Deluan 9dd306eb10 fix(artwork): enforce entity visibility on the Subsonic getCoverArt path ...

serveEntity reads persisted item_artwork by id, bypassing the library and private-
playlist filters that the legacy entity-load applied. On the authenticated Subsonic
path a user could fetch artwork for an inaccessible album or someone else's private
playlist by guessing an id. getCoverArt now resolves the underlying entity through
the request-scoped (filtered) repositories and serves the placeholder when it is not
visible, so existence isn't leaked and the always-an-image invariant holds. The
public share (JWT-authorized) and Jellyfin (admin) paths are intentionally untouched.

2026-07-23 14:08:08 -04:00

..

backgrounds

chore(deps): bump golangci-lint to v2.10.0 and suppress new gosec false positives

2026-02-17 09:28:42 -05:00

events

fix(ui): activity Indicator switching constantly between online/offline (#5054)

2026-02-17 14:47:20 -05:00

filter

feat(jellyfin): filter items by year and record label (#5817)

2026-07-19 12:39:31 -04:00

imghttp

feat(server): serve artwork from persisted state with content-hash caching

2026-07-23 14:08:08 -04:00

jellyfin

feat(artwork): precache on acquisition, bump on upload/radio changes, manual re-resolve API

2026-07-23 14:08:08 -04:00

nativeapi

fix(artwork): invalidate artwork when an uploaded image is deleted

2026-07-23 14:08:08 -04:00

public

feat(server): serve artwork from persisted state with content-hash caching

2026-07-23 14:08:08 -04:00

subsonic

fix(artwork): enforce entity visibility on the Subsonic getCoverArt path

2026-07-23 14:08:08 -04:00

testdata

…

auth_test.go

refactor: run Go modernize (#5002)

2026-02-08 09:57:30 -05:00

auth.go

refactor: multiple syntax updates for Go 1.26

2026-05-19 18:02:36 -03:00

initial_setup_test.go

…

initial_setup.go

fix(transcoding): include ffprobe in MSI and fall back gracefully when absent (#5326)

2026-04-07 20:11:38 -04:00

middlewares_test.go

…

middlewares.go

feat(jellyfin): experimental Jellyfin Music API support (#5730)

2026-07-14 11:46:37 -04:00

serve_index_test.go

feat(ui): replace UI scrobble with reportPlayback and redesign NowPlaying panel (#5448)

2026-05-01 15:27:32 -04:00

serve_index.go

fix(ui): Set Cache-Control: no-cache on index.html - #5766 (#5767)

2026-07-12 12:25:23 -04:00

server_suite_test.go

…

server_test.go

ci: run Go tests on Windows (#5380)

2026-04-19 13:16:47 -04:00

server.go

chore(deps): bump golangci-lint to v2.10.0 and suppress new gosec false positives

2026-02-17 09:28:42 -05:00

throttle_backlog_test.go

fix(test): prevent flaky deadlock in throttle backlog test (#5474)

2026-05-06 11:03:11 -04:00

throttle_backlog.go

chore: go fix

2026-05-28 22:13:05 -03:00