Jellyfin 10.10.4 → 10.11.9
13 releases · 12 breaking changes · 8 security fixes · 8 advisories fixed
8security12breaking2deprecated38feature86fix
Vulnerabilities fixed by this upgrade
- 5.7 CVE-2026-49220 Potential XSS in user management
- high CVE-2026-35033 Potential SSRF + Arbitrary file read via stream argument injection
- 6.5 CVE-2026-35034 Potential Application DoS from excessively large SyncPlay group names
- high CVE-2026-35032 Potential SSRF + Arbitrary file read via LiveTV M3U tuner
- 9.9 CVE-2026-35031 Potential RCE via subtitle upload path traversal + .strm chain
- low GHSA-rrr6-mvwg-9pg9 Resource Exhaustion DoS via Branding Endpoint
- medium CVE-2025-32012 IP Spoofing leading to potential DoS
- high CVE-2025-31499 FFmpeg Argument Injection
Breaking changes
- breaking Remove -copyts and add -flush_packets 1 to subtitle extraction [PR #16440], by @Molier in 10.11.7
- breaking Remove InheritedTags and update tag filtering logic [PR #15493], by @theguymadmax in 10.11.3
- breaking Remove chapters on file change [PR #14984], by @Shadowghost in 10.11.0
- breaking Remove appsettings.json loading component from startup server [PR #14275], by @JPVenson in 10.11.0
- breaking Remove 10.11.z EFcore migration warnings [PR #13972], by @ferferga in 10.11.0
- breaking Remove the hashed password from startup users response [PR #13904], by @thornbill in 10.11.0
- breaking Remove all DB data on item removal, delete internal trickplay files [PR #13753], by @Shadowghost in 10.11.0
- breaking Remove deprecated GetWakeOnLanInfo endpoint [PR #13606], by @nielsvanvelzen in 10.11.0
- breaking Remove check-backport CI action [PR #13523], by @joshuaboniface in 10.11.0
- breaking Remove useless checks and dead code [PR #13405], by @Bond-009 in 10.11.0
- breaking Removed RemoveOldPlugins configuration flag [PR #13102], by @RealGreenDragon in 10.11.0
- breaking Remove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost in 10.10.7
Security changes
- security Fixes CVE-2026-49220: Potential XSS in user management in 10.11.8
- security Fix for GHSA-j2hf-x4q5-47j3, by @Shadowghost in 10.11.7
- security Fix for GHSA-8fw7-f233-ffr8, by @Shadowghost in 10.11.7
- security Fix for GHSA-v2jv-54xj-h76w, by @Shadowghost in 10.11.7
- security Fix for GHSA-jh22-fw8w-2v9x, by @Shadowghost in 10.11.7
- security Update password reset to always return the same response structure [PR #15254], by @thornbill in 10.11.2
- security Fix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost in 10.10.7
- security Fix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson in 10.10.7
Deprecations
- deprecated Deprecate OnPlaybackXXX API operations in favor of ReportPlaybackXXX [PR #13993], by @nielsvanvelzen in 10.11.0
- deprecated Add option to disable deprecated legacy authorization options [PR #13306], by @nielsvanvelzen in 10.11.0
Every release in between
fixFix rate control in av1_amf encoder [PR #16819], by @nyanmisaka
fixFix UserManager after EFcore refactor [PR #15368], by @JPVenson
otherUpdate log for user session related concurrency update fails [PR #16845], by @JPVenson
featureAllow HDR10 for VPP tonemapping [PR #16718], by @gnattu
otherUse strict QSV CPB size for less powerful H.264 decoder [PR #16743], by @nyanmisaka
securityFixes CVE-2026-49220: Potential XSS in user management
otherHandle folders without associated library in FixLibrarySubtitleDownloadLanguages [PR #16540], by @Shadowghost
fixFix subtitle saving [PR #16539], by @MBR-0001
fixFix querying media with language filters [PR #16538], by @MBR-0001
securityFix for GHSA-j2hf-x4q5-47j3, by @Shadowghost
securityFix for GHSA-8fw7-f233-ffr8, by @Shadowghost
securityFix for GHSA-v2jv-54xj-h76w, by @Shadowghost
securityFix for GHSA-jh22-fw8w-2v9x, by @Shadowghost
fixFix CA1810 build error [PR #16522], by @Bond-009
fixFix Null was not checked before using the H264 profile [PR #16519], by @nyanmisaka
breakingRemove -copyts and add -flush_packets 1 to subtitle extraction [PR #16440], by @Molier
fixFix lint issue [PR #16514], by @theguymadmax
fixFix nullref ex in font handling [PR #16369], by @Bond-009
