v1.0.0 馃帀
first tagged release, and it doubles as the security baseline. if you self host an older image, this is the one to be on.
what's in it
- navidrome: experimental method that pulls real per play scrobble history through the native api. way more accurate than counting play counts, but needs a navidrome build that ships
/api/scrobble(unreleased upstream right now, master only). the old subsonic scan stays as the legacy toggle and remains the default - multi arch docker images (amd64 + arm64), tagged with the commit sha for easy rollbacks plus semver tags on releases
- readme badges got safer serving, and the wrapped counter finally stops losing counts across gunicorn workers
- legal email popup, because apparently spotify needs a counter offer :0
- community docs: contributing guide rewrite, code of conduct, security policy and a pull request template
security fixes
- fixed stored xss in svg badges: quote escaping plus a sandbox csp on all svg responses, see GHSA-3grr-2p98-m6cv
- hardened remote artwork fetching: host allowlist, private range blocking, validated redirect hops and raster only content types
- fixed rate limit bypass via spoofed forwarded headers
- capped request body size so oversized uploads stop being buffered in memory
- docker image now runs as a non root user on a pinned python 3.14 slim base
for self hosters
docker compose pull && docker compose up -dthen purge any cdn cache sitting in front of the app.