Navidrome

Changelog

Bug fixes

• 205c85da5523338807808202d8877ccaa6e82776: fix(plugins): surface host service failures when loading plugins (#5756) (@deluan)
• 7fa13761d734159e2f0a502a31affacc88e66d37: fix(scanner): resolve file symlinks with the production local storage FS (#5755) (@deluan)
• e91687e760a8b4e19dc74b6a9b1ff7f3674565ce: fix(smartplaylist): reject NSP mixing top-level 'any' and 'all' (#5759) (@deluan)

Build process updates

• be10f89c117925fabf10394b8d2962a370108b97: ci: don't skip release jobs after the DB migration check on tag pushes (#5760) (@deluan)
• 4381366e663b4647cfec1eb5597c39c3c42e9d7a: ci: validate DB migration order on pull requests (#5750) (@deluan)

Other work

• 116a4407184b6f21221a6aa7702fb738a3915773: test(scanner): fix flaky Windows search_normalized rescan test (#5758) (@deluan)

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.63.1...v0.63.2

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods or Danian for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

Changelog

Bug fixes

• 052f10fd68984a01cc2c87eee9edcc16dbfa6ad5: fix(build): prevent 32-bit startup crash (segfault/SIGILL) in downloads binaries (#5739) (@deluan)
• f48943c05873dad7cab4e159747453a5d7677f74: fix(plugins): discard buffered scrobbles when a plugin is removed (#5737) (@deluan)
• 4652b4660205abf38a484a2dc7856b4f6d5c24aa: fix(plugins): populate username for buffered plugin scrobbles (#5736) (@deluan)
• 42d4363f6135167b7fce5c8fd9070a25fab10172: fix(service): rewrite systemd service template for kardianos/service v1.3.0 (#5743) (@deluan)

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.63.0...v0.63.1

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods or Danian for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

Navidrome 0.63 brings a long-awaited upgrade to lyrics: full support for synced sidecar lyrics in multiple formats (TTML, ELRC, SRT, YAML and LRC), including word-by-word karaoke timing and multi-voice (agent) layers, exposed to clients through the new OpenSubsonic v2 lyrics extensions. A huge shoutout to @ranokay, who not only contributed the code for these lyrics enhancements, but also helped shape the OpenSubsonic extension specification behind them. Search also gets noticeably smarter: exact matches now rank above prefix matches (searching for "MØ" brings MØ to the top instead of burying it), and artists with short or non-ASCII names that were previously unfindable now show up correctly.

The other big theme of this release is performance for large libraries and offline-first clients. Full-library synchronization via search3 (the way clients like Symfonium mirror the whole library) is now flat at every offset instead of degrading with depth, roughly 30-50x faster at deep offsets and about 20x faster for a complete sync on a ~1M-track library, and a related pagination-integrity fix eliminates the duplicate and short pages that could corrupt those syncs. Alongside it, getRandomSongs is about 13x faster on the same library size, and a batch of database improvements (annotation-index-friendly smart playlist filters, leaner list-count queries, and new composite indexes for album/artist song sorts) makes everyday operations anywhere from ~9x to ~160x faster. Finally, a heads-up on a behavior change: sharing is now enabled by default, and can be turned off with EnableSharing=false.

Security

• Enforce per-library access on playlist import and sharing paths. In multi-library setups, three read paths did not consistently apply per-library restrictions: M3U import path resolution, shared-playlist track loading, and public share-scoped streams. A user with access to only some libraries could resolve or be served tracks from libraries they weren't assigned to. All three now respect the user's (or share owner's) library access. (#5640 by @deluan)
• Resolve symlinks to their real target when classifying files during scan, preventing symlinked entries from being misclassified. (ecba19a08 by @deluan)

Configuration Changes

Status	Option	Description	Default
New	Scanner.ArtistSplitExceptions	List of artist names that must never be split by tag separators (e.g. "Tyler, The Creator"). (#5701)	[] (empty)
New	Scanner.IgnoreDotFolders	Whether to skip folders whose name starts with a dot when scanning. Set to false to index dot-prefixed folders. (#5568)	true
Changed	EnableSharing	Sharing is now enabled by default. Set to false to restore the previous behavior. (#5714)	true
Changed	LyricsPriority	New sidecar lyrics formats added to the default priority list. (#5076)	.ttml,.yaml,.yml,.elrc,.lrc,.srt,.txt,embedded

For a complete list of all configuration options, see the Configuration Options documentation.

Lyrics

• Add structured sidecar lyrics support with OpenSubsonic v2 karaoke cues and agent layers: TTML, ELRC, SRT and YAML sidecar files are now parsed with word-by-word timing and multi-voice information. (#5076 by @ranokay)
• Allow lyrics plugins to return lyrics in any supported format, not just LRC. (#5632 by @deluan)
• Keep the player's lyrics in sync on track change and seek, so the previous song's lyrics no longer linger. (7303c9ca4 by @deluan)

Search

• Rank exact matches above prefix matches in search results. (#5704 by @deluan)
• Fix artists with short or non-ASCII names being unfindable after the FTS5 search migration. (#5703 by @deluan)

UI

• Add Rosé Pine themes. (#5664 by @draconivis)
• Fix transient jump to a wrong song when switching tracks in the web player. (#5676 by @deluan)
• Fix profile self-edits not reporting success or failure. (#5699 by @deluan)
• Fix Nautiline theme font and width on mobile devices. (#5590 by @devBoi76)
• Fix DefaultLanguage not being applied on app startup. (#4000 by @deluan)