fixFix restore backup metadata location [PR #16425], by @theguymadmax
fixFix NFO saver using wrong provider ID for collectionnumber [PR #16449], by @theguymadmax
fixFix readrate options in FFmpeg 8.1 [PR #16423], by @nyanmisaka
otherApply analyzeduration and probesize for subtitle streams to improve codec parameter detection [PR #16293], by @IceStormNG
fixFix filter detection in FFmpeg 8.1 [PR #16392], by @nyanmisaka
fixFix subtitle extraction caching empty files [PR #16257], by @lowbit
fixFix hls segment length adjustment for remuxed content [PR #16341], by @crimsonspecter
fixFix broken library subtitle download settings [PR #16204], by @MBR-0001
otherCheckpoint WAL before moving library.db in migration [PR #16253], by @theguymadmax
fixFix nullref in Season.GetEpisodes when the season is detached from a series [PR #16150], by @dfederm
otherReattach user data after item removal during library scan [PR #16227], by @dfederm
otherDeduplicate provider IDs during MigrateLibraryDb migration [PR #16226], by @dfederm
otherSkip image checks for empty folders [PR #16231], by @theguymadmax
fixFix TMDB image URLs missing size parameter [PR #16116], by @saltpi
fixFix random sort returning duplicate items [PR #16098], by @theguymadmax
fixFix SessionInfoWebSocketListener not using SessionInfoDto [PR #16109], by @nielsvanvelzen
fixFix HLS playlist generation for transcodes with fractional framerate [PR #16053], by @IceStormNG
otherRehydrate cached UserData after reattachment [PR #16071], by @MarcoCoreDuo
fixFix TMDB crew department mapping [PR #16066], by @theguymadmax
otherRevert hidden directory ignore pattern [PR #16077], by @theguymadmax
otherPrioritize better matches on search [PR #15983], by @Shadowghost
fixFix artist display order [PR #15816], by @theguymadmax
otherRestore weekly refresh for library folder images [PR #16046], by @theguymadmax
otherBe more strict about PersonType assignment [PR #15872], by @Shadowghost
fixFix birthplace not saving correctly [PR #16020], by @theguymadmax
otherTrim music artist names [PR #15808], by @theguymadmax
featureAdd mblink creation logic to library update endpoint. [PR #15965], by @Collin-Swish
fixFix watched state not kept on Media replace/rename [PR #15899], by @MarcoCoreDuo
otherSkip hidden directories and .ignore paths in library monitoring [PR #16029], by @theguymadmax
otherRevert "always sort season by index number" [PR #15950], by @theguymadmax
fixFix crash when plugin repository has an invalid URL [PR #15961], by @theguymadmax
fixFix tag inheritance for Continue Watching queries [PR #15931], by @theguymadmax
fixFix playlist item de-duplication [PR #15858], by @Collin-Swish
otherPrefer US rating on fallback [PR #15793], by @Shadowghost
fixFix missing H.264 and AV1 SDR fallbacks in HLS playlist [PR #15833], by @nyanmisaka
featureadd CultureDto cache [PR #15826], by @cvium
fixFix the use of HWA in unsupported H.264 Hi422P/Hi444PP [PR #15819], by @nyanmisaka
otherEnforce more strict webm check [PR #15807], by @gnattu
fixFix video lacking SAR and DAR are marked as anamorphic [PR #15834], by @nyanmisaka
otherUse hvc1 codectag for Dolby Vision 8.4 [PR #15835], by @gnattu
fixFix unnecessary database JOINs in ApplyNavigations [PR #15666], by @andrewrabert
otherSkip invalid ignore rules [PR #15746], by @Shadowghost
fixFix backdrop images being deleted when stored with media [PR #15766], by @theguymadmax
fixFix NullReferenceException in ApplyOrder method [PR #15768], by @theguymadmax
fixFix AV1 decoding hang regression on RK3588 [PR #15776], by @nyanmisaka
fixFix collections display order [PR #15767], by @theguymadmax
fixFix parental rating filtering with sub-scores [PR #15786], by @theguymadmax
fixFix case sensitivity edge case [PR #15752], by @Collin-Swish
fixFix trickplay images using wrong item on alternate versions [PR #15757], by @theguymadmax
fixFix blocking in async context in LimitedConcurrencyLibraryScheduler [PR #15662], by @SapientGuardian
otherUse original name for MusicAritist matching [PR #15689], by @gnattu
