mStream releases

Fixes issue where the previous release was drafted before the latest rust binaries were committed

Adds in a local backup feature to backup your library to another location on the server

Adds multi-threading to the rust scanner
Can disable waveform generation in the file scanner

Fixes issue with last release not booting some environments

Fixes issue with public accessible setups

Fixes issue where setups with no users configured couldn't not use some APIs

Fix a bug where file scans were failing to start

• Rust parser optimizations
• add config option to trust proxy X-Forwarded-For header

• Subsonic REST API — full implementation backing browsing, search, stars (tracks/albums/artists), bookmarks, cross-device play queue, sharing, and jukebox control. Per-user API keys for client auth via apiKey= instead of username/password.
• Airsonic Refix web client bundled as a third UI option (config.ui: 'subsonic') — still hand-edit-only until the admin panel story lands.
• DLNA / UPnP MediaServer with three modes (disabled / same-port / separate-port). Six browse layouts per library, smart containers (recent, recently-played, most-played, favorites, shuffle, by-year), time-based seek, Samsung compatibility.
• Lyrics support — real GET /api/v1/lyrics + Subsonic getLyrics / getLyricsBySongId. Reads embedded tags (USLT, SYLT, Vorbis, MP4, APE) and sidecar .lrc / .txt files (including multi-language variants).
• LRCLib fallback — opt-in (lyrics.lrclib: true) auto-fetch from lrclib.net for tracks with no local lyrics, with optional sidecar write-back.
• Multi-artist / compilation support — tracks and albums now store multiple credited artists. Clicking an artist returns every album they appear on (primary, collab, or featured), not just albums where they're the sole artist.
• Server-side audio playback — /server-remote page + /api/v1/server-playback/*. Auto-detects and prefers MPD, falls back to MPV / VLC / MPlayer. Gated per-user by an opt-in permission flag.
• Inline waveform generation — rust scanner produces the 800-bar waveform during scan; admin UI gets the waveform-as-progress-bar with no delay thanks to per-queue prefetching.
• OpenSubsonic extended fields — sampleRate, channels, bitDepth on every song so clients can render "24/96 FLAC" quality badges.
• OpenAPI 3.0 spec — first complete machine-readable documentation of the REST API at docs/openapi.yaml.
• Per-library followSymlinks flag — scanner behavior is now configurable per folder in the admin panel instead of a global on/off.
• Playlist rename support in the default UI.

new feature: rename playlists
improvement: waveform progress bar caching

Fixes issues with the waveform parser running too often on docker. Also makes the waveform files 70% smaller on average

Update the rust parser to ignore invalid metadata fields

Fixes a bug where the DB could lock up while scanning

Fixes ffmpeg issue on docker builds

Adds DLNA support

Translation support

Includes rust builds for alpine linux

Some APIs were modified accidentally in the v6 release. These changes have been reverted

Desktop Player Release

• Builds more for CPU architectures
• Updated electron version

YouTube Download & Per-User Permissions

• YouTube download — new yt-dlp integration with download modal, codec selection, metadata editing, and album art embedding (supports MP3, FLAC, Opus, OGG)
• Per-user upload/mkdir permissions — upload and create-folder can now be enabled/disabled per user
• Server-level mkdir config — global toggle to disable folder creation
• Rust parser — experimental Rust-based file scanner for faster library scanning, with pre-built binaries and CI/CD pipeline
• Vpath security — added path normalization to prevent directory traversal attacks

Server Audio & Remote Controls

• Server audio playback — Rust-based audio player that plays music through the server's speakers via HTTP API, with queue management, loop/shuffle modes
• Remote control page — redesigned remote control UI with album art, progress bar, volume control, and queue browsing
• Cross-compilation — custom Docker images for ARM Linux builds of the Rust audio player

Server audio is disabled by default. Enable it in the admin panel

Database

• SQLite migration — complete rewrite from LokiJS to Node.js built-in node:sqlite (DatabaseSync)
• Schema migration system — versioned migrations (V1-V8) using PRAGMA user_version
• Auto-migration from LokiJS — playlists, user metadata, shared playlists migrated automatically on first boot
• Genre support — normalized genres table with many-to-many track_genres junction table
• Track duration — scanner now extracts and stores audio duration from file metadata
• Force rescan — admin can trigger a full rescan that re-parses all files regardless of modification time, useful after schema changes
• Scan progress — real-time progress reporting via scan_progress table, visible in admin panel and Velvet UI

