress and a stop button — a 5000-finding retag no longer times out the page while secretly still working (thanks pertti)
  • album tag consistency says exactly which albums it excluded and why (single-track, no stored file paths, no artist link) and warns when files weren't readable from soulsync's filesystem (thanks clouddead89)
  • findings page size is adjustable (30/60/100), and genre tag cleanup scans — and counts — the whole library (#1066)

multi-user hardening

  • profile isolation audit: profile-scoped apis verify ownership (no more reading another profile's data by id), deleting a profile sweeps every table that references it (derived from the schema so new tables can't be forgotten), and socket rooms derive from the session — one profile can't see or touch another's

reported fixes

  • singles and EPs no longer file as Albums when the metadata source carries no type signal (#1064)
  • the artist photo picker works on navidrome/jellyfin — text ids were being forced into ints (#1069)
  • enabling usenet in the download source priority survives a reload (thanks @Fl3m)
  • the music Manage Workers modal gets Retry All Failed (video parity)
  • video's "block release and retry" actually retries with another release instead of stopping

community

  • the whole library-discography-source feature is @ragnarlotus's PR #1068 — clean typed rework of the discography provider chain

Security Fixes

  • Multi‑user profile isolation audit enforces ownership checks, sweeps all referenced tables on deletion, and isolates socket rooms per session

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track SoulSync

Get notified when new releases ship.

Sign up free

About SoulSync

Automated Music Discovery and Collection Manager

All releases →

Related context

Beta — feedback welcome: [email protected]