v1.9.1

jellyfin/jellyfin-desktopv1.9.1Apr 24, 2023by iwalton3

AI Summary

A security update primarily to patch a stored XSS vulnerability in the web client, alongside maintenance fixes for Linux and transcoding rules.

Key Highlights

Patch for stored XSS vulnerability (GHSA-89hp-h43h-r5pq)
Skip searching for SSL bundles on Linux
Disallow flac from video transcoding
Update to jellyfin-web 10.8.10

New Features

Censor token from new stored creds block
Allow disabling dovi transcode rule
Fix missing port in translation

Full Release Notes

This release is primarily to get the updated `jellyfin-web` to correct the stored XSS vulnerability [GHSA-89hp-h43h-r5pq](https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq). While JMP is not vulnerable to most XSS vulnerabilities due to being an isolated application, this one could affect it.

Changes:

  * Update web client to 10.8.10 to patch stored XSS issue.
  * Skip searching for SSL bundles on Linux. (#301)
  * Disallow flac from video transcoding. (#423)
  * Allow disabling dovi transcode rule.
  * Fix missing port in translation. (#288)
  * Censor token from new stored creds block.