Jellyfin 10.10.6 → 10.11.2
4 releases · 10 breaking changes · 3 security fixes · 3 advisories fixed
3security10breaking2deprecated30feature11fix
Vulnerabilities fixed by this upgrade
- low GHSA-rrr6-mvwg-9pg9 Resource Exhaustion DoS via Branding Endpoint
- medium CVE-2025-32012 IP Spoofing leading to potential DoS
- high CVE-2025-31499 FFmpeg Argument Injection
Breaking changes
- breaking Remove chapters on file change [PR #14984], by @Shadowghost in 10.11.0
- breaking Remove appsettings.json loading component from startup server [PR #14275], by @JPVenson in 10.11.0
- breaking Remove 10.11.z EFcore migration warnings [PR #13972], by @ferferga in 10.11.0
- breaking Remove the hashed password from startup users response [PR #13904], by @thornbill in 10.11.0
- breaking Remove all DB data on item removal, delete internal trickplay files [PR #13753], by @Shadowghost in 10.11.0
- breaking Remove deprecated GetWakeOnLanInfo endpoint [PR #13606], by @nielsvanvelzen in 10.11.0
- breaking Remove check-backport CI action [PR #13523], by @joshuaboniface in 10.11.0
- breaking Remove useless checks and dead code [PR #13405], by @Bond-009 in 10.11.0
- breaking Removed RemoveOldPlugins configuration flag [PR #13102], by @RealGreenDragon in 10.11.0
- breaking Remove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost in 10.10.7
Security changes
- security Update password reset to always return the same response structure [PR #15254], by @thornbill in 10.11.2
- security Fix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost in 10.10.7
- security Fix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson in 10.10.7
Deprecations
- deprecated Deprecate OnPlaybackXXX API operations in favor of ReportPlaybackXXX [PR #13993], by @nielsvanvelzen in 10.11.0
- deprecated Add option to disable deprecated legacy authorization options [PR #13306], by @nielsvanvelzen in 10.11.0
Every release in between
securityUpdate password reset to always return the same response structure [PR #15254], by @thornbill
fixFix legacy migration file checks [PR #15322], by @crobibero
otherUpdate file size when refreshing metadata [PR #15325], by @vinnyspb
otherSkip too large extracted season numbers [PR #15326], by @Shadowghost
fixfix: in optimistic locking, key off table is locked [PR #15328], by @evanreichard
otherIgnore initial delay in audio-only containers [PR #15247], by @nyanmisaka
otherImprove symlink handling [PR #15209], by @Shadowghost
fixFix pagination and sorting for folders [PR #15187], by @Shadowghost
otherUpdate dependency z440.atl.core to 7.6.0 [PR #15225], by @Bond-009
featureAdd season number fallback for OMDB and TMDB plugins [PR #15113], by @ivanjx
otherSkip invalid database migration [PR #15212], by @crobibero
otherSkip directory entry when restoring from backup [PR #15196], by @crobibero
otherSkip extracted files in migration if bad timestamp or no access [PR #15220], by @JJBlue
otherNormalize paths in database queries [PR #15217], by @theguymadmax
otherOnly save chapters that are within the runtime of the video file [PR #15176], by @CeruleanRed
otherFilter plugins by id instead of name [PR #15197], by @crobibero
otherPlay selected song first with instant mix [PR #15133], by @theguymadmax
fixFix Has(Imdb/Tmdb/Tvdb)Id checks [PR #15126], by @MBR-0001
otherSkip extracted files in migration if bad timestamp or no access [PR #15112], by @Shadowghost
otherClean up BackupService [PR #15170], by @crobibero
otherInitialize transcode marker during startup [PR #15194], by @crobibero
otherMake priority class setting more robust [PR #15177], by @gnattu
otherLower required tmp dir size to 512MiB [PR #15098], by @Bond-009
fixFix XmlOutputFormatter [PR #15164], by @crobibero
otherMake season paths case-insensitive [PR #15102], by @theguymadmax
fixFix LiveTV images not saving to database [PR #15083], by @theguymadmax
otherSpeed-up trickplay migration [PR #15054], by @Shadowghost
otherOptimize WhereReferencedItemMultipleTypes filtering [PR #15087], by @theguymadmax
fixFix videos with cropping metadata are probed as anamorphic [PR #15144], by @nyanmisaka
otherReject stream copy of HDR10+ video if the client does not support HDR10 [PR #15072], by @nyanmisaka
otherLog the message more clear when network manager is not ready [PR #15055], by @gnattu
otherSkip invalid keyframe cache data [PR #15032], by @Shadowghost
featureAdd Full system backup feature [PR #13945], by @JPVenson
featureAdd .gitignore style ignoring [PR #13906], by @Shadowghost
featureAdd Api and startup check for sufficient storage capacity [PR #13888], by @JPVenson
