Jellyfin 10.10.4 → 10.10.7
3 releases · 1 breaking change · 2 security fixes · 2 advisories fixed
2security1breaking0deprecated2feature16fix
Vulnerabilities fixed by this upgrade
- medium CVE-2025-32012 IP Spoofing leading to potential DoS
- high CVE-2025-31499 FFmpeg Argument Injection
Breaking changes
- breaking Remove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost in 10.10.7
Security changes
- security Fix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost in 10.10.7
- security Fix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson in 10.10.7
Every release in between
otherConfigurations behind a reverse proxy that did not explicitly configure trusted proxies will not work after this release. This was never a supported configuration, so please ensure you correct your configuration before upgrading. See the updated docs here for more information.
securityFix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost
securityFix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson
fixFix regression where "Search for missing metadata" not handling cast having multiple roles [PR #13720], by @Lampan-git
otherClone fallback audio tags instead of use ATL.Track.set [PR #13694], by @gnattu
otherBackport 10.11 API enum changes [PR #13835], by @nielsvanvelzen
otherSupport more rating formats [PR #13639], by @IDisposable
fixFix stackoverflow in MediaSourceCount [PR #12907], by @JPVenson
otherUpgrade LrcParser to 2025.228.1 [PR #13659], by @congerh
otherInclude Role and SortOrder in MergePeople to fix "Search for missing metadata" [PR #13618], by @Lampan-git
otherDelete children from cache on parent delete [PR #13601], by @Bond-009
fixFix overwrite of PremierDate with a year-only value [PR #13598], by @IDisposable
otherWait for ffmpeg to exit on Windows before we try deleting the concat file [PR #13593], by @Bond-009
fixFix 4K filtering when grouping movies into collections [PR #13594], by @theguymadmax
breakingRemove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost
otherUpdate dependency z440.atl.core to 6.20.0 [PR #13845], by @Shadowghost
fixCrashes on Apple silicon [Issue #13379] should be fixed by the bump to .NET framework version 8.0.13 in this release
otherUpdate dependency z440.atl.core to 6.16.0 [PR #13526], by @crobibero
fixFix subnet contains check [PR #13489], by @gnattu
fixFix image encoding concurrency limit [PR #13532], by @gnattu
fixFix SchedulesDirect image prefetching [PR #13469], by @Shadowghost
otherSkip allowed tags check for parents of an item [PR #12721], by @elfalem
fixFix LiveTV Guide Backdrop image not updating [PR #13504], by @IDisposable
otherCorrectly handle audio number tag fallbacks [PR #13490], by @gnattu
featureAllow api key to subscribe to admin websockets [PR #13499], by @crobibero
fixFix rating mistake in us.csv [PR #13487], by @Bond-009
otherFall back to calculating mime type from path when needed [PR #13439], by @Bond-009
fixFix interface ordering again [PR #13448], by @Shadowghost
fixFixed Websocket not locking state correctly [PR #13459], by @JPVenson
featureAdd check to prevent downgrade from future EFCore refactor [PR #13103], by @JPVenson
otherOpen files with FileShare.Read for BlurHash calculations [PR #13425], by @Bond-009
otherDon't select audio stream and codec explicitly for copy when bitrate exceeds limit [PR #13423], by @gnattu
fixFix parallel use of not thread-safe SubtitleFormat instance [PR #13384], by @alltilla
otherUse WriteThrough for ImageSaver [PR #13411], by @gnattu
otherCatch IOExceptions for GetFileSystemMetadata [PR #13390], by @gnattu
fixFix rating levels [PR #13388], by @Shadowghost
fixFix: handling of elements in NfoParser [PR #13092], by @TheMelmacian
fixFix interface selection [PR #13382], by @Shadowghost