otherBackport dependencies [PR #15723], by @Shadowghost
fixFix symlinked file size [PR #15681], by @ivanjx
fixFix ItemAdded event triggering when updating metadata [PR #15680], by @theguymadmax
fixFix: Add .ts fallback for video streams to prevent crash [PR #15690], by @martenumberto
fixFix stack overflow during scan (#15000) [PR #15698], by @myzhysz
fixFix the empty output of trickplay on RK3576 [PR #15670], by @nyanmisaka
fixFix ResolveLinkTarget crashing on exFAT drives [PR #15568], by @theguymadmax
otherCache OpenApi document generation [PR #15672], by @crobibero
otherRevert "Localization/iso6392.txt: change pob and pop" [PR #15555], by @MBR-0001
featureAdd hidden file check in BdInfoDirectoryInfo.cs. [PR #15582], by @QuintonQu
fixFix isMovie filter logic [PR #15594], by @theguymadmax
fixFix locked fields not saving [PR #15564], by @theguymadmax
otherSave item to database before providers run to prevent FK errors [PR #15563], by @theguymadmax
otherPrevent copying HDR streams when only SDR is supported [PR #15556], by @gnattu
fixFix NullReferenceException in filesystem path comparison [PR #15548], by @theguymadmax
otherRestrict first video frame probing to file protocol [PR #15557], by @gnattu
fixFix series DateLastMediaAdded not updating when new episodes are added [PR #15472], by @theguymadmax
fixFix movie titles using folder name when NFO saver is enabled [PR #15529], by @theguymadmax
fixFix tmdbid not detected in single movie folder [PR #14955], by @theguymadmax
fixFix font extraction for certain transcoding settings [PR #15502], by @Iksas
fixFix playlist DateCreated and DateLastMediaAdded not being set [PR #15508], by @theguymadmax
featureAdd 1 minute tolerance for NFO change detection [PR #15514], by @theguymadmax
breakingRemove InheritedTags and update tag filtering logic [PR #15493], by @theguymadmax
fixFix .ignore handling for directories [PR #15501], by @theguymadmax
fixFix gitignore-style not working properly on windows. [PR #15487], by @CBPJ
otherImprove season folder parsing [PR #15404], by @theguymadmax
otherDon't error out when searching for marker files fails [PR #15466], by @Bond-009
fixFix NullReferenceException in GetPathProtocol when path is null [PR #15462], by @theguymadmax
otherResolve symlinks for static media source infos [PR #15263], by @revam
otherCheck if target exists before trying to follow it [PR #15468], by @Bond-009
fixFix collection grouping in mixed libraries [PR #15373], by @theguymadmax
fixFix AncestorIds not migrating [PR #15446], by @theguymadmax
fixFix System.NullReferenceException when people's role is null (10.11.z) [PR #15441], by @IceStormNG
otherInvalidate parent folder's cache on deletion/creation [PR #15423], by @theguymadmax
fixFix name filters to use only SortName [PR #15381], by @theguymadmax
otherDon't enforce a minimum amount of free space for the tmp and log dirs [PR #15390], by @Bond-009
fixFixed missing sort argument [PR #15413], by @JPVenson
fixFix item count display for collapsed items [PR #15380], by @theguymadmax
otherUpdate branding in Swagger page [PR #15422], by @nielsvanvelzen
fixFix search terms using diacritics [PR #15435], by @theguymadmax
featurefeat(sqlite): add timeout config [PR #15369], by @evanreichard
securityUpdate password reset to always return the same response structure [PR #15254], by @thornbill
fixFix legacy migration file checks [PR #15322], by @crobibero
otherUpdate file size when refreshing metadata [PR #15325], by @vinnyspb
otherSkip too large extracted season numbers [PR #15326], by @Shadowghost
fixfix: in optimistic locking, key off table is locked [PR #15328], by @evanreichard
otherIgnore initial delay in audio-only containers [PR #15247], by @nyanmisaka
otherImprove symlink handling [PR #15209], by @Shadowghost
fixFix pagination and sorting for folders [PR #15187], by @Shadowghost
otherUpdate dependency z440.atl.core to 7.6.0 [PR #15225], by @Bond-009
featureAdd season number fallback for OMDB and TMDB plugins [PR #15113], by @ivanjx
otherSkip invalid database migration [PR #15212], by @crobibero
