10.8.13

Jellyfin 10.8.13

Stable hotfix release for 10.8.z release branch.

New Features and Major Improvements

N/A

Release Notes

• NOTICE: The customizable FFmpeg binary path in the WebUI/API has been REMOVED for security reasons. Please see the corresponding blog post here for further details.

This bugfix release contains two GHSA security fixes; the details of these vulnerabilities will be released publicly on December 5th 2023. Please ensure you update your systems as soon as possible. Credit to @Kwstubbs (of GitHub Security Labs), @FredericLinn, and @mawalu for finding these.

Changelog

GitHub Project: https://github.com/orgs/jellyfin/projects/29

jellyfin [3]

Note: Dependabot & Renovate automatic PRs are excluded from this list.

• #10625 [@ilovepilav] Fix: Plugin Installed Alerts missing from Admin Dashboard #10620
• GHSA-rr9h-w522-cvmr [@joshuaboniface] Remove the functionality of /System/MediaEncoder/Path
• GHSA-866x-wj5j-2vf4 [@crobibero] Validate codec and container

jellyfin-web [3]

Note: Dependabot & Renovate automatic PRs are excluded from this list.

• jellyfin/jellyfin-web#5019 [@joshuaboniface] Set FFmpeg path disabled
• jellyfin/jellyfin-web#4993 [@rafma0] Remove FLAC Audio in Video Support for Tizen (Backport #4938)
• jellyfin/jellyfin-web#4992 [@rafma0] Fix jittering in emby-checkbox (Backport #4929)