As promised, more security improvements: Passwords are now encrypted in the DB. The encryption key used can be overridden by the new config option PasswordEncryptionKey. See more details here: https://www.navidrome.org/docs/usage/security/#encrypted-passwords

ATTENTION: Please backup your DB before upgrading, as passwords will be encrypted when first running 0.44.0, and if you need to downgrade for any reason, old versions of Navidrome won't be able to read the passwords!

Also, you can now use a SSO/OAuth/OIDC proxy (like Authelia or Vouch) in front of Navidrome, to handle authentication. Thanks @ajgon!

And last but not least: Last.fm scrobbling is here! Users can opt-in by going to their Personal menu in the UI, and it can also be disabled for specific players if needed. Thanks @srichter!

Navidrome now uses a shared API-Key for Last.fm, so now Last.fm integrations (including scrobbling) work out of the box, but you can still override the API-Key with your own if you want to.

BREAKING CHANGE: The Native API URLs were changed:

/app/login => /auth/login
/app/createAdmin => /auth/createAdmin
/app/api/* => /api/*

If you use a script that connects directly with Navidrome, please check/change the URLs.

Highlights

• [UI] Auto update current view when there are changes in the DB (new albums, ratings/playCount changes, etc) (#1025)
• [UI] Prompt the user to refresh the page if server is using a version different then the UI, to keep both in sync after an upgrade
• [UI] Move Artists/Songs/Playlist to top level, removing "Library" submenu
• [UI] Show Disc Subtitles even if the album has only one disc (#947)
• [UI] Allow themes to override the React Player styling. Fixed colors for Dark, ExtraDark and Light themes
• [UI] New option to disable album cover animation in UI (save a few CPU cycles): EnableCoverAnimation (#1185)
• [Server] Last.fm scrobbling! Must be authorized by the user, and can be disable by player (or completely disabled) (#1202) Thanks @srichter!
• [Server] Last.fm integration now uses a shared API-Key, so Artist's bios, TopSongs, SimilarArtists and scrobbling work out of the box
• [Server] New option LastFM.Enabled (default true) allows disabling Last.fm integration completely
• [Server] Passwords are encrypted in the DB, with an option to override the encryption key used (#1187)
• [Server] Reverse Proxy Authentication, allowing setting up SSO, OAuth and other authentication schemas (#1152) Thanks @ajgon!
• [Server] Better SimilarSongs algorithm, prioritizing songs per popularity
• [Subsonic API] Fix /rest/updatePlaylist not updating fields comment and public.
• [Subsonic API] Fix /rest/getNowPlaying endpoint only returning one player/user
• [Subsonic API] GetCoverArt returns placeholder if id is missing, mimicking Subsonic behaviour

