Jellyfin 10.10.6 → 10.11.5
7 releases · 11 breaking changes · 3 security fixes · 3 advisories fixed
3security11breaking2deprecated33feature44fix
Vulnerabilities fixed by this upgrade
- low GHSA-rrr6-mvwg-9pg9 Resource Exhaustion DoS via Branding Endpoint
- medium CVE-2025-32012 IP Spoofing leading to potential DoS
- high CVE-2025-31499 FFmpeg Argument Injection
Breaking changes
- breaking Remove InheritedTags and update tag filtering logic [PR #15493], by @theguymadmax in 10.11.3
- breaking Remove chapters on file change [PR #14984], by @Shadowghost in 10.11.0
- breaking Remove appsettings.json loading component from startup server [PR #14275], by @JPVenson in 10.11.0
- breaking Remove 10.11.z EFcore migration warnings [PR #13972], by @ferferga in 10.11.0
- breaking Remove the hashed password from startup users response [PR #13904], by @thornbill in 10.11.0
- breaking Remove all DB data on item removal, delete internal trickplay files [PR #13753], by @Shadowghost in 10.11.0
- breaking Remove deprecated GetWakeOnLanInfo endpoint [PR #13606], by @nielsvanvelzen in 10.11.0
- breaking Remove check-backport CI action [PR #13523], by @joshuaboniface in 10.11.0
- breaking Remove useless checks and dead code [PR #13405], by @Bond-009 in 10.11.0
- breaking Removed RemoveOldPlugins configuration flag [PR #13102], by @RealGreenDragon in 10.11.0
- breaking Remove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost in 10.10.7
Security changes
- security Update password reset to always return the same response structure [PR #15254], by @thornbill in 10.11.2
- security Fix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost in 10.10.7
- security Fix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson in 10.10.7
Deprecations
- deprecated Deprecate OnPlaybackXXX API operations in favor of ReportPlaybackXXX [PR #13993], by @nielsvanvelzen in 10.11.0
- deprecated Add option to disable deprecated legacy authorization options [PR #13306], by @nielsvanvelzen in 10.11.0
Every release in between
fixFix unnecessary database JOINs in ApplyNavigations [PR #15666], by @andrewrabert
otherSkip invalid ignore rules [PR #15746], by @Shadowghost
fixFix backdrop images being deleted when stored with media [PR #15766], by @theguymadmax
fixFix NullReferenceException in ApplyOrder method [PR #15768], by @theguymadmax
fixFix AV1 decoding hang regression on RK3588 [PR #15776], by @nyanmisaka
fixFix collections display order [PR #15767], by @theguymadmax
fixFix parental rating filtering with sub-scores [PR #15786], by @theguymadmax
fixFix case sensitivity edge case [PR #15752], by @Collin-Swish
fixFix trickplay images using wrong item on alternate versions [PR #15757], by @theguymadmax
fixFix blocking in async context in LimitedConcurrencyLibraryScheduler [PR #15662], by @SapientGuardian
otherUse original name for MusicAritist matching [PR #15689], by @gnattu
otherBackport dependencies [PR #15723], by @Shadowghost
fixFix symlinked file size [PR #15681], by @ivanjx
fixFix ItemAdded event triggering when updating metadata [PR #15680], by @theguymadmax
fixFix: Add .ts fallback for video streams to prevent crash [PR #15690], by @martenumberto
fixFix stack overflow during scan (#15000) [PR #15698], by @myzhysz
fixFix the empty output of trickplay on RK3576 [PR #15670], by @nyanmisaka
fixFix ResolveLinkTarget crashing on exFAT drives [PR #15568], by @theguymadmax
otherCache OpenApi document generation [PR #15672], by @crobibero
otherRevert "Localization/iso6392.txt: change pob and pop" [PR #15555], by @MBR-0001
featureAdd hidden file check in BdInfoDirectoryInfo.cs. [PR #15582], by @QuintonQu
fixFix isMovie filter logic [PR #15594], by @theguymadmax
fixFix locked fields not saving [PR #15564], by @theguymadmax
otherSave item to database before providers run to prevent FK errors [PR #15563], by @theguymadmax
otherPrevent copying HDR streams when only SDR is supported [PR #15556], by @gnattu
fixFix NullReferenceException in filesystem path comparison [PR #15548], by @theguymadmax
otherRestrict first video frame probing to file protocol [PR #15557], by @gnattu
fixFix series DateLastMediaAdded not updating when new episodes are added [PR #15472], by @theguymadmax
fixFix movie titles using folder name when NFO saver is enabled [PR #15529], by @theguymadmax
fixFix tmdbid not detected in single movie folder [PR #14955], by @theguymadmax
fixFix font extraction for certain transcoding settings [PR #15502], by @Iksas