Scanner

• Add Scanner.ArtistSplitExceptions to protect artist names from being split by tag separators. (#5701 by @deluan)
• Add Scanner.IgnoreDotFolders to allow indexing dot-prefixed folders. (#5568 by @deluan)
• Fix playlists not being imported when the first scan runs before any admin user exists. (#5609 by @deluan)

Subsonic API

• Add OpenSubsonic work and movement attributes, improving classical music metadata for compatible clients. (#5659 by @deluan)
• Speed up getRandomSongs on large libraries with two-phase random selection, about 13x faster on a 1M-track library. (#5618 by @deluan)
• Speed up artist search3 pagination at deep offsets, roughly 5-8x faster on a 300K-artist library. (#5620 by @deluan)
• Speed up search3 empty-query (browse-all) pagination: response times are now flat at any offset, 30-50x faster at deep offsets, making a full ~1M-track library sync about 20x faster overall. (#5601 by @deluan)
• Make "recently added" album order reproducible and consistent with the RecentlyAddedByModTime setting. (#5678 by @deluan)

Smart Playlists

• Extend isMissing/isPresent operators to BPM, bit depth and many text fields. (#5603 by @deluan)
• Speed up smart playlists that filter on play count, rating or loved status, up to ~14x faster end-to-end (the underlying query alone is over 300x faster). (#5662 by @deluan)
• Speed up smart playlists with many negated artist/tag rules, ~160x faster on a real-world case with 120 rules on a 323K-track library. (#5607 by @deluan)
• Fix isMissing/isPresent operators on ReplayGain fields. (#5585 by @deluan)

Recommendations

• Match similar and top songs across all artists credited on a track, improving results for collaborations. (#5668 by @deluan)
• Match ListenBrainz top songs for collaborations using all credited artist MBIDs. (#5670 by @deluan)
• Speed up top/similar song matching with batched lookups, up to ~14x faster on large batches. (#5635 by @deluan)
• Fix song matching to use artist credits, so artist-MBID specificity works and collaborators match correctly. (#5637 by @deluan)

Plugins

• Add a navidrome plugin CLI for managing and inspecting plugins. (#5682 by @deluan)
• Expose the song Matcher as a host service for plugins. (#5643 by @deluan)
• Share plugin DTOs via a common types package, simplifying plugin development. (#5655 by @deluan)

Artwork

• Speed up image resizing and WebP encoding/decoding, up to ~30% faster with far fewer allocations. (#5652 by @deluan)
• Fix artist folder images being incorrectly served as album art. (#5596 by @deluan)
• Fix WebP crash on 32-bit ARM; WebP encoding is now disabled by default in Docker images. (#5606 by @deluan)

Transcoding

• Preserve source metadata when transcoding downloads. (#5628 by @deluan)
• Enforce server-side player MaxBitRate on all stream paths. (#5611 by @deluan)
• Honor the player's forced transcoding format in the web UI playback flow. (#5613 by @deluan)
• Fix partially-written transcodes being served from the cache after a server crash. (#5657 by @deluan)

Server

• Enable sharing by default. (#5714 by @deluan)
• Fix direct log.Log calls not honoring DevLogLevels. (#5700 by @kgarner7)

Database

• Speed up song sorting by album and artist with new sort-order indexes, ~19x faster on large libraries on a cold cache. (#5706 by @deluan)
• Skip library filtering when a non-admin user has access to all libraries, making song counts ~19x faster on a 920K-track database. (#5696 by @deluan)
• Skip unnecessary annotation joins when counting items, up to ~9x faster list counts, with even larger gains on a cold cache. (#5694 by @deluan)
• Make PRAGMA optimize errors non-fatal at startup. (bd3192be0 by @deluan)

Translations

• Update Turkish translations. (#5685 by @deluan)

New Contributors

• @ranokay made their first contribution in #5076
• @devBoi76 made their first contribution in #5590
• @draconivis made their first contribution in #5664

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.62.0...v0.63.0

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods or Danian for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

This release introduces support for the OpenSubsonic sonicSimilarity extension, enabling audio-based similarity through the plugin system: when a plugin provides the capability, the new getSonicSimilarTracks and findSonicPath endpoints unlock smarter, sound-based recommendations and playlists. One plugin that implements it is AudioMuse-AI. It also brings a major overhaul to playback reporting and the Now Playing experience — the UI now uses the new OpenSubsonic playbackReport extension, replacing the old scrobble flow with a redesigned panel and configurable reporting interval. On the security front, it hardens the server with stronger ownership and authorization checks across shares, players, and transcoding endpoints, caps concurrent transcodes to prevent ffmpeg-based denial of service, and adds an option to refuse to run as root. Smart playlists gain ReplayGain fields and new isMissing/isPresent operators, and there are five new UI themes to choose from.

Security

This release fixes several reported vulnerabilities. We thank the security researchers who responsibly disclosed them.