featureAdded Setup overlay app to communicate status of startup [PR #12880], by @JPVenson
featureRemove the ability to auto port forward [PR #13222], by @Bond-009
featureRefactor library.db into jellyfin.db and EFCore [PR #12798], by @JPVenson
featureadd xmbc nfo uniqueid type norminalisation [PR #14965], by @KGT1
featureFix CA1051 warning, Change public field to auto-property [PR #14827], by @tjwalkr3
featureOffload 1080p+ subtitle scaling to RKRGA [PR #14179], by @nyanmisaka
featureEnable OpenCL deinterlacer for AMF on Windows when available [PR #14144], by @nyanmisaka
featureUse VBR and MBBRC in QSV encoders for better quality [PR #14079], by @nyanmisaka
featureFix the transparency issue of ASS subtitle rendering in HWA [PR #14024], by @nyanmisaka
featureAdd DoVi Profile 5 support for Rockchip RKMPP [PR #13911], by @nyanmisaka
featureAdd ServerName to startup configuration [PR #13901], by @thornbill
featureAdd missing public properties to SystemInfo response [PR #13822], by @thornbill
featureReduce allocations, simplifed code, faster implementation, included tests - StreamInfo.ToUrl [PR #9369], by @Shadowghost
featureFix only returning one item from /Item/Latest api. [PR #12492], by @scampower3
featureUse TryAdd instead of Add when registering custom OpenAPI responses [PR #14997], by @crobibero
breakingRemove chapters on file change [PR #14984], by @Shadowghost
featureAdd check for processing recursive data structures [PR #14897], by @JPVenson
featureAdd tag filtering and random sorting to GetSimilarItems [PR #14918], by @theguymadmax
featureAdd explicit reference check to migration [PR #14887], by @JPVenson
featureAdd Jellyfin.CodeAnalysis project to abi diff [PR #14875], by @JPVenson
featureAdd Check for ItemValues [PR #14860], by @JPVenson
featureAdd People Dedup and multiple progress fixes [PR #14848], by @JPVenson
featureAdd schema to 503 headers [PR #14840], by @crobibero
featureAdd ec3 to audio file extensions [PR #14799], by @Shadowghost
featureAllow non-admin users to subscribe to their own Sessions [PR #13767], by @KGT1
featureAdd fast path to check for empty ignore files [PR #14782], by @Bond-009
featureAdd 1-second tolerance to resume playback completion check [PR #14774], by @theguymadmax
breakingRemove appsettings.json loading component from startup server [PR #14275], by @JPVenson
deprecatedDeprecate OnPlaybackXXX API operations in favor of ReportPlaybackXXX [PR #13993], by @nielsvanvelzen
breakingRemove 10.11.z EFcore migration warnings [PR #13972], by @ferferga
breakingRemove the hashed password from startup users response [PR #13904], by @thornbill
breakingRemove all DB data on item removal, delete internal trickplay files [PR #13753], by @Shadowghost
breakingRemove deprecated GetWakeOnLanInfo endpoint [PR #13606], by @nielsvanvelzen
breakingRemove check-backport CI action [PR #13523], by @joshuaboniface
breakingRemove useless checks and dead code [PR #13405], by @Bond-009
deprecatedAdd option to disable deprecated legacy authorization options [PR #13306], by @nielsvanvelzen
breakingRemoved RemoveOldPlugins configuration flag [PR #13102], by @RealGreenDragon
+356 more items in the release notesotherConfigurations behind a reverse proxy that did not explicitly configure trusted proxies will not work after this release. This was never a supported configuration, so please ensure you correct your configuration before upgrading. See the updated docs here for more information.
securityFix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost
securityFix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson
fixFix regression where "Search for missing metadata" not handling cast having multiple roles [PR #13720], by @Lampan-git
otherClone fallback audio tags instead of use ATL.Track.set [PR #13694], by @gnattu
otherBackport 10.11 API enum changes [PR #13835], by @nielsvanvelzen
otherSupport more rating formats [PR #13639], by @IDisposable
fixFix stackoverflow in MediaSourceCount [PR #12907], by @JPVenson
otherUpgrade LrcParser to 2025.228.1 [PR #13659], by @congerh
otherInclude Role and SortOrder in MergePeople to fix "Search for missing metadata" [PR #13618], by @Lampan-git
otherDelete children from cache on parent delete [PR #13601], by @Bond-009
fixFix overwrite of PremierDate with a year-only value [PR #13598], by @IDisposable
otherWait for ffmpeg to exit on Windows before we try deleting the concat file [PR #13593], by @Bond-009
fixFix 4K filtering when grouping movies into collections [PR #13594], by @theguymadmax
breakingRemove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost
otherUpdate dependency z440.atl.core to 6.20.0 [PR #13845], by @Shadowghost