Velvet UI Integration

• Alternative frontend — Velvet UI imported as a selectable skin (ui: 'velvet' in config)
• Smart playlists — dynamic playlists with filters (genre, year, rating, play status, artist search, starred, fresh picks) and sort options
• ListenBrainz scrobbling — connect/disconnect, now-playing, and scrobble endpoints with token validation
• Discogs integration — admin config, cover art search with base64 thumbnails, Deezer search, and art embed endpoint
• Waveform visualization — ffmpeg-based peak analysis with 800-bar waveform data, disk + memory cache
• Your Stats / Wrapped — listening statistics with play event tracking, top songs/artists, listening by hour/weekday, personality type, session analysis
• Cue points — per-user bookmarks on audio tracks displayed as tick marks on the progress bar
• User settings persistence — 36+ UI preferences saved per user in the database

The UIs can be switched in the admin panel

FFmpeg

• Self-contained bootstrap — auto-downloads static ffmpeg binaries from BtbN/FFmpeg-Builds with SHA256 checksum verification
• Daily auto-update — checks for new ffmpeg versions on a daily interval
• Removed fluent-ffmpeg — all ffmpeg operations use direct child_process.spawn calls
• Removed ffbinaries — replaced with the custom download module

Transcode

• Fixed opus/aac transcoding — corrected ffmpeg container format flags (-f ogg for opus, -f adts for aac)
• Estimated Content-Length — calculates expected output size from duration × bitrate, enabling progress bars and seeking during streaming
• Smart cache — strong reference for song duration + 2 minutes, then moved to WeakRef for GC. No memory cap needed.
• Unified streaming — eliminated buffer/stream mode split. All requests stream immediately and cache in parallel.
• Client disconnect cleanup — kills ffmpeg process when client disconnects mid-stream
• Express 5 fix — {*filepath} wildcard param returns array in Express 5, now joined back to string

Album Art

• Album art search — MusicBrainz, iTunes, and Deezer search from the UI with manual selection
• Album art upload — custom art upload with base64 encoding
• Album art embed — ffmpeg-based embedding into MP3, FLAC, M4A, AAC files
• File modification permissions — server-level and per-user control over file writes
• Compress album art toggle — Layout panel option to use compressed or full-size art in album grid

Security

• Path traversal prevention — centralized bounds check in getVPathInfo() using path.resolve() + startsWith(base + sep)
• Upload filename sanitization — path.basename() strips directory components from uploaded filenames
• M3U path traversal fix — entries containing .., absolute paths, and Windows drive letters are rejected
• Download directory fix — archive.directory() now uses the requested subdirectory instead of the entire library root
• M3U listing bounds check — resolved paths verified to stay within library root before returning to client
• Locked admin hardening — when admin API is locked with no users, server-level write flags (noUpload, noMkdir, noFileModify) are forced on, and the public user gets no admin or write privileges
• Library access control — all new endpoints use getVPathInfo() for path validation instead of manual parsing

Default UI Improvements

• Album queue button — green play button on album grid cards to queue entire albums
• Popper menu dark theme — context menus and dropdown buttons updated for dark theme consistency
• File explorer header tooltips — SVG <title> elements added to back, search, mkdir, upload, add-all, repeat, shuffle, auto-DJ, and visualizer icons
• File explorer header icon hover — white-to-grey color transition on hover

Infrastructure

• Node.js >=22.5.0 — minimum version bumped for native SQLite support
• Electron 37 — bumped from 29 for Node 23+ with unflagged sqlite
• Scanner kill on shutdown — running scanner processes added to kill-list for clean server exit
• Removed dependencies — lokijs, ffbinaries, fluent-ffmpeg, escape-string-regexp

• fixes issues with electron builds

• Updates project to use ESM
• Dark mode in shared playlists