Release readiness: next stable

[github-actions]

Release readiness: next stable

This issue tracks user-level testing for the next Aurral stable release.

The automation updates the candidate and included-change status comment below. Keep manual test evidence and decisions in this issue. Apply the release-ready label only after the checklist and required testing are complete for the current source commit.

Maintainer checklist

• Nightly validation passed
• Affected areas tested against the current nightly build
• Upgrade, migration, and rollback behavior checked where applicable
• No blocking nightly issues remain
• Release approved

Test evidence

Add comments with the tester, date, exact nightly build, affected area, and result.

[github-actions]

Current nightly candidate

• Image: ghcr.io/lklynet/aurral:nightly
• Build: nightly.234+5fb0f3e
• Source commit: 5fb0f3e8c371de1fc5635594c7761a3e05f0ac0d
• Changes: v2.8.0...5fb0f3e
• View the nightly workflow

Included pull requests

• #752 build(deps-dev): bump the root-tooling group across 1 directory with 2 updates
• #756 feat(library): add ownership management and Lidarr enablement
• #757 fix(security): address code scanning findings
• #758 build(deps): bump the root-production group across 1 directory with 11 updates
• #760 fix(playlists): encode preview cover URLs
• #761 build(deps): bump node from 26.5.1-bookworm-slim to 26.8.1-bookworm-slim in the root-docker group
• #764 fix: stop discovery refresh looping when the library has no seed artists
• #765 fix(jellyfin): make playlist sync reliable and user-scoped
• #767 build(deps-dev): bump fast-uri from 3.1.5 to 3.1.7
• #768 feat(lidarr): show only available music in the Library by default
• #769 build(deps): bump qs from 6.15.2 to 6.16.0
• #772 feat(weekly-flow): check filesystem for existing tracks before downloading ([Bug]: Existing tracks ignored when importing playlist #741)
• #773 fix(activity): reconcile completed tracker job status in history requests
• #774 fix(navidrome): invalidate song cache on publish and prevent dropped playlist tracks
• #778 fix(discovery): annotate adopted discover playlists for plain user ids
• #784 build(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 in the github-actions group
• #785 build(deps-dev): bump browserslist from 4.28.2 to 4.28.9
• #787 build(deps-dev): bump the root-tooling group across 1 directory with 2 updates
• #788 build(deps): bump the root-production group across 1 directory with 4 updates
• #789 fix(weekly-flow): avoid unnecessary library scans
• #790 fix(lidarr): prevent large library scans from getting stuck
• #791 fix(subsonic): mark album directory entries correctly
• #792 fix(auth): honor explicit proxy auth disable setting
• #793 fix(ytdlp): validate channels and review identity mismatches
• #794 fix(tasks): report queue counts beyond display limit
• #795 fix(flows): reject ownerless API-key flow creation
• #796 fix(http): honor environment proxies in axios fetch
• #797 fix(deemix): reuse existing playlist files
• #798 fix(ui): keep playlist menu open while scrolling
• #799 fix(library): retry failed Lidarr scans
• #800 fix(shows): respect country for postal code lookup ([Bug]: Non-US Ticketmaster ZIP code picks a random country #669)
• #801 build(deps): bump svgo from 4.0.2 to 4.1.0 in /docs
• #802 build(deps): bump sharp from 0.35.3 to 0.35.4 in /docs
• #803 build(deps): bump js-yaml from 4.3.1 to 4.3.2 in /docs
• #804 build(deps): bump astro from 7.1.6 to 7.3.2 in /docs
• #805 build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2
• #808 fix(ci): ignore unrelated Chrome APT source
• #810 fix(library): deduplicate lidarr retry jobs
• #812 fix(jellyfin): support API-key-authenticated playlist updates
• #817 test(e2e): add Playwright smoke coverage
• #819 fix(auth): reject API-key-only user mutations
• #824 refactor(library): optimize media lookups and recent ordering

Linked closing issues

• #618 Can't login via OIDC with Authentik
• #669 [Bug]: Non-US Ticketmaster ZIP code picks a random country
• #738 [Bug]: Cannot select particular playlist if there are too many
• #741 [Bug]: Existing tracks ignored when importing playlist
• #749 [Bug]: Download worker queue capped at 500
• #750 [Bug]: Aurral reports all entries in lidarr as partially downloaded even when unmonitored
• #754 [Bug]: Subsonic getMusicDirectory returns albums with isDir: false, causing playback failures in Symfonium
• #762 [Bug]: Aurral not indexing music from lidarr
• #763 [Bug]: Discovery refresh loops every 15 minutes when global cache never gains topGenres (per-user Last.fm mode)
• #766 [Bug]: Library lists the full Lidarr discography (unavailable albums) with no way to show only owned music
• #770 [Bug]: Last.fm requests bypass HTTP(S)_PROXY when NODE_USE_ENV_PROXY=1
• #775 [Bug]: API-key auth has no way to attribute a created flow to a real user, and Aurral silently discards the attempt instead of erroring
• #776 [Bug]: Duplication issue with deemix as a download client
• #777 [Bug]: Discover playlists never show adopted state; adding as flow appears to do nothing
• #786 yt-dlp download validation ignores uploader/channel metadata, causing false artist-mismatch rejections with no recovery path
• #807 [Bug]: Lidarr retry jobs multiply without dedup — 177k runs in one morning, one core pegged, when Lidarr is unreachable
• #811 [Bug]: Jellyfin playlist updates fail with API-key authentication
• #813 [Bug]: GET /api/scrobbling/lastfm/link returns 500 under API-key auth (synthetic user id violates FK)

The candidate above is the build that should be used for readiness testing. A nightly built from a newer source commit replaces this status and revokes the release-ready label until the current candidate is retested.