-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 16 Oct 2026 12:54:58 +0200
Source: mopidy
Architecture: source
Version: 4.0.5-1
Distribution: unstable
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Stein Magnus Jodal <jodal@debian.org>
Changes:
mopidy (4.0.5-1) unstable; urgency=high
.
* New upstream release.
* Fix a security issue: the file backend did not apply the
file/media_dirs restriction in lookup(). A client of the HTTP
JSON-RPC API, which has no authentication, could find out if any
file that Mopidy can read exists, read the tags of audio files
outside media_dirs, and add them to the tracklist.
Checksums-Sha1:
bbf1bc7aaccc4b16fea3af9f93fc0b243c35846b 2907 mopidy_4.0.5-1.dsc
b4afad23e43fa3f78db8170d161586c28c9c6ab9 528383 mopidy_4.0.5.orig.tar.gz
142ae74d05ede42721ea6689a86df0525078724a 20936 mopidy_4.0.5-1.debian.tar.xz
a68f06295f71d6c1e67adbec394c443bcf24b55f 604572 mopidy_4.0.5-1.git.tar.xz
0f71e3fa7e6eb90588e83b507b8498b25962decb 17720 mopidy_4.0.5-1_source.buildinfo
Checksums-Sha256:
dbfbdec916bc958af950344f8d13f356a08d810de3351200d57781c2d13110b5 2907 mopidy_4.0.5-1.dsc
8ee57d41dc90923ddbf10d289bbbba8fd589da09f59e9f2c2162d5dc3b4e1328 528383 mopidy_4.0.5.orig.tar.gz
fa6a0169969d2a180a64bbbc246d390e39f319585a7c3eca74cae4c72f6c646c 20936 mopidy_4.0.5-1.debian.tar.xz
03972ac0da6f51ce024ee7fa3634cf51f414a90b6d13f07115a43688a1522334 604572 mopidy_4.0.5-1.git.tar.xz
7223910ee97599a6f987e69bec293efbb89175c9a8a5b6842ac47fa2c3129bbe 17720 mopidy_4.0.5-1_source.buildinfo
Files:
a7c2ea1c813e12fe96b45fc28f238f0c 2907 sound optional mopidy_4.0.5-1.dsc
29f303d482ab0d53db3b047deecf7203 528383 sound optional mopidy_4.0.5.orig.tar.gz
ab8a0eea8473d8aa3088c4a969ea1d97 20936 sound optional mopidy_4.0.5-1.debian.tar.xz
a4571e83766c85ff13607cbbaa95c717 604572 sound None mopidy_4.0.5-1.git.tar.xz
675811003e10f037ee2adf17435e1ccf 17720 sound optional mopidy_4.0.5-1_source.buildinfo
Git-Tag-Info: tag=d824bfeb3ca4f6503ce941c547d49ce1440c9ab8 fp=80aaf4907638251f08b1ca4620b4c7f5a17c58f6
Git-Tag-Tagger: Stein Magnus Jodal <jodal@debian.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrSBP4ACgkQYG0ITkaD
wHkIDQ/8Cz/0FPaAcGqS+X1ff88PkGMGWiPypWljXsfC6394T9t5ZSFby6nWgk0i
at1S+DT57lpdowsMUQ23G5DsbARtLihGEpgffEGJjVQAOybbzUYllxqoX+PXPrWm
mBwAgJ90SbM42/l6cDuVsdNW0PIUhyYFIQqKwN3LhR7JRr+vi2WVsYRig26ZInfF
JzFTJpON8HBy+J7jOFxWLrxK/UcJzgGxrbhr4THZVXGz/FECmcrxgGL/vyi6Ytqg
MZ0vNemMU9qejAAK9RY4/w0ZhdEhDjeg5gdXpaNEI3r6XBOScSJMIV/j1kxlUnXh
uL5coWDYCb0LBhV3slOI9sN+TczqINqycUd2YmoCcrEyKfH20AvtrUpmUqaKrhdk
OBdncgiHFx98qH7iUCgA6t6EPd2xoCdYGWKP0QVF+/mCnUn5uZ0EmblZ/6FBJQMb
iIqmtyOJrqo58S9gsgB0VJ3YCbL4Mom+sIthCOLlDK/AH8D5XP93x7z94CHFh8mK
x6+5q/gY672J1kybTNVGeVRT8YPN++/Fk+hnGih4FinKMoVbEZBOJagzlZrlIqW5
g99KsjmOznJg1ctrGLb3vCeRAlZ8WRqV7rKdf6DjsRBYMFwlYH6krVX+3hPMFyio
C6h/uNJaqQcgzAG8Rcp74HyMSUApuZv04CgXVQoVstztTDa5sm8=
=06fL
-----END PGP SIGNATURE-----