• Fix cross-account disclosure of other users' shares (incl. share tokens) by enforcing per-user ownership on share reads. (1e7996f5d, GHSA-3g4p-jhv2-xrxf, reported by @Wernerina)
• Fix cross-tenant player takeover and share-update IDOR by enforcing ownership atomically on player and share updates. (#5563, GHSA-x65f-m8x9-pjxm reported by @tonghuaroot; GHSA-58gr-c777-g23p reported by @lighthousekeeper1212; GHSA-wx2c-q8g7-4q5p reported by @CE2Sec)
• Fix unauthenticated Last.fm scrobble session hijack (IDOR) by requiring a signed state token on the link callback. (#5521, GHSA-8jrh-w926-8rvw, reported by @geo-chen)
• Fix JWT expiration bypass on public share stream endpoints by validating token expiration and share existence. (#5426, GHSA-3rfj-qx9q-jghx, reported by @wooseokdotkim)
• Fix disclosure of admin-only transcoding configuration to non-admin users by restricting transcoding config reads to admins. (#5564, GHSA-4p3r-6362-833w, reported by @DavidCarliez)
• Fix missing admin authorization on internet radio station management endpoints by requiring admin access for Subsonic management endpoints. (#5510, GHSA-jw24-qqrj-633c, reported by @osageling)
• Cap concurrent transcodes to prevent an ffmpeg-based denial of service, with new per-server and per-user limits. (#5522 by @deluan)
• Add EnforceNonRootUser option to exit early if Navidrome is started as root. (#5373 by @kopf)
• Split HTML sanitization from plaintext handling. (7e083e079 by @deluan)

Note: Several of the advisories linked above are still in draft/triage on GitHub at the time of writing. Their links will become publicly accessible once the advisories are published. The fixes themselves are already included in this release.

Configuration Changes

Status	Option	Description	Default
New	EnforceNonRootUser	Exit early on startup if Navidrome is running as root (ignored on Windows). (#5373)	false
New	Transcoding.MaxConcurrent	Maximum number of concurrent transcodes server-wide (0 = unlimited). (#5522)	0
New	Transcoding.MaxConcurrentPerUser	Maximum number of concurrent transcodes per user (0 = unlimited). (#5522)	0
New	Matcher.PreferStarred	Bias the fuzzy matcher toward starred/high-rated tracks. (#5387)	true
New	UIPlaybackReportInterval	How often the UI reports playback progress. (#5448)	1m
Deprecated	EnableTranscodingCancellation → Transcoding.EnableCancellation	Renamed and moved under the new Transcoding section. (#5523)	false
Deprecated	SimilarSongsMatchThreshold → Matcher.FuzzyThreshold	Renamed and moved under the new Matcher section. (#5387)	85

For a complete list of all configuration options, see the Configuration Options documentation.

UI

• Replace UI scrobble with reportPlayback and redesign the Now Playing panel. (#5448 by @deluan)
• Add Tokyo Night theme. (#5497 by @Metalhearf)
• Add Catppuccin Latte theme. (#5250 by @lov3b)
• Add Moonbase themes (Alpha light + Bravo dark). (#5243 by @craiglush)
• Add a "Not Starred" filter option. (#5362 by @danielbanariba)
• Add a Rescan button to the plugin list empty state. (#5471 by @deluan)
• Suppress capitalization and autocorrection for login on mobile keyboards. (#3783 by @bdefore)
• Show album tile actions on keyboard focus. (#5434 by @danielbanariba)
• Start a new album from track 1 after closing the player. (#5441 by @deluan)
• Prevent autoplay when clearing the play queue. (#5430 by @deluan)
• Fix Gruvbox Dark colors. (#5553 by @Tal0na)
• Update the AMusic theme to use the correct text color for primary confirmation buttons. (#5509 by @VirtualWolf)

Smart Playlists

• Add ReplayGain fields to the criteria system. (d9dac4445 by @deluan)
• Add isMissing and isPresent operators. (#5436 by @deluan)
• Relax playlist visibility in inPlaylist/notInPlaylist rules. (#5411 by @deluan)
• Optimize smart playlist performance for role and tag criteria. (#5515 by @deluan)
• Coerce string booleans in smart playlist rules. (#5450 by @deluan)

Subsonic API

• Implement the playbackReport OpenSubsonic extension. (#5442 by @deluan)
• Add the sonicSimilarity extension as a plugin capability. (#5419 by @deluan)
• Add a groupings field to the OpenSubsonic Child response. (f12e75aa1 by @deluan)
• Use SQLite RANDOM() sorting in getRandomSongs for faster results. (cf1f190bb by @deluan)
• Mark AlbumID3 songCount and created as required. (8897ec918 by @deluan)
• Normalize non-NFKD Unicode letters (ø, æ, œ, ß) in search. (#5413 by @deluan)

Transcoding

• Place -ss before -i for fast input seeking. (#5492 by @deluan)
• Don't apply server-side override on getTranscodeDecision. (#5473 by @deluan)
• Log a warning for invalid or stale transcode tokens. (9a2eb483e by @deluan)

Scanner

• Respect tag-split config when multiple frames map to the same tag. (#5193 by @trek-e)
• Fix error when importing playlists without an admin user. (5b85b2839 by @deluan)

Artwork

• Fix stale cache and top-level album artwork for multi-disc albums. (#5457 by @deluan)
• Prefer album-root images over disc-subfolder images for multi-disc albums. (#5451 by @deluan)
• Return the correct timestamp when disc or album cover art changes. (#5378 by @bobo-xxx)

Server

• Prevent artwork throttle token starvation on slow clients. (#5472 by @deluan)
• Proxy NowPlaying even when ignoreScrobble is set. (#5559 by @deluan)
• Make the /api/song path filter work and use startsWith. (#5566 by @deluan)
• Preserve unchanged fields on partial REST playlist updates. (#5542 by @deluan)
• Allow toggling playlist auto-import and avoid unnecessary artwork reloads. (#5421 by @deluan)

Matcher

• Add Matcher.PreferStarred option to bias the fuzzy matcher toward starred/high-rated tracks. (#5387 by @deluan)

Plugins

• Add PlaybackReport to the scrobbler capability. (#5452 by @deluan)
• Add LibraryID to TrackInfo. (fd930eefd by @deluan)