otherSkip directory entry when restoring from backup [PR #15196], by @crobibero
otherSkip extracted files in migration if bad timestamp or no access [PR #15220], by @JJBlue
otherNormalize paths in database queries [PR #15217], by @theguymadmax
otherOnly save chapters that are within the runtime of the video file [PR #15176], by @CeruleanRed
otherFilter plugins by id instead of name [PR #15197], by @crobibero
otherPlay selected song first with instant mix [PR #15133], by @theguymadmax
fixFix Has(Imdb/Tmdb/Tvdb)Id checks [PR #15126], by @MBR-0001
otherSkip extracted files in migration if bad timestamp or no access [PR #15112], by @Shadowghost
otherClean up BackupService [PR #15170], by @crobibero
otherInitialize transcode marker during startup [PR #15194], by @crobibero
otherMake priority class setting more robust [PR #15177], by @gnattu
otherLower required tmp dir size to 512MiB [PR #15098], by @Bond-009
fixFix XmlOutputFormatter [PR #15164], by @crobibero
otherMake season paths case-insensitive [PR #15102], by @theguymadmax
fixFix LiveTV images not saving to database [PR #15083], by @theguymadmax
otherSpeed-up trickplay migration [PR #15054], by @Shadowghost
otherOptimize WhereReferencedItemMultipleTypes filtering [PR #15087], by @theguymadmax
fixFix videos with cropping metadata are probed as anamorphic [PR #15144], by @nyanmisaka
otherReject stream copy of HDR10+ video if the client does not support HDR10 [PR #15072], by @nyanmisaka
otherLog the message more clear when network manager is not ready [PR #15055], by @gnattu
otherSkip invalid keyframe cache data [PR #15032], by @Shadowghost
featureAdd Full system backup feature [PR #13945], by @JPVenson
featureAdd .gitignore style ignoring [PR #13906], by @Shadowghost
featureAdd Api and startup check for sufficient storage capacity [PR #13888], by @JPVenson
featureAdded Setup overlay app to communicate status of startup [PR #12880], by @JPVenson
featureRemove the ability to auto port forward [PR #13222], by @Bond-009
featureRefactor library.db into jellyfin.db and EFCore [PR #12798], by @JPVenson
featureadd xmbc nfo uniqueid type norminalisation [PR #14965], by @KGT1
featureFix CA1051 warning, Change public field to auto-property [PR #14827], by @tjwalkr3
featureOffload 1080p+ subtitle scaling to RKRGA [PR #14179], by @nyanmisaka
featureEnable OpenCL deinterlacer for AMF on Windows when available [PR #14144], by @nyanmisaka
featureUse VBR and MBBRC in QSV encoders for better quality [PR #14079], by @nyanmisaka
featureFix the transparency issue of ASS subtitle rendering in HWA [PR #14024], by @nyanmisaka
featureAdd DoVi Profile 5 support for Rockchip RKMPP [PR #13911], by @nyanmisaka
featureAdd ServerName to startup configuration [PR #13901], by @thornbill
featureAdd missing public properties to SystemInfo response [PR #13822], by @thornbill
featureReduce allocations, simplifed code, faster implementation, included tests - StreamInfo.ToUrl [PR #9369], by @Shadowghost
featureFix only returning one item from /Item/Latest api. [PR #12492], by @scampower3
featureUse TryAdd instead of Add when registering custom OpenAPI responses [PR #14997], by @crobibero
breakingRemove chapters on file change [PR #14984], by @Shadowghost
featureAdd check for processing recursive data structures [PR #14897], by @JPVenson
featureAdd tag filtering and random sorting to GetSimilarItems [PR #14918], by @theguymadmax
featureAdd explicit reference check to migration [PR #14887], by @JPVenson
featureAdd Jellyfin.CodeAnalysis project to abi diff [PR #14875], by @JPVenson
featureAdd Check for ItemValues [PR #14860], by @JPVenson
featureAdd People Dedup and multiple progress fixes [PR #14848], by @JPVenson
featureAdd schema to 503 headers [PR #14840], by @crobibero
featureAdd ec3 to audio file extensions [PR #14799], by @Shadowghost
featureAllow non-admin users to subscribe to their own Sessions [PR #13767], by @KGT1
featureAdd fast path to check for empty ignore files [PR #14782], by @Bond-009
featureAdd 1-second tolerance to resume playback completion check [PR #14774], by @theguymadmax
