cross-posted from: https://aussie.zone/post/19146681
Important Notes
Configurations behind a reverse proxy that did not explicitly configure trusted proxies will not work after this release. This was never a supported configuration, so please ensure you correct your configuration before upgrading. See the updated docs here for more information.
Security
- Fix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost
- Fix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson
Note: GHSAs will be published seven (7) days after this release.
General Changes
- Fix regression where "Search for missing metadata" not handling cast having multiple roles [PR #13720], by @Lampan-git
- Clone fallback audio tags instead of use ATL.Track.set [PR #13694], by @gnattu
- Backport 10.11 API enum changes [PR #13835], by @nielsvanvelzen
- Support more rating formats [PR #13639], by @IDisposable
- Fix stackoverflow in MediaSourceCount [PR #12907], by @JPVenson
- Upgrade LrcParser to 2025.228.1 [PR #13659], by @congerh
- Include Role and SortOrder in MergePeople to fix "Search for missing metadata" [PR #13618], by @Lampan-git
- Delete children from cache on parent delete [PR #13601], by @Bond-009
- Fix overwrite of PremierDate with a year-only value [PR #13598], by @IDisposable
- Wait for ffmpeg to exit on Windows before we try deleting the concat file [PR #13593], by @Bond-009
- Fix 4K filtering when grouping movies into collections [PR #13594], by @theguymadmax
- Remove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost
- Update dependency z440.atl.core to 6.20.0 [PR #13845], by @Shadowghost
General Changes
- Fix parsing minor version of Tizen [PR #6661], by @dmitrylyzo
- Fix re-focusing on pause button when displaying OSD [PR #6510], by @dmitrylyzo
- Fix skip button not displaying correctly with OSD [PR #6583], by @rlauuzo
- Fix catalog plugin page not setting page title [PR #6570], by @nielsvanvelzen
Well I’m glad I read that before upgrading!
It's odd to throw that into a patch release. I guess we'll find out if I did it correctly.
I mean, it's patching a security issue caused by trusting headers it shouldn't, so I don't think they should wait for a big number release.
Why wait? Just release it as a big number release. The version number doesn't define the size or cadence of a release, it just says whether there's a breaking change.
At least in my org we use semantic versioning ( Major.Minor.patch) where patch must either be a new feature, a fix, or something that is backwards compatible
Minor can be breaking
Major is basically something you're proud of lol
That's not semantic versioning...
Guess my org fucked it up ¯\(ツ)/¯
Thanks for pointing this out! I probably would have missed this, since I didn't expect such a change for a patch release.
Their documentation mentions:
Does this really mean, that the only way to configure this is through the web UI? This is kind of a problem when deploying it, since without the reverse proxy I can't reach the Jellyfin server. Is there no way of doing this outside the web UI, via a config file or something?
Edit: Apparently the configuration for the proxies is stored in Jellyfin's
network.xmlconfig file. So it should be possible to do this without manually configuring it via the web UI.Another edit: It works. Adding
<KnownProxies>[proxy ip or hostname]</KnownProxies>in place of the empty<KnownProxies/>key to that config file does the trick.Yeah the lack of info in the docs on how to configure jellyfin in the CLI is pathetic
If I run traefik and jellyfin in docker, do I add the docker IP of traefik as the trusted proxy?
I think you can use the container name if both containers are in the same docker network
I don't know your exact setup, but you should add the IP that Jellyfin sees when the reverse proxy makes a request. That probably comes from the IP of your Traefik docker container.