CLI

• Add pls export/import subcommands for bulk playlist management. (#5412 by @deluan)
• Restore int cast for syscall.Stdin on Windows. (e75ab3b03 by @deluan)

Build & Dependencies

• Improve Windows support: the Go test suite now runs on Windows CI, with previously-skipped Subsonic, artwork, watcher, and scheduler tests enabled and fixed. (#5380, #5427, #5416 by @deluan)
• Upgrade Go to 1.26. (#5361 by @deluan)
• Enable native libwebp encoding in the Docker image. (#5350 by @deluan)
• Update TagLib to 2.3. (e55a35544 by @deluan)

Translations

• Add Estonian translation. (725f6ab34 by @deluan)
• Update Indonesian translations from POEditor. (#5575 by @deluan)
• Update Spanish translations and add missing gain keys. (#5433 by @danielbanariba)
• Update Basque localisation. (#5364 by @xabirequejo)
• Update German, Finnish, Galician, Dutch, Slovak, Thai, and Chinese (traditional) translations from POEditor. (#5351 by @deluan)
• Update Serbian translation. (#5444 by @nenadjokic)
• Update Traditional Chinese translation. (#5470 by @IEEE-754)
• Complete Italian translation. (#5407 by @DanieleMassa)

New Contributors

• @bdefore made their first contribution in #3783
• @craiglush made their first contribution in #5243
• @lov3b made their first contribution in #5250
• @danielbanariba made their first contribution in #5362
• @kopf made their first contribution in #5373
• @bobo-xxx made their first contribution in #5378
• @DanieleMassa made their first contribution in #5407
• @nenadjokic made their first contribution in #5444
• @IEEE-754 made their first contribution in #5470
• @Metalhearf made their first contribution in #5497
• @VirtualWolf made their first contribution in #5509
• @Tal0na made their first contribution in #5553

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.61.2...v0.62.0

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods or Danian for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

Another round of bugfixes. Transcoding now properly clamps target channels to codec limits, WAV files play directly in browsers without unnecessary transcoding, and the scanner picks up ORIGYEAR tags for VorbisComment and MP4 formats. Cover art handling got a few fixes too, including configurable max upload size. Plugin developers now get the file path in TrackInfo for Scrobbler and Lyrics plugins.

Configuration Changes

Status	Option	Description	Default
New	MaxImageUploadSize	Maximum allowed size for uploaded cover art images. Accepts human-readable values like '10MB', '1GB'. (#5335)	10MB

For a complete list of all configuration options, see the Configuration Options documentation.

UI

• Prevent theme CSS filters from affecting disc cover art. (c91721363 by @deluan)
• Refine image filters for playing and paused states in SquiddiesGlass theme. (4570dec67 by @deluan)
• Update Chinese (Simplified) translation. (#5323 by @fxj368)
• Update Russian translations. (#5329 by @amakeenk)

Scanner

• Map ORIGYEAR tag for VorbisComment and MP4 formats, bringing them in line with ID3. (#5303 by @obskyr)
• Fix issue with empty ID3v2 frames in go-taglib. (1de4e43d2 by @deluan)

Subsonic API

• Always emit required created field on AlbumID3 responses. (#5340 by @deluan)

Artwork

• Make max image upload size configurable. (#5335 by @m8tec)
• Allow shared disc art from unnumbered filenames in single-folder albums. (#5344 by @deluan)

Transcoding

• Clamp target channels to codec limit, fixing issues with codecs that don't support high channel counts. (#5345 by @deluan)
• Play WAV files directly in browsers instead of transcoding. (#5309 by @deluan)
• Include ffprobe in MSI installer and fall back gracefully when absent. (#5326 by @deluan)

Plugins

• Add file path to Scrobbler and Lyrics plugin TrackInfo. (#5339 by @J0R6IT0)
• Fix race condition between KVStore cleanup goroutine and Close. (478845bc5 by @deluan)

Server

• Honor path component of ShareURL config. (d7baf6ee7 by @deluan)
• Surface real SQLite error when backup step fails. (1f3a7efa7 by @deluan)
• Improve error handling in configuration validation. (1988a4162 by @deluan)
• Reduce hot-path heap escapes from value-param pointer aliasing. (#5342 by @deluan)

Database

• Resolve schema inconsistencies in library_artist and scrobble_buffer tables. (#5047 by @bvdwalt)

New Contributors

• @m8tec made their first contribution in #5335
• @J0R6IT0 made their first contribution in #5339
• @obskyr made their first contribution in #5303
• @bvdwalt made their first contribution in #5047
• @amakeenk made their first contribution in #5329

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.61.1...v0.61.2

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

This patch release addresses a WebP performance regression on low-power hardware introduced in v0.61.0, adds a new EnableWebPEncoding config option and a configurable UI cover art size, and includes several Subsonic API and translation fixes.

Configuration Changes

Status	Option	Description	Default
New	EnableWebPEncoding	Opt-in to WebP encoding for resized artwork. When false (default), Navidrome uses JPEG/PNG (preserving the original source format), avoiding the WebP WASM encoder overhead that caused slow image processing on low-power hardware in v0.61.0. Set to true to re-enable WebP output. Replaces the internal DevJpegCoverArt flag. (#5286)	false
New	UICoverArtSize	Size (in pixels, 200–1200) of cover art requested by the web UI. It was increased from 300px to 600px in 0.61.0; now configurable and defaulting to 300px to reduce image encoding load on low-power hardware. Users on capable hardware can raise it for sharper thumbnails. (#5286)	300
Changed	DevArtworkMaxRequests	Default lowered from max(4, NumCPU) to max(2, NumCPU/2) to reduce load on low-power hardware. (#5286). (Note: this is an internal configuration and can be removed in future releases)	max(2, NumCPU/2)
Removed	DevJpegCoverArt	Replaced by the user-facing EnableWebPEncoding option. (#5286)	—

For a complete list of all configuration options, see the Configuration Options documentation.