fixFix playlist DateCreated and DateLastMediaAdded not being set [PR #15508], by @theguymadmax
featureAdd 1 minute tolerance for NFO change detection [PR #15514], by @theguymadmax
breakingRemove InheritedTags and update tag filtering logic [PR #15493], by @theguymadmax
fixFix .ignore handling for directories [PR #15501], by @theguymadmax
fixFix gitignore-style not working properly on windows. [PR #15487], by @CBPJ
otherImprove season folder parsing [PR #15404], by @theguymadmax
otherDon't error out when searching for marker files fails [PR #15466], by @Bond-009
fixFix NullReferenceException in GetPathProtocol when path is null [PR #15462], by @theguymadmax
otherResolve symlinks for static media source infos [PR #15263], by @revam
otherCheck if target exists before trying to follow it [PR #15468], by @Bond-009
fixFix collection grouping in mixed libraries [PR #15373], by @theguymadmax
fixFix AncestorIds not migrating [PR #15446], by @theguymadmax
fixFix System.NullReferenceException when people's role is null (10.11.z) [PR #15441], by @IceStormNG
otherInvalidate parent folder's cache on deletion/creation [PR #15423], by @theguymadmax
fixFix name filters to use only SortName [PR #15381], by @theguymadmax
otherDon't enforce a minimum amount of free space for the tmp and log dirs [PR #15390], by @Bond-009
fixFixed missing sort argument [PR #15413], by @JPVenson
fixFix item count display for collapsed items [PR #15380], by @theguymadmax
otherUpdate branding in Swagger page [PR #15422], by @nielsvanvelzen
fixFix search terms using diacritics [PR #15435], by @theguymadmax
featurefeat(sqlite): add timeout config [PR #15369], by @evanreichard
securityUpdate password reset to always return the same response structure [PR #15254], by @thornbill
fixFix legacy migration file checks [PR #15322], by @crobibero
otherUpdate file size when refreshing metadata [PR #15325], by @vinnyspb
otherSkip too large extracted season numbers [PR #15326], by @Shadowghost
fixfix: in optimistic locking, key off table is locked [PR #15328], by @evanreichard
otherIgnore initial delay in audio-only containers [PR #15247], by @nyanmisaka
otherImprove symlink handling [PR #15209], by @Shadowghost
fixFix pagination and sorting for folders [PR #15187], by @Shadowghost
otherUpdate dependency z440.atl.core to 7.6.0 [PR #15225], by @Bond-009
featureAdd season number fallback for OMDB and TMDB plugins [PR #15113], by @ivanjx
otherSkip invalid database migration [PR #15212], by @crobibero
otherSkip directory entry when restoring from backup [PR #15196], by @crobibero
otherSkip extracted files in migration if bad timestamp or no access [PR #15220], by @JJBlue
otherNormalize paths in database queries [PR #15217], by @theguymadmax
otherOnly save chapters that are within the runtime of the video file [PR #15176], by @CeruleanRed
otherFilter plugins by id instead of name [PR #15197], by @crobibero
otherPlay selected song first with instant mix [PR #15133], by @theguymadmax
fixFix Has(Imdb/Tmdb/Tvdb)Id checks [PR #15126], by @MBR-0001
otherSkip extracted files in migration if bad timestamp or no access [PR #15112], by @Shadowghost
otherClean up BackupService [PR #15170], by @crobibero
otherInitialize transcode marker during startup [PR #15194], by @crobibero
otherMake priority class setting more robust [PR #15177], by @gnattu
otherLower required tmp dir size to 512MiB [PR #15098], by @Bond-009
fixFix XmlOutputFormatter [PR #15164], by @crobibero
otherMake season paths case-insensitive [PR #15102], by @theguymadmax
fixFix LiveTV images not saving to database [PR #15083], by @theguymadmax
otherSpeed-up trickplay migration [PR #15054], by @Shadowghost
otherOptimize WhereReferencedItemMultipleTypes filtering [PR #15087], by @theguymadmax
fixFix videos with cropping metadata are probed as anamorphic [PR #15144], by @nyanmisaka
otherReject stream copy of HDR10+ video if the client does not support HDR10 [PR #15072], by @nyanmisaka
otherLog the message more clear when network manager is not ready [PR #15055], by @gnattu
otherSkip invalid keyframe cache data [PR #15032], by @Shadowghost
featureAdd Full system backup feature [PR #13945], by @JPVenson
featureAdd .gitignore style ignoring [PR #13906], by @Shadowghost
featureAdd Api and startup check for sufficient storage capacity [PR #13888], by @JPVenson
featureAdded Setup overlay app to communicate status of startup [PR #12880], by @JPVenson
featureRemove the ability to auto port forward [PR #13222], by @Bond-009
