Ditto v0.5.1

Fixes the built-in Lavalink on Pterodactyl, where music was unavailable in v0.5.0.

Fixed

• Lavalink never answered on Pterodactyl. The panel sets SERVER_PORT to the server's public port; Spring Boot reads it as Lavalink's own port and it wins over the config file, so Lavalink listened there while Ditto waited on 127.0.0.1:2333 and gave up after 90 seconds with "Lavalink did not start in time". Port and address are now passed on the command line, which beats any environment variable, and Lavalink starts without the host's SERVER_*, SPRING_* and similar variables.
• If Lavalink still does not answer, it is stopped instead of being left running in the background.

Changed

• Auto-updates stay on Lavalink 4.x. A new major version could break the client library, so moving to it will be a deliberate release.
• sharp 0.35. 0.33 bundled libvips and libheif versions with known vulnerabilities (GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c); npm audit is clean again.

Upgrading

git fetch origin && git reset --hard origin/main && npm install --omit=dev && npm start

Java and Lavalink downloaded by v0.5.0 are reused.

Note

The fix was checked by running the built-in Lavalink with SERVER_PORT=25567 set, as on Pterodactyl: it started in 25 s and loaded YouTube, YouTube Music and SoundCloud tracks, and both yt-dlp fallbacks played. Playback in a Discord voice channel is still to be confirmed.