breakingRemove appsettings.json loading component from startup server [PR #14275], by @JPVenson
deprecatedDeprecate OnPlaybackXXX API operations in favor of ReportPlaybackXXX [PR #13993], by @nielsvanvelzen
breakingRemove 10.11.z EFcore migration warnings [PR #13972], by @ferferga
breakingRemove the hashed password from startup users response [PR #13904], by @thornbill
breakingRemove all DB data on item removal, delete internal trickplay files [PR #13753], by @Shadowghost
breakingRemove deprecated GetWakeOnLanInfo endpoint [PR #13606], by @nielsvanvelzen
breakingRemove check-backport CI action [PR #13523], by @joshuaboniface
breakingRemove useless checks and dead code [PR #13405], by @Bond-009
deprecatedAdd option to disable deprecated legacy authorization options [PR #13306], by @nielsvanvelzen
breakingRemoved RemoveOldPlugins configuration flag [PR #13102], by @RealGreenDragon
+356 more items in the release notesotherConfigurations behind a reverse proxy that did not explicitly configure trusted proxies will not work after this release. This was never a supported configuration, so please ensure you correct your configuration before upgrading. See the updated docs here for more information.
securityFix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost
securityFix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson
fixFix regression where "Search for missing metadata" not handling cast having multiple roles [PR #13720], by @Lampan-git
otherClone fallback audio tags instead of use ATL.Track.set [PR #13694], by @gnattu
otherBackport 10.11 API enum changes [PR #13835], by @nielsvanvelzen
otherSupport more rating formats [PR #13639], by @IDisposable
fixFix stackoverflow in MediaSourceCount [PR #12907], by @JPVenson
otherUpgrade LrcParser to 2025.228.1 [PR #13659], by @congerh
otherInclude Role and SortOrder in MergePeople to fix "Search for missing metadata" [PR #13618], by @Lampan-git
otherDelete children from cache on parent delete [PR #13601], by @Bond-009
fixFix overwrite of PremierDate with a year-only value [PR #13598], by @IDisposable
otherWait for ffmpeg to exit on Windows before we try deleting the concat file [PR #13593], by @Bond-009
fixFix 4K filtering when grouping movies into collections [PR #13594], by @theguymadmax
breakingRemove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost
otherUpdate dependency z440.atl.core to 6.20.0 [PR #13845], by @Shadowghost
fixCrashes on Apple silicon [Issue #13379] should be fixed by the bump to .NET framework version 8.0.13 in this release
otherUpdate dependency z440.atl.core to 6.16.0 [PR #13526], by @crobibero
fixFix subnet contains check [PR #13489], by @gnattu
fixFix image encoding concurrency limit [PR #13532], by @gnattu
fixFix SchedulesDirect image prefetching [PR #13469], by @Shadowghost
otherSkip allowed tags check for parents of an item [PR #12721], by @elfalem
fixFix LiveTV Guide Backdrop image not updating [PR #13504], by @IDisposable
otherCorrectly handle audio number tag fallbacks [PR #13490], by @gnattu
featureAllow api key to subscribe to admin websockets [PR #13499], by @crobibero
fixFix rating mistake in us.csv [PR #13487], by @Bond-009
otherFall back to calculating mime type from path when needed [PR #13439], by @Bond-009
fixFix interface ordering again [PR #13448], by @Shadowghost
fixFixed Websocket not locking state correctly [PR #13459], by @JPVenson
featureAdd check to prevent downgrade from future EFCore refactor [PR #13103], by @JPVenson
otherOpen files with FileShare.Read for BlurHash calculations [PR #13425], by @Bond-009
otherDon't select audio stream and codec explicitly for copy when bitrate exceeds limit [PR #13423], by @gnattu
fixFix parallel use of not thread-safe SubtitleFormat instance [PR #13384], by @alltilla
otherUse WriteThrough for ImageSaver [PR #13411], by @gnattu
otherCatch IOExceptions for GetFileSystemMetadata [PR #13390], by @gnattu
fixFix rating levels [PR #13388], by @Shadowghost
fixFix: handling of elements in NfoParser [PR #13092], by @TheMelmacian
fixFix interface selection [PR #13382], by @Shadowghost