Server

• Add missing viper defaults for MPVPath, ArtistImageFolder, and Plugins.LogLevel so they can be overridden via environment variables and config files. (220019a9f by @deluan)
• Update go-sqlite3 to v1.14.38 and go-toml to v2.3.0. (6109bf519 by @deluan)

Artwork

• Address WebP performance regression on low-power hardware by preserving original image format when WebP encoding is disabled, and adding encoder/decoder selection logging. (#5286 by @deluan)
• Preserve animation for square thumbnails with animated images. (4030bfe06 by @deluan)

Smart Playlists

• Add sampleRate, codec, and missing fields for smart playlist criteria. (80c1e6025 by @deluan)

Subsonic API

• Strip OpenSubsonic extensions from playlists for legacy clients to improve compatibility. (23f355637 by @deluan)
• Return proper artwork ID format in getInternetRadioStations. (c60637de2 by @deluan)

Translations

• Update Esperanto and Dutch translations from POEditor. (#5301 by @deluan)
• Update Basque localisation. (#5278 by @xabirequejo)

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.61.0...v0.61.1

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

This version brings a comprehensive Artwork overhaul, with per-disc cover art, artist image uploads, animated image preservation, and a faster image pipeline powered by WebP encoding. You can now upload custom artwork for playlists, artists, and internet radios directly from the UI, and multi-disc albums will automatically pick up disc-specific cover images.

Search has been completely rebuilt on top of SQLite FTS5 with two-phase BM25 ranking, delivering faster and more accurate results across your entire library.

Transcoding is now fully server-managed: Navidrome detects client codecs, applies format-aware bitrate defaults, and implements the OpenSubsonic Transcoding extension, so clients no longer need to guess what format to request.

The Plugin System continues to mature with new host services for HTTP requests, persistent task queues, lyrics providers, and key-value storage with TTL support, giving plugin developers more tools to build powerful integrations.

Security

• Bump golang.org/x/image to v0.38.0 to address CVE-2026-33809. (#5268)
• Add ownership checks to share Delete and Update operations, preventing unauthorized access to other users' shares. (#5189 by @deluan)
• Clear server-managed fields in savePlaylist to prevent field injection via REST API. (f102036dc by @deluan)

⚠️ Breaking Changes

• Remove built-in Spotify integration. The Spotify.ID and Spotify.Secret configuration options are no longer supported. Use the Last.fm or Deezer agents, or a plugin for similar functionality, like the new Apple Music Plugin. (#5197 by @deluan)

Configuration Changes

Status	Option	Description	Default
New	EnableArtworkUpload	Enable uploading custom artwork for playlists and artists. (#5110, #5198)	true
New	EnableM3UExternalAlbumArt	Enable fetching album art URLs from #EXTALBUMARTURL directives in M3U playlists. (#5131)	false
New	DiscArtPriority	Priority list for disc-level cover art sources. (#5182)	disc*.*, cd*.*, cover.*, folder.*, front.*, discsubtitle, embedded
New	ArtistImageFolder	Folder name to search for artist images within the library. (#5198)	—
New	Search.Backend	Search backend to use (fts for FTS5 full-text search). (#5079)	fts
New	ExtAuth.LogoutURL	URL to redirect to when logging out with external authentication. (#5074)	""
New	Subsonic.AppendAlbumVersion	Append album version/edition to album names in Subsonic API responses. (#5111)	true
New	UISearchDebounceMs	Debounce delay for the UI search field. (#5079)	—
Changed	CoverJpegQuality → CoverArtQuality	Renamed for clarity. Old name still works. (#5181)	75
CHanged	SearchFullString	Use Search.FullString instead. (#5079)	—
Removed	Spotify.ID, Spotify.Secret	Spotify integration has been removed. (#5197)	—

For a complete list of all configuration options, see the Configuration Options documentation.

Artwork

• Add per-disc cover art support, with configurable DiscArtPriority. (#5182 by @deluan)
• Add artist image uploads and image-folder artwork source. (#5198 by @deluan)
• Preserve animated image artwork (GIF, APNG, animated WebP) during resize. (#5184 by @deluan)
• Improve image serving performance with WebP encoding and optimized pipeline. (#5181 by @deluan)
• Increase cover art size to 600px and use CatmullRom scaling for sharper images. (cb396f3db by @deluan)
• Fallback mediafile cover art to disc artwork before album. (#5216 by @deluan)
• Refresh stale artist image URLs on expiry. (#5267 by @deluan)
• Validate ffmpeg pipe before returning in cover art fallback. (420d2c8e5 by @deluan)
• Search parent folders for album cover art in multi-disc layouts. (#5157 by @deluan)

