Mopidy

Latest version: v3.4.2

Safety actively analyzes 707796 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 3

4.0

old versions of our dependencies and a number of deprecated APIs.

Dependencies
------------

- Python >= 3.11 is now required.
Support for 3.7-3.10 have been dropped,
while Python 3.13 has been included in the testing matrix.

- GStreamer >= 1.22.0 is now required.

- PyGObject >= 3.42 is now an explicit Python dependency, and not something we
assume you'll install together with GStreamer.

- Pykka >= 4.1 is now required.

- Pydantic >= 2.9 is now required. This is a new dependency for Mopidy to
replace our custom data models.

- Requests >= 2.28 is now required.

- Setuptools >= 66 is now required.

- Tornado >= 6.2 is now required.

- Replaced :mod:`pkg_resources` with :mod:`importlib.metadata` from Python's
standard library.

Core API
--------

Changes to the Core API may affect Mopidy clients.

Some of the changes in the Core API are related to replacing the use of
full ``TlTrack`` objects as API arguments with tracklist IDs, ``tlid``.
This is especially relevant for remote clients, like web clients, which may
pass a lot less data over the network when using tracklist IDs in API calls.

Root object
^^^^^^^^^^^

- The :class:`mopidy.core.Core` class now requires the ``config`` argument to be
present. As this argument is provided by Mopidy itself at runtime, this
should only affect the setup of extension's test suites.

Library controller
^^^^^^^^^^^^^^^^^^

- No changes so far.

Playback controller
^^^^^^^^^^^^^^^^^^^

- :meth:`mopidy.core.PlaybackController.play`
no longer accepts ``TlTrack`` objects,
which has been deprecated since Mopidy 3.0.
Use tracklist IDs (``tlid``) instead.
(Fixes :issue:`1855`, PR: :issue:`2150`)

Playlist controller
^^^^^^^^^^^^^^^^^^^

- No changes so far.

Tracklist controller
^^^^^^^^^^^^^^^^^^^^

- No changes so far.

Backend API
-----------

Changes to the Backend API may affect Mopidy backend extensions.

- Added :meth:`mopidy.backend.LibraryProvider.lookup_many` to take a list of
URIs and return a mapping of URIs to tracks. If this method is not implemented
then repeated calls to :meth:`mopidy.backend.LibraryProvider.lookup` will be
used as a fallback.

- Deprecated :meth:`mopidy.backend.LibraryProvider.lookup`. Extensions should
implement :meth:`mopidy.backend.LibraryProvider.lookup_many` instead.

Models
------

Changes to the data models may affect any Mopidy extension or client.

- The models are now based on Pydantic data classes, which means:

- All models fields and the ``replace()`` method should work as before, so
unless your extension modifies or adds models, this should not affect you.

- Models are now type-checked at runtime. This should help catch bugs early.

- Since we now use Pydantic to convert data models to and from JSON, the old
model machinery has been removed. This includes the following:

- :class:`mopidy.models.ImmutableObject` -- Not used by Mopidy since v1.0.5 nine
years ago.
- :class:`mopidy.models.ValidatedImmutableObject` -- The old base class for all models.
- :class:`mopidy.models.ModelJSONEncoder`
- :func:`mopidy.models.model_json_decoder`
- :class:`mopidy.models.fields.Collection`
- :class:`mopidy.models.fields.Date`
- :class:`mopidy.models.fields.Field`
- :class:`mopidy.models.fields.Identifier`
- :class:`mopidy.models.fields.Integer`
- :class:`mopidy.models.fields.String`
- :class:`mopidy.models.fields.URI`

Audio API
---------

Changes to the Audio API may affect a few Mopidy backend extensions.

