Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@audius/sdk@16.0.0

Major Changes

• 6bd5c27: Rename the path field on getNotifications and getPlaylistUpdates from userId to id, matching the convention used by every /users/{id}/… method. Add an optional userId query field that carries the requester id for personalization of embedded related.users (e.g. does_current_user_follow).

  Migration:

  // Before
  sdk.notifications.getNotifications({ userId: "aE9MA" });
  sdk.notifications.getPlaylistUpdates({ userId: "aE9MA" });
  
  // After
  sdk.notifications.getNotifications({
    id: "aE9MA", // notifications owner (was `userId`)
    userId: "aE9MA", // requester id, for personalization of related.users
  });
  sdk.notifications.getPlaylistUpdates({ id: "aE9MA", userId: "aE9MA" });

  The two ids differ only when a manager reads a managed user's notifications; in the normal flow they're the same value. The wire format and server URL are unchanged — only the request type shape was renamed to remove a collision between the path and the new query parameter.

Minor Changes

• be0537f: Add an optional userId?: string query parameter to three endpoints so the backend can personalize embedded users in related.users / collection owners (does_current_user_follow, etc.):

  • events.getRemixContests
  • users.getContestsByUser
  • playlists.getPlaylistsNewReleases

  Without this, the endpoints' handlers (app.getMyId(c)) resolved the requester id from the missing ?user_id= query and got 0, so embedded user objects came back with does_current_user_follow: false for everyone. Clients that primed those into a shared cache (e.g. via primeRelatedData / primeCollectionData) silently poisoned follow state for the surfaced artists.

  Existing callers continue to work unchanged — the field is optional. Pass Id.parse(currentUserId) (or whichever id your app treats as "me") to opt in.

Patch Changes

• b803e5e: Point the production anti-abuse oracle endpoint at https://anti-abuse-oracle.audius.engineering, replacing the old https://discoveryprovider.audius.co host in the SDK services config and supporting clients/services.
• da6c724: Add allowedApiKeys to UploadTrackMetadataSchema so it's preserved when uploading or updating tracks. Previously the strict schema stripped the field, which prevented the "Disallow Streaming via the API" setting from being saved.
• 8662a56: Generate the production SDK storage-node defaults from the canonical Audius storage-node hostname, removing creatornode2.audius.co and creatornode3.audius.co.

@audius/sdk-legacy@6.0.29

Patch Changes

• f3d55fa: Remove FingerprintJS from all clients and services. Sign-in no longer collects a visitorId, the identity service's fingerprint-based OTP bypass is gone (new devices always require OTP), and the anti-abuse-oracle drops the per-fingerprint device-count scoring and UI section.
• Updated dependencies [b803e5e]
• Updated dependencies [6bd5c27]
• Updated dependencies [da6c724]
• Updated dependencies [be0537f]
• Updated dependencies [8662a56]
  • @audius/sdk@16.0.0