UI

• Add custom playlist cover art upload. (#5110 by @adrbn)
• Add cover art support for internet radio stations. (#5229 by @deluan)
• Add Dracula theme. (#5023 by @Saulimedes)
• Add Nutball theme. (#4544 by @cafecitopuro)
• Add tooltips for long playlist and album names. (#5070 by @sfredo)
• Add download link for config TOML and disable clipboard copy when unavailable. (#5035 by @kgarner7)
• Add path field as optional column in library list for desktop view. (4e34d3ac1 by @deluan)
• Integrate server-managed transcoding decisions into web player. (#5155 by @deluan)
• Improve browser codec detection. (#5171 by @deluan)
• Allow DefaultTheme="Auto" from config. (#5190 by @trek-e)
• Fix search focus after clearing search field. (#4932 by @borisrorsvort)
• Fix "Play Next" from restarting playback at top of queue. (#5049 by @alannnna)
• Fix toggle switches not visible in Gruvbox Dark theme. (#5064 by @deluan)
• Fix delete button contrast in AMusic theme. (51c48bcac by @deluan)
• Cancel in-flight image requests on pagination, cache across remounts. (#5249 by @deluan)
• Prevent mobile touch events from triggering playback after lightbox close. (197d357f0 by @deluan)
• Prevent duplicate getCoverArt requests on artist page. (549b81263 by @deluan)

Search

• Implement FTS5-based full-text search for faster and more accurate results. (#5079 by @deluan)
• Improve FTS queries with two-phase BM25 ranking for Subsonic's search3 endpoint. (#5086 by @deluan)

Transcoding

• Implement server-managed transcoding. (#4990 by @deluan)
• Add player MaxBitRate cap, format-aware defaults, and browser profile filtering. (#5165 by @deluan)
• Improve transcoding failure diagnostics and error responses. (#5227 by @deluan)
• Use ADTS for AAC transcoding. (#5167 by @deluan)
• Implement fallback to DefaultDownsamplingFormat for unknown formats. (5ecbe31a0 by @deluan)
• Prevent raw file being returned when explicit transcode format is requested. (053a0fd6c by @deluan)

Subsonic API

• Implement OpenSubsonic transcoding extension. (#4990 by @deluan)
• Append album version to names in Subsonic API responses. (#5111 by @deluan)
• Add coverArt to internetRadioStation response. (03608d3ee by @deluan)
• Add per-disc cover art support. (#5182 by @deluan)
• Never omit duration for AlbumID3. (#5217 by @kgarner7)
• Always return required playqueue fields. (#5172 by @kgarner7)
• Always include mandatory title field in Child responses. (a887521d7 by @deluan)
• Restore public attribute for playlists in XML responses. (0c3cc8653 by @deluan)

Scanner

• Add MKA/Matroska audio file support via TagLib 2.2. (#5071 by @deluan)
• Exclude Vorbis VERSION from albumversion tag mapping. (#5194 by @trek-e)
• Widen WASM panic recovery to cover tag/property reading. (#5223 by @deluan)
• Prevent duplicate tracks when multiple missing files match same target. (#5183 by @deluan)
• Prevent ScanOnStartup when scanner is disabled. (1cf3fd916 by @deluan)
• Increase watcher channel buffers to prevent dropped filesystem events. (0790f6662 by @deluan)

Playlists / Smart Playlists

• Support #EXTALBUMARTURL directive and sidecar images for playlist cover art. (#5131 by @deluan)
• Add percentage-based limits to smart playlists. (#5144 by @deluan)
• Make album and artist fields available to smart playlist queries. (#4927 by @ulfurinn)
• Add averageRating as a smart playlist field. (#5092 by @Lokke)

Server

• Add ExtAuth logout URL configuration. (#5074 by @deluan)
• Accept ND_-prefixed environment variable names in config files. (#5258 by @deluan)
• Add syslog priority prefixes for systemd-journald. (#5192 by @trek-e)
• Require additional variable to enable systemd logging. (#5222 by @kgarner7)
• Add crontab(5) random ~ syntax support for schedule expressions. (#5233 by @deluan)
• Preserve created_at when moving songs between libraries. (#5055 by @deluan)
• Increase SSE writeTimeout to exceed keepAlive period. (#5054 by @rcatolino)
• Use http.TimeFormat for Last-Modified header. (#5219 by @SimonTeixidor)
• Return correct scanType in startScan response. (#5159 by @deluan)
• Return 404 instead of 500 for non-existent playlists. (b64d8ad33 by @deluan)
• Normalize timestamps and fix recently added album sorting. (#5176 by @deluan)

Plugins

• Add HTTP host service for plugin HTTP requests. (#5095 by @deluan)
• Add TaskQueue host service for persistent background task queues. (#5116 by @deluan)
• Add lyrics provider plugin capability. (#5126 by @deluan)
• Add TTL support, batch operations, and hardening to kvstore. (#5127 by @deluan)
• Allow mounting library directories as read-write. (#5122 by @deluan)
• Change websockets Data field type to []byte for binary support. (6fd044fb0 by @deluan)
• Clear plugin errors on startup to allow retrying. (27a83547f by @deluan)

Translations

• Add Slovak language translation. (#5231 by @JRoshthen1)
• Update Chinese Simplified translation. (#5025 by @fxj368)
• Update Basque translation. (#5038 by @xabirequejo)
• Update Hungarian translation. (#5041, #5263 by @ChekeredList71)
• Update Bulgarian, Catalan, Danish, German, Greek, Spanish, Finnish, French, Galician, Portuguese (BR), Russian, Slovenian, Swedish, Thai, Ukrainian, Chinese (Traditional) translations. (#5044, #5039, #5218, #5260)

New Contributors

• @cafecitopuro made their first contribution in #4544
• @Saulimedes made their first contribution in #5023
• @fxj368 made their first contribution in #5025
• @rcatolino made their first contribution in #5054
• @sfredo made their first contribution in #5070
• @adrbn made their first contribution in #5110
• @trek-e made their first contribution in #5190
• @SimonTeixidor made their first contribution in #5219
• @JRoshthen1 made their first contribution in #5231