- Removed APIs only used by Mopidy-Spotify's bespoke audio delivery mechanism,
which has not been used since Spotify shut down their libspotify APIs in
May 2022. The removed functions/methods are:

- :meth:`mopidy.audio.Audio.emit_data`
- :meth:`mopidy.audio.Audio.set_appsrc`
- :meth:`mopidy.audio.Audio.set_metadata`
- :func:`mopidy.audio.calculate_duration`
- :func:`mopidy.audio.create_buffer`
- :func:`mopidy.audio.millisecond_to_clocktime`

Extension support
-----------------

- The command :command:`mopidy deps` no longer repeats transitive dependencies
that have already been listed. This reduces the length of the command's output
drastically. (PR: :issue:`2152`)

Internals
---------

- Dropped split between the ``main`` and ``develop`` branches. We now use
``main`` for all development, and have removed the ``develop`` branch.

- Added type hints to most of the source code.

- Switched from mypy to pyright for type checking.

4.0.0

===================

3.4.2

===================

- Deps: Python 3.11 and 3.12 are now included in the testing matrix.

- M3U: Stop following symlinks when :confval:`file/follow_symlinks` is false.
(PR: :issue:`2094`)

- zeroconf: Fix exception on shutdown if `dbus` is not installed.

- Docs: Fix crash when building docs on recent Sphinx versions.

- Dev: Make stacktraces from deprecation warnings include the offending call
site, to help upgrade API usage in extensions.

- Dev: Upgrade CI workflows to fix Node.js 12 deprecation notices and avoid
Codecov's bash uploader.

- Dev: Make tests pass on macOS. (PR: :issue:`2092`)

- Dev: Incease test coverage of Mopidy-File to 100%. (PR: :issue:`2096`)

- Dev: Added ``"tox -e ci``", to allow easy CI check before ``git push``.

3.4.1

===================

- HTTP: Fix non-optional :confval:`http/allowed_origins` config setting. (PR:
:issue:`2066`)

3.4.0

===================

- Config: Handle DBus "Algorithm plain is not supported" error. (PR: :issue:`2061`)

- File: Fix uppercase :confval:`file/excluded_file_extensions`. (PR:
:issue:`2063`)

- Add :meth:`mopidy.backend.PlaybackProvider.on_source_setup` which can be
implemented by Backend playback providers that want to set GStreamer source
properties in the ``source-setup`` callback. (PR: :issue:`2060`)

- HTTP: Improve handling of :confval:`http/allowed_origins` config setting. (PR: :issue:`2054`)

3.3.0

===================

- Core: Fixes invalid verbosity logging levels. (Fixes: :issue:`1947`,
PR: :issue:`2021`)

- Core: Fix TypeError exception when playing track with unnamed artists.
(Fixes: :issue:`1991`, PR: :issue:`2012`)

- Core: Fix startup crash when loading invalid extensions. (PR:
:issue:`1990`)

- Core: Fix error-handling when fetching backend support info. (PR:
:issue:`1964`)

- Core: Align values supported by the ``field`` argument to
:meth:`mopidy.core.LibraryController.get_distinct` with Mopidy search query
fields, with the exception of 'any'. Deprecated field 'track' with the
goal of removing it in the next major release, use 'track_name' instead.
Backends should support both `track` and `track_name` until they require
a version of Mopidy where `track` has been removed.
(Fixes: :issue:`1900`, PR: :issue:`1899`)

- Core: Add ``musicbrainz_albumid``, ``musicbrainz_artistid``,
``musicbrainz_trackid``, and ``disc_no`` to the permitted search query
fields. (Fixes: :issue:`1900`, PR: :issue:`1899`)

- Audio: Fix TypeError when handling create output pipeline errors.
(Fixes: :issue:`1924`, PR: :issue:`2040`)

- Audio: Fix seek when stopped. (Fixes: :issue:`2005`, PR: :issue:`2006`)

- Config: Fix support for inline comments, a regression introduced during
our Python 3 migration. (Fixes: :issue:`1868`, PR: :issue:`2041`)

- HTTP: Fix missing CORS headers on RPC response. (Fixes: :issue:`2028`,
PR: :issue:`2029`)

- HTTP: Improve CSRF protection Content-Type check. (PR: :issue:`1997`)

- HTTP: Fix support for websocket clients connecting/disconnecting
during broadcast. (PR: :issue:`1993`)

- Add Python 3.10 to our test matrix.

- Core: Added and improved configuration parsing code for extension
developers. (PR: :issue:`2010`)

Page 1 of 3

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.