MusicBrainz Server update, 2020-09-21

React conversion tasks are conspicuously absent from today’s release, but that’s just because we needed to take some time to get it all working with the recent refactoring. This new server update mainly brings strong security improvements for the OAuth service. It also comes with a fair amount of smaller bugfixes and improvements. The most noticeable of these probably are the added details to the merge recordings’ form and the statistics by entity type on editors’ profile pages.

Announcement for MusicBrainz API users: A small but breaking change will be deployed on October 19th (in one month from now), to fix the JSON formatting of release packaging in search results (SEARCH-579).

A new release of MusicBrainz Docker is also available that matches this update of MusicBrainz Server. See the release notes for update instructions.

Thanks to kellnerd and loujine for contributing code. Thanks to calculator.ftvb, chaban, hibiscuskazeneko, jesus2099, kellnerd, lalinksy, psychoadept, rdswift, and spitzwegerich for having reported bugs and suggested improvements. Thanks to jesus2099, kellnerd, mfmeulenbelt, outsidecontext, and salorock for updating the translations. And thanks to all others who tested the beta version!

The git tag is v-2020-09-21.

Bug

• [MBS-10880] – Series automatic ordering (without numbers) fails for new release group
• [MBS-11065] – Smart link blocks affecting legitimate links
• [MBS-11069] – Diff highlighting not visible for certain display resolutions
• [MBS-11098] – Big Cartel URLs are denied for labels
• [MBS-11101] – Series relationships not showing for work series

Improvement

• [MBS-2768] – Display AcoustIDs, Annotation and any other useful info when merging recordings
• [MBS-7473] – Adding a new discid: Allow to specify the target by its releaseid
• [MBS-11017] – Normalize IMSLP URLs to HTTPS and add validation
• [MBS-11058] – Tighten security of OAuth service
• [MBS-11061] – Don’t allow MusicBrainz URLs in relationships
• [MBS-11062] – Link basic how-tos from the front page
• [MBS-11086] – Add icon for tabs with errors in release editor
• [MBS-11109] – Block further more smart links
• [MBS-11119] – Set a Content-Security-Policy header on account/admin related forms

New Feature

• [MBS-7485] – OAuth token revokation through API
• [MBS-9769] – Show entities added statistics on editor profile page
• [MBS-10835] – Disallow creating new accounts with an e-mail already in use
• [MBS-11097] – Support PKCE (Proof Key for Code Exchange) by OAuth clients

Task

• [MBS-10921] – Clear editing history of unrelated recording-of relationship edits