featureRefactor library.db into jellyfin.db and EFCore [PR #12798], by @JPVenson
featureadd xmbc nfo uniqueid type norminalisation [PR #14965], by @KGT1
featureFix CA1051 warning, Change public field to auto-property [PR #14827], by @tjwalkr3
featureOffload 1080p+ subtitle scaling to RKRGA [PR #14179], by @nyanmisaka
featureEnable OpenCL deinterlacer for AMF on Windows when available [PR #14144], by @nyanmisaka
featureUse VBR and MBBRC in QSV encoders for better quality [PR #14079], by @nyanmisaka
featureFix the transparency issue of ASS subtitle rendering in HWA [PR #14024], by @nyanmisaka
featureAdd DoVi Profile 5 support for Rockchip RKMPP [PR #13911], by @nyanmisaka
featureAdd ServerName to startup configuration [PR #13901], by @thornbill
featureAdd missing public properties to SystemInfo response [PR #13822], by @thornbill
featureReduce allocations, simplifed code, faster implementation, included tests - StreamInfo.ToUrl [PR #9369], by @Shadowghost
featureFix only returning one item from /Item/Latest api. [PR #12492], by @scampower3
featureUse TryAdd instead of Add when registering custom OpenAPI responses [PR #14997], by @crobibero
breakingRemove chapters on file change [PR #14984], by @Shadowghost
featureAdd check for processing recursive data structures [PR #14897], by @JPVenson
featureAdd tag filtering and random sorting to GetSimilarItems [PR #14918], by @theguymadmax
featureAdd explicit reference check to migration [PR #14887], by @JPVenson
featureAdd Jellyfin.CodeAnalysis project to abi diff [PR #14875], by @JPVenson
featureAdd Check for ItemValues [PR #14860], by @JPVenson
featureAdd People Dedup and multiple progress fixes [PR #14848], by @JPVenson
featureAdd schema to 503 headers [PR #14840], by @crobibero
featureAdd ec3 to audio file extensions [PR #14799], by @Shadowghost
featureAllow non-admin users to subscribe to their own Sessions [PR #13767], by @KGT1
featureAdd fast path to check for empty ignore files [PR #14782], by @Bond-009
featureAdd 1-second tolerance to resume playback completion check [PR #14774], by @theguymadmax
breakingRemove appsettings.json loading component from startup server [PR #14275], by @JPVenson
deprecatedDeprecate OnPlaybackXXX API operations in favor of ReportPlaybackXXX [PR #13993], by @nielsvanvelzen
breakingRemove 10.11.z EFcore migration warnings [PR #13972], by @ferferga
breakingRemove the hashed password from startup users response [PR #13904], by @thornbill
breakingRemove all DB data on item removal, delete internal trickplay files [PR #13753], by @Shadowghost
breakingRemove deprecated GetWakeOnLanInfo endpoint [PR #13606], by @nielsvanvelzen
breakingRemove check-backport CI action [PR #13523], by @joshuaboniface
breakingRemove useless checks and dead code [PR #13405], by @Bond-009
deprecatedAdd option to disable deprecated legacy authorization options [PR #13306], by @nielsvanvelzen
breakingRemoved RemoveOldPlugins configuration flag [PR #13102], by @RealGreenDragon
+356 more items in the release notesotherConfigurations behind a reverse proxy that did not explicitly configure trusted proxies will not work after this release. This was never a supported configuration, so please ensure you correct your configuration before upgrading. See the updated docs here for more information.
securityFix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost
securityFix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson
fixFix regression where "Search for missing metadata" not handling cast having multiple roles [PR #13720], by @Lampan-git
otherClone fallback audio tags instead of use ATL.Track.set [PR #13694], by @gnattu
otherBackport 10.11 API enum changes [PR #13835], by @nielsvanvelzen
otherSupport more rating formats [PR #13639], by @IDisposable
fixFix stackoverflow in MediaSourceCount [PR #12907], by @JPVenson
otherUpgrade LrcParser to 2025.228.1 [PR #13659], by @congerh
otherInclude Role and SortOrder in MergePeople to fix "Search for missing metadata" [PR #13618], by @Lampan-git
otherDelete children from cache on parent delete [PR #13601], by @Bond-009
fixFix overwrite of PremierDate with a year-only value [PR #13598], by @IDisposable
otherWait for ffmpeg to exit on Windows before we try deleting the concat file [PR #13593], by @Bond-009
fixFix 4K filtering when grouping movies into collections [PR #13594], by @theguymadmax
breakingRemove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost
otherUpdate dependency z440.atl.core to 6.20.0 [PR #13845], by @Shadowghost