v1.23.0

1.23.0 (2026-08-28)

Features

• set the admin password without restarting (#896) (6b3cae8)

Bug Fixes

• block background music path traversal (#884) (c445870)
• default download format (#883) (780c55d)
• give headings a consistent scale and a single owner (#891) (8872a32)
• loosen exact pins so Dependabot can resolve (#882) (ca26647)
• put the download bar on one honest scale (#889) (1f315b8)
• rename a song to another case without refusing (#905) (d088faa)
• require POST for the host-only routes that change state (#886) (5af2de0)
• require POST for the playback control routes (#895) (4bf9215)
• resolve previews under the android client (#910) (3d73fb5)
• set SameSite and HttpOnly on the admin cookie (#885) (cccd1ee)
• stop a raced rename overwriting a song (#907) (a7ca0b1)
• stop the batch renamer dropping YouTube ids (#906) (4a525a1)

Performance Improvements

• read config.ini once, not on every get (#901) (701c094)

Documentation

• fix the dead links in the README (#897) (8901fdc)
• refresh the README screenshots and note session management (#890) (f7d40e7)