v1.1.0 🎉

the template update. this one's for the artists. you can now make your own wrapped templates, browse what the community made, and use any of them. plus libre.fm support, which opens the generator up to yet another open music service.

what's in it

• community templates: the built-in themes and community templates all render from one template format, so a template you design works everywhere and with every service
• /marketplace - browse official and community templates, search, filter by category, sort by featured/newest/popular, live previews, and hit use this template to jump straight into the generator (beta)
• /editor - a visual drag and drop template editor. position and style text, ranked lists, stats, background, palette and album art on a live wrapped sized canvas, export/import templates as json, then submit it for review (beta)
• /templates - a landing page that explains the whole thing
• /admin - the moderation desk. submissions land in a pending review state and only go live after a maintainer approves
• libre.fm is now a thing. same generator, another open music service. marked beta/unstable because libre.fm throttles hard per ip and its api is a bit less predictable
• more patient upstream fetching, extra retries and backoff on 5xx/429, so when listenbrainz or last.fm are having a moment the wrapped doesn't just die
• navidrome: the experimental native api method got faster

for self hosters

docker compose pull && docker compose up -d

v1.0.0 🎉

first tagged release, and it doubles as the security baseline. if you self host an older image, this is the one to be on.

what's in it

• navidrome: experimental method that pulls real per play scrobble history through the native api. way more accurate than counting play counts, but needs a navidrome build that ships /api/scrobble (unreleased upstream right now, master only). the old subsonic scan stays as the legacy toggle and remains the default
• multi arch docker images (amd64 + arm64), tagged with the commit sha for easy rollbacks plus semver tags on releases
• readme badges got safer serving, and the wrapped counter finally stops losing counts across gunicorn workers
• legal email popup, because apparently spotify needs a counter offer :0
• community docs: contributing guide rewrite, code of conduct, security policy and a pull request template

security fixes

• fixed stored xss in svg badges: quote escaping plus a sandbox csp on all svg responses, see GHSA-3grr-2p98-m6cv
• hardened remote artwork fetching: host allowlist, private range blocking, validated redirect hops and raster only content types
• fixed rate limit bypass via spoofed forwarded headers
• capped request body size so oversized uploads stop being buffered in memory
• docker image now runs as a non root user on a pinned python 3.14 slim base

for self hosters

docker compose pull && docker compose up -d

then purge any cdn cache sitting in front of the app.