Changelog

b16d473d Update es.json (POEditor.com) fd82b8f2 Default for EnableCoverAnimation in dev mode is true a73f885a Add option to disable album cover animation in the player. Closes #1185 167fe462 Addresses a bug that would prevent users from changing their own passwords, introduced as part of #1187. (#1214) cb1827cc Update translations (#1134) 25f0e115 Add 'AlbumArtist' column to SongList 292cf99f Add 'Year' column to Album and Playlists song list d2fcab78 Fix ND_DEVFASTACCESSCOVERART flag not available as env var 94533e58 Add tests to /scrobble endpoint 6dd38376 Add referential integrity to remove user's props when user is deleted 26bcf0b8 Enable Last.fm scrobbling by default (still requires user's authorization) 92634a74 Only show message after 2 seconds, giving time for the browser to close it first ee21f395 Pass userId explicitly to UserPropsRepository methods a1551074 Add a hacky way to style the react-player. 823fef8e Fix JS console error 82105c3a Remove React.Strict mode b684a47f Show DiscSubtitle even if the album has only one disc. da2334e1 Remove submenu "Library". Relates to #430 4853760f Suppress logs of successful DB migrations applied when running for the first time 0cbb0aca Skip songs with less than 31 seconds, as per Last.fm specification 5040f6fd Fix label abe80157 Add option to disable external scrobbling per player 50015182 Move user properties (like session keys) to their own table 265f33ed Remove clearServiceWorkerCache, not needed anymore. (#1205) 99be8444 Disable completely external scrobblers if feature is disabled (DevEnableScrobble) f4ddd201 Send the time the track started playing when scrobbling 056f0b94 Refactor: Consolidate scrobbling logic in play_tracker 76acd7da Don't send scrobbles/nowPlaying updates to Last.fm if user has not authorized 8af7dab2 Fix wrong warning about ignored NowPlaying a7509c9f Send NowPlaying and Scrobbles to Last.fm d5461d0a Refactor Agents to be singleton f9fa9667 Show user-friendly message when error occurs in Last.fm callback endpoint 5fbfd9c8 Implement Last.fm account linking UI 8b62a58b Remove limitation of only scrobbling tracks longer than 30 seconds 743e4697 Use singleton in other places as well 1f997357 Expose Last.fm's ApiKey to UI 143cde37 Implement Last.FM Web authentication flow 502a719e Implement Last.FM Desktop Auth flow endpoints 8ee5c1f2 Initial Last.fm UI implementation 0495e421 Fix Last.fm API method signature ffa76bba Add flag to disable Scrobble config in the UI a4f91b74 Add Last.FM Authentication methods 73e1a8fa Remove false-positive on new version detection 877f01bd Show notification if server is updated 47bcf719 Fix cookie warning 197d430d Fix lint error 4e1957ca Update Go dependencies 25db2cb0 Add concurrency test for singleton 80b2c2f3 Try to register all playing music in GetNowPlaying 97434c17 Fix GetNowPlaying endpoint showing only the last play f8ee6db7 New implementation of NowPlaying 0df0ac07 Add logos to badges c09468e1 Option to allow auto-login during development. cf553ce8 Don't show "logout" when authenticated by Header 31ea0338 Fix subsonic token when authenticating by Header 66b74c81 Encrypt passwords in DB (#1187) d42dfafa Add username to request.Context 84413b54 Bump @testing-library/jest-dom from 5.13.0 to 5.14.1 in /ui (#1176) b590c31e Fix stream url, after changes to subsonic client api c4623d7b Don't show "empty" dates e0fd1c6a Add "Last Played" column to SongList 86271f04 Optimize refresh events for scrobble endpoint fb7229a5 Refech using getMany, reducing the number of API calls 521d1ff2 Disable realip middleware when using the reverse proxy authentication feature d3db41ae Bump github.com/go-chi/httprate version 8bf0089a Bump github.com/ReneKroon/ttlcache/ and github.com/microcosm-cc/bluemonday versions b65e7629 Only send events to clients who need it 5f6f74ff Always use httpClient to call APIs 8383527a Only refetch changed resources when receive a "refreshResource" event 8a56584a Removed the albumSong workaround, as React-Admin's cache seems to behave better now 667701be Less warning messages when first running it. 59b99d22 No need to check for first time when authenticating. One less SQL call per request d54129ec Rename app package to nativeapi 03efc481 Refactor routing, changes API URLs (#1171) bed2f017 Fix index of songs in downloaded playlist 6bd4c0f6 Reverse proxy authentication support (#1152) b445cdd6 Use a dedicated api-key/secret pair for Last.FM e31802d2 Only send "refresh" event if SetRating was successful cefc9399 Trigger UI refresh on media annotation events: star, setRating and scrobble 2afb2db7 Refactor for readability 7f85ecd5 Trigger a UI refresh when the scanner finds changes. cb6aa494 Bump github.com/lestrrat-go/jwx from 1.2.0 to 1.2.1 (#1167) b7f47c88 Bump github.com/onsi/ginkgo from 1.16.3 to 1.16.4 (#1163) adb09c9c Bump @testing-library/jest-dom from 5.12.0 to 5.13.0 in /ui (#1162) 0c9e0ff8 Bump prettier from 2.3.0 to 2.3.1 in /ui (#1161) f9eec5e4 Refactored agents calling into its own struct 6c1ba8f0 Add tests to core.Share 110e17b0 Make MockRepo names more consistent 779571a0 go mod tidy af210c89 Add Native Sharing REST API (#1150) e80cf80d Move all Spotify and LastFM code into only one folder for each 182e3ec7 Update zh-Hans.json (#1160) 65ccd4c9 Parse ParamBool case-insensitively (#1151) bebfe296 Allow updating only specific columns 9da9d73c Don't panic when taglib returns an error cd242695 Foundational work to enable multi-valued tags 519c8934 Omit empty fields from Native API responses 336d891e Bump github.com/ReneKroon/ttlcache/v2 from 2.5.0 to 2.6.0 9b4b28f6 Bump ginkgo/gomega versions 39c560a5 Remove unused web-vitals package c5abdc19 Fix recursive bug in Last.FM calls without mbid ead2095d Respect EnableLogRedacting config when pretty printing configuration 7b05c492 Add devEnableShare config option (#1141) 327c259a Create share table and repository. (#930) 675cbe11 Fix updatePlaylist not updating fields comment and public. 91a91f7e GetCoverArt returns placeholder if id is missing 7bbb09e5 Add tests for WeightedRandomChooser dd56a779 Rename variable with conflicting name a38e478a Better SimilarSongs algorithm 1940267a Handle functions with params in sort order. 01f3ce02 Add a timeout to background task 48b6fa7f Don't use request's context when refreshing artist info in background 25d62cd7 Set retention time for uploaded artifacts to 7 days ed01946a Embed Last.FM error responses, making the tests faster 89b12b34 Retry calls to Last.FM without MBIDs when if returns artist invalid (#1138) 4e0177ee Always update artist info, even if info is fresh b3980532 Include a shared Last.FM api key, providing zero conf ArtistInfo (bio/top songs/similar artists) db11b6b8 Remove decoration from reflex output 60d50de8 Refactoring to make common components usage more uniform 0941fbc0 Fix lag on albumList toggling (#1136) 4217c75c Upgrade to Node v16 409020a5 Bump github.com/ReneKroon/ttlcache/v2 from 2.4.0 to 2.5.0 b4832c36 Bump github.com/golangci/golangci-lint from 1.40.0 to 1.40.1 1de7366e Bump @material-ui/lab from 4.0.0-alpha.57 to 4.0.0-alpha.58 in /ui ab1bc619 Bump @testing-library dependencies ad4db122 Bump hosted-git-info from 2.8.8 to 2.8.9 in /ui (#1111) 200b815c Bump url-parse from 1.4.7 to 1.5.1 in /ui (#1107) 5631493c Upgrade Web UI to Create-React-App 4 and React 17 (#1105)