Transcoding, seeking, artist metadata, playlist security, Go bump
gonic
Media ServersLightweight music streaming server. Subsonic compatible. `GPL-3.0` `Go/Docker`
Features
- Free Subsonic server API implementation supporting many clients
- On-the-fly audio transcoding and caching with ffmpeg
- Multi‑user support with individual preferences, playlists, and scrobbling
Recent releases
View all 6 releases →Fixed regression in playlist ID handling.
- Playlist cover art support on filesystem
- Log‑db option to log queries
- Non‑admin podcast episode downloads
Full changelog
Features
- add support for playlist cover art on filesystem (aad729e), closes #650
- ci: bump golangci-lint (79e3898)
- db: add an index on albums.created_at (816e437), closes #620
- gonic: add log-db option to log queries (75a0918), closes #620
- scanner: read multi valued release types (c752a22)
- subsonic: allow non admins to download podcast episodes (c2ebe96), closes #623
- subsonic: implement getSimilarSongs for artists and albums (#649) (db9aa2b)
- subsonic: return disc titles (0377bfa)
- taglib: add
.apeas a supported filetype (82642eb), closes #615
Bug Fixes
- db: enable WAL also for Wasm driver (b67c1c1), closes #620
- db: use separate DSN for both drivers (4696499)
- gonic: correct typo in command line help (#640) (99e2ccf)
- podcast: truncate filenames longer than 200 chars (e12ab54), closes #624
- podcast: validate response status code when fetching podcast audio (2900ce5), closes #639
- scanner: clear metadata of albums who no longer have tracks (ca59601), closes #638
- scanner: reset embedded cover for album when toggling
scan-embedded-cover(ea5e625), closes #619 - subsonic: correct spec typos (04ff7f3), closes #653
- Set `CGO_ENABLED=0` when building to produce static binaries
- Verify vendored WASM artifacts using provided attestations (taglib.wasm and sqlite3.wasm)
- To opt out of WebAssembly backends, build with `-tags nowasm`; this re‑enables Cgo for SQLite and uses ffprobe for tagging
- Removed requirement for `sqlite-dev` and `libtag-dev` system packages
- Default build switched to Cgo‑free WebAssembly backends; native Cgo builds are opt‑in via the `nowasm` tag
- Cgo‑free database backend using go‑sqlite3 WASM implementation
- Cgo‑free tagging backend using go‑taglib WASM implementation
- Added `scan-embedded-cover-enabled` flag for embedded cover handling
Full changelog
This release uses WebAssesmby for the tagging and database backends. This means that gonic no longer requires Cgo or external dependencies to build. As a result, static binaries will be available in the releases page, and Docker images for more architectures. Performance of scanning and tagging should also be improved.
Features
- build: add Cgo free database (505f7d8)
- build: add Cgo free tagging backend (7802e20)
- ci: merge nightly and debug workflows (ca85eed)
- ci: remove Cgo dependencies, cross compile without QEMU, upload static binaries (e3db819)
- ffprobe: add more supported file types (8e7820a)
- gonic: add
scan-embedded-cover-enabledflag (c69cb8c) - gonic: use wrtag/normtag for nag normalisation (aba758f)
- subsonic: also read unsynced lyrics from .txt files and tag metadata (eb0d8fd), closes #593
- subsonic: keep original cover file format when caching (#609) (1af4ce3), closes #11
- subsonic: return genres for getAlbumListTwo2 (3909e9b), closes #605
- subsonic: support embedded cover art (ec7cffd), closes #11 #556
- subsonic: support embedded track level cover art (d66814b), closes #11
- tags: add ffprobe reader (3a9c03a)
- tags: add Properties.HasCover (bc0b6c0)
- tags: add ReadCover interface method (e413bc3)
⚠ Note to package maintainers
- The
sqlite-devandlibtag-dev(or your distro's equivalents) packages are no longer required; please remove them from package dependencies. - Build with
CGO_ENABLED=0to produce static binaries.
gonic now vendors reproducible WebAssembly backends for TagLib and SQLite, eliminating Cgo and external system libraries. Builds are fully static, cross-compiling is straightforward, and supply-chain verification is easier.
Verify the vendored WASM artifacts using Artifact Attestations:
- https://github.com/sentriz/go-taglib/raw/refs/tags/v0.10.4/taglib.wasm (Attestations)
- https://github.com/ncruces/go-sqlite3/raw/refs/tags/v0.29.1/embed/sqlite3.wasm (Attestations)
Example build pipeline:
$ git clone https://github.com/sentriz/gonic
$ cd gonic
$ sha256sum "$(go list -m -f '{{.Dir}}' go.senan.xyz/taglib)/taglib.wasm"
# expected ca5ce04b35f1e6cad8b8d9f00906a4c108ccd004b56e713db5ce69aa69b3805d (https://github.com/sentriz/go-taglib/attestations/11402786)
$ sha256sum "$(go list -m -f '{{.Dir}}' github.com/ncruces/go-sqlite3)/embed/sqlite3.wasm"
# expected 117262b6241d8de78ba564a44383fa1562e52f1a978de269e20a02b3c06c02e3 (https://github.com/ncruces/go-sqlite3/attestations/11344814)
$ CGO_ENABLED=0 go build ./cmd/gonic/.
Opting out of WebAssembly:
- If you prefer not to use the WebAssembly binaries, you can build with
nowasm:
$ go build -tags nowasm ./cmd/gonic/.
- This mode is not supported, and tagging/scan performance will degrade.
- Cgo will be used for sqlite, so sqlite-dev is still required.
ffprobewill be used for tagging, so that must be available in$PATH.libtag-devis still not used in this mode.
- Minimum Go version bumped to go1.25
- Docker now uses Alpine native taglib
- Subsonic added lyrics support and improved internet radio/podcast handling in jukebox
- README updated with comma escaping documentation
Full changelog
⚠ BREAKING CHANGES
- deps: bump to go1.25
Features
- docker: use alpine native taglib (c9f4181)
- readme: document comma escaping in readme (eaa82b0), closes #596
- subsonic: add support for lyrics (#519) (db97bc7)
- subsonic: better support for internet radio and podcast episodes in jukebox (3db183b), closes #572
- subsonic: replace html2text with bluemonday (5916a7f), closes #591
Bug Fixes
Miscellaneous Chores
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.