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.60.3...v0.61.0

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

Changelog

New Features

• 34c6f12aeeb11144100d764b06248e0a40ccb126: feat(server): add explicit status support in smart playlists (#5031) (@kgarner7)

Bug fixes

• 408aa78ed53f0299d35e758cd422fd0b9dfe93a3: fix(scanner): log warning when metadata extraction fails (@deluan)
• ed79a8897bc16602ebadb4e3a253d87f1599642f: fix(scanner): pass filename hint to gotaglib's OpenStream for format detection (#5012) (@deluan)
• fd09ca103fd9fd14f5d0ecd3df6efd839a9df560: fix(scanner): resolve data race on conf.Server access in getScanner (@deluan)
• 0a4722802af833caa8dd794fa8c25f8d0a97dd06: fix(subsonic): validate JSONP callback parameter (@deluan)
• eb9ebc3fba6545334c2c13d778273c1bd55135ee: fix(ui): add missing keys in Danish translation (#5011) (@denisarissa)
• 62f9c3a458bd101df1d059eeaf8bce43e7c97c21: fix: linux service should restart when upgrading (#5001) (@mintsoft)
• e05a7e230f7a72b6c2e7d789006df63b688c30e2: fix: prevent data race on conf.Server during cleanup in e2e tests (@deluan)
• bee0305831a76c49a46e7a6b0cbe09fd865abebc: fix: split reflex -R flags to preserve directory exclusion optimization (@deluan)

Other work

• 302d99aa8b17e381cbd5a6c78d58125a9e0d6755: chore(deps): update dependencies in go.mod and go.sum (@deluan)
• c80ef8ae41d692f971baf2ebab1a710a3182108f: chore: ignore _test.go files in reflex conf (@deluan)
• 8319905d2c913b817a896a0b79a44b6b1cffe8c9: test(subsonic): add comprehensive e2e test suite for Subsonic API (#5003) (@deluan)

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.60.2...v0.60.3

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

This release expands ListenBrainz integration with artist URLs and top/similar songs, adds OpenSubsonic readonly and validUntil properties for playlists, and includes several bug fixes for the UI, scanner, and plugin system.

Added

• Backend Features:

  • Add artist URL, top songs, and similar songs support to the ListenBrainz agent. (#4934 by @kgarner7)

• API Features:

  • Add OpenSubsonic readonly and validUntil properties to playlists. (#4993 by @kgarner7)

• Plugin Features:

  • Add CallRaw method to SubsonicAPI host function with support for binary responses. (#4982 by @deluan)

Fixed

• UI:

  • Fix Last.fm URL handling and Biographies rendering on artist page. (#4980 by @kgarner7)
  • Fix Nautiline theme font path. (#4983 by @borisrorsvort)

• Scanner:

  • Preserve first line in parentheses in lyrics. (#4985 by @deluan)

• Server:

  • Clean up Last.fm content by removing "Read more" links from descriptions and bios. (e11206f0e by @deluan)
  • Handle WASM runtime panics in gotaglib openFile function. (4e720ee93 by @deluan)

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.60.0...v0.60.2

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!

Plugins

This release introduces a major rewrite of the experimental Plugin System, now with multi-language PDK support, enabling developers to extend Navidrome's functionality using WebAssembly-based plugins written in Go, Rust, Python or JavaScript. Plugins run in a secure sandbox and can provide additional metadata sources, custom integrations, and server-side enhancements. Users can now easily configure plugins directly from the UI through a new JSONForms-based configuration interface.

A couple of working plugins are already available:

• AudioMuse-AI integration
• ListenBrainz Daily Playlist Importer
• Discord Rich Presence

For more plugins, keep an eye on the tag navidrome-plugins in GitHub.

More details and instructions on how to use and manage plugins can be found in our documentation. New documentation will soon be added with details on how to create new plugins.

Metadata Extraction

Additionally, this version includes a pure-Go metadata extractor built on top of the new go-taglib library. This is a significant step toward removing the C++ TagLib dependency, which will simplify cross-platform builds and packaging in future releases. The new extractor is activated by default, but in case of any issues you can revert to the previous implementation by setting Scanner.Extractor="legacy-taglib" configuration option.

Instant Mix

The Instant Mix feature generates a playlist of similar songs based on a selected track. By default, it retrieves similar songs from Last.fm (if configured with an API key) or falls back to Deezer. It can also be configured to use external plugins, like AudioMuse-AI for sonic analysis-based similarity recommendations.

New and Changed Configuration Options

Plugin System Options

Option	Default	Description
Plugins.Enabled	true	Enable/disable the plugin system
Plugins.Folder	""	Path to the plugins directory. Default: $DataFolder/Plugins
Plugins.CacheSize	"200MB"	Maximum cache size for storing compiled plugin WASM modules
Plugins.AutoReload	false	Automatically detect new/changed/removed plugins
Plugins.LogLevel	""	Override log level for plugin-related messages

Subsonic API Options

Option	Default	Description
Subsonic.MinimalClients	""	Comma-separated list of clients that receive reduced API responses (useful for resource-constrained devices like smartwatches)
Subsonic.EnableAverageRating	true	Include average rating in API responses

Metadata & Matching Options

Option	Default	Description
SimilarSongsMatchThreshold	85	Minimum similarity score (0-100) for matching similar songs from external sources to local library
LastFM.Language	"en"	Now supports comma-separated list of languages (e.g., "de,fr,en") for metadata fallback
Deezer.Language	"en"	Now supports comma-separated list of languages for metadata fallback

Renamed Options (Deprecation Notice)

The following options have been renamed. The old names still work but will be removed in a future release:

Old Name	New Name
HTTPSecurityHeaders.CustomFrameOptionsValue	HTTPHeaders.FrameOptions

Security

• Fix potential XSS vulnerability by sanitizing user-supplied data before rendering (GHSA-rh3r-8pxm-hg4w). (d7ec735 by @AlexGustafsson)
• Fix potential DoS vulnerability in cover art upscaling by clamping requested square size to original dimensions (GHSA-hrr4-3wgr-68x3). (77367548 by @deluan). Thanks to @yunfachi

Added

• Plugins:

  • Add new WebAssembly-based plugin system with multi-language PDK support (Go, Rust, Python). (#4833 by @deluan)
  • Add JSONForms-based plugin configuration UI. (#4911 by @deluan)
  • Add similar songs retrieval functions to plugins API. (#4933 by @deluan)

• Server:

  • Add pure-Go metadata extractor (go-taglib) as alternative to FFmpeg-based extraction. (#4902 by @deluan)
  • Add support for reading embedded images using the new taglib extractor by default. (66474fc by @deluan)
  • Add Instant Mix (song-based Similar Songs) functionality with MBID, ISRC and Title/Artist fuzzy matching. (#4919, #4946 by @deluan)
  • Add support for multiple languages when fetching metadata from Last.fm and Deezer. (#4952 by @deluan)
  • Add Subsonic.MinimalClients configuration option for improved compatibility with minimal Subsonic clients. Default list is "SubMusic" (#4850 by @typhoon2099)
  • Add support for public/private playlists in NSP import. (c5447a6 by @deluan)
  • Add RISCV64 builds. (#4949 by @MichaIng)

• UI Features:

  • Add composer field to table views. (#4857 by @AlexGustafsson)
  • Add prompt before closing window if music is playing. (#4899 by @alannnna)
  • Add Nautiline-like theme. (#4909 by @borisrorsvort)
  • Add multiline support and resizing for playlist comment input. (6fce30c by @deluan)

• Subsonic API:

  • Add avgRating field from Subsonic spec. (#4900 by @terry90)

• Insights:

  • Add insights collection for Scanner.Extractor configuration to measure go-taglib usage. (63517e9 by @deluan)
  • Add file suffix counting to insights. (0473c50 by @deluan)

Changed

• Optimize cross-library move detection for single-library setups. (#4888 by @deluan)
• Improve Deezer artist search ranking. (a081569 by @deluan)
• Rename HTTPSecurityHeaders.CustomFrameOptionsValue to HTTPHeaders.FrameOptions. (7ccf44b by @deluan)
• Update translations: Bulgarian, Catalan, German, Greek, Spanish, Finnish, French, Galician, Indonesian, Dutch, Polish, Russian, Slovenian, Swedish, Thai by POEditor contributors.
• Update Spanish translations. (#4904 by @abrugues)
• Update Basque translation. (#4815 by @xabirequejo)

Fixed

• Playlists:

  • Fix M3U playlist import failing for paths with different UTF/Unicode representations (NFC/NFD normalization). (#4890 by @deluan)
  • Fix playlist name sorting to be case-insensitive. (#4845 by @deluan)

• UI:

  • Fix various UI issues and improve styling coherence. (#4910 by @borisrorsvort)
  • Fix AMusic theme player buttons and delete button color. (#4797 by @dragonish)
  • Fix export missing files showing only first 1000 results. (017676c by @deluan)

• Scanner:

  • Fix FullScanInProgress not reflecting current scan request during interrupted scans. (8c80be5 by @deluan)
  • Fix "Expression tree is too large" error by executing GetFolderUpdateInfo in batches. (cde5992 by @deluan)
  • Fix stale role associations when artist role changes. (2d7b716 by @deluan)
  • Fix infinite recursion in PID configuration. (1c4a7e8 by @deluan)
  • Fix default PIDs not being set for Album and Track. In some circumstances it could lead to empty PIDs (71f549a by @deluan)
  • Fix error when watcher detected too many folder changes, causing the scan to fail. (9ed309a by @deluan)
  • Show scan errors in the UI more consistently. (ebbc31f by @deluan)

• Subsonic API:

  • Fix username parameter validation for getUser endpoint. (6ed6524 by @deluan)
  • Fix getNowPlaying endpoint to always be enabled regardless of configuration. (603cccd by @deluan)

• Server:

  • Fix JWT-related errors being exposed on share page. (#4892 by @AlexGustafsson)
  • Fix user context not preserved in async NowPlaying dispatch. (396eee4 by @deluan)
  • Fix environment variable configuration loading not being logged when no config file is found. (51ca2de by @deluan)
  • Fix items with no annotation not being included for starred=false filter, handle has_rating=false. (#4921 by @kgarner7)
  • Last.fm's scrobble and updateNowPlaying methods should send parameters in request body. (51026de by @deluan)

New Contributors

• @alannnna made their first contribution in #4899
• @abrugues made their first contribution in #4904
• @AlexGustafsson made their first contribution in #4857
• @borisrorsvort made their first contribution in #4909
• @dragonish made their first contribution in #4797
• @MichaIng made their first contribution in #4949
• @terry90 made their first contribution in #4900
• @typhoon2099 made their first contribution in #4850

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.59.0...v0.60.0

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

• Read installation instructions on our website.
• Host Navidrome on PikaPods for a simple cloud solution.
• Reach out on Discord, Reddit and Twitter!