@audius/sp-actions@1.0.33

Patch Changes

• Updated dependencies [f3d55fa]
  • @audius/sdk-legacy@6.0.29

@audius/common@1.5.79

Patch Changes

• 272b8db: Fix freeform/custom track genres silently reverting to Electronic on save. toSdkGenre in the track adapter filtered out any value not in the canonical Genre enum and returned undefined, which then fell back to DEFAULT_GENRE (Electronic) before reaching the SDK. Now any non-empty genre string is passed through unchanged (the SDK upload schema already caps it at 100 chars), so custom genres entered by artists are preserved end-to-end.
• 98ad217: Forward the running CodePush bundle label to Optimizely as an otaVersion attribute (or "native" when no OTA is applied), so feature flags can be gated on a specific OTA cut in addition to the native binary version.
• 5d9d4e4: Add usePrefetchTrackComments and usePrefetchTrackPageLineup, hooks that warm a track's comment list and "more by / remixes / you might also like" lineup as early as possible (e.g. on track screen mount) so those sections render from cache instead of starting their own fetch only once they mount. Each keeps a live observer so the warmed data isn't evicted before the section mounts. usePrefetchTrackComments can fire from a bare trackId; usePrefetchTrackPageLineup still depends on the hero track + owner handle but starts the instant those resolve rather than waiting for the mobile screen-ready/animation gate.
• 791b612: Hide the profile Contests tab unless the CONTESTS feature flag is enabled and the artist hosts at least one remix contest. Previously the desktop and mobile-web profiles always rendered the tab for any artist (ignoring the flag entirely), and the React Native side respected the flag but still showed the tab for artists who don't run any contest — both led to an empty/unreachable destination. Adds a shared useUserHasRemixContest hook that paginates the global remix-contest list (matching ContestsTab's page cap) and matches event.userId against the host. Direct visits to /:handle/contests on a non-qualifying profile fall back to the default tab so the body stays in sync with the (now hidden) tab list.
• f3d55fa: Remove FingerprintJS from all clients and services. Sign-in no longer collects a visitorId, the identity service's fingerprint-based OTP bypass is gone (new devices always require OTP), and the anti-abuse-oracle drops the per-fingerprint device-count scoring and UI section.
• f97f1ac: Remove the unused legacy lineup store module (store/lineup: lineupActions, lineupReducer, lineupSelectors, LineupBaseActions, lineupRegistry) from @audius/common. The lineup engine has been fully migrated to tan-query hooks plus the playback slice; these exports had no remaining consumers and were not wired into any store.
• b52d005: Rename the Feed page's "Chronological" tab to "Latest" on web and mobile. The persisted feed-page:tab localStorage value is migrated transparently so existing users land on the same tab they had selected.
• Updated dependencies [b803e5e]
• Updated dependencies [6bd5c27]
• Updated dependencies [da6c724]
• Updated dependencies [be0537f]
• Updated dependencies [8662a56]
  • @audius/sdk@16.0.0

@audius/mobile@1.5.186

Patch Changes

• 5a20b85: Fix bottom tab bar color clipping after the comment drawer opens. The drawer rendered a white overlay over the bottom safe area to color the gap below its footer, but it was kept mounted after dismissal and covered the tab bar's surface1 padding, leaving a visible color seam at the bottom. The overlay now only renders while the drawer is visible.
• ea2ca22: Fix a thin white sliver appearing above the cover image when pulling to refresh on the mobile contest page. ContestHero was clipping its scaled cover image with overflow: 'hidden', so the existing scale + translate over-scroll interpolation could only stretch within the 220px hero box and never bled upward into the over-scroll gap. The clip is removed (mirroring ProfileCoverPhoto), and the title/CTA/countdown section gets its own opaque background to cover the downward bleed — same sibling-with-bg pattern ProfileHeader uses below the cover photo.
• 76ef0bb: Restrict the Top Albums This Month, New Album Releases, and Best Selling Albums sections on the Explore page to the Albums tab only, matching web behavior.
• 1259682: Fix video embed sizing in fan club post cards. The WebView's embedded HTML set iframe { height: 100% } but neither <html> nor <body> had an explicit height, so the iframe collapsed and left a visible gap inside the 16:9 container. Giving html, body an explicit 100% height lets the iframe fill the card as intended.
• af63712: Fix initial dark mode load on the mobile app: with theme set to Auto and the system in dark mode, the app launched in light and only flipped after backgrounding. Also fix SelectablePill components keeping the previous palette's colors after a theme flip.
• c917fd6: Fix the mobile play queue drag-to-reorder gesture: dragging a track row was being claimed by the queue drawer's swipe-to-dismiss pan responder, so reorder attempts dragged the drawer down instead. The drawer now suspends its pan responder while a row is being dragged. Also adds a grabber bar above the Queue title and a bit more breathing room in the header.
• 5a5a93f: Smooth out the infinite-scroll feel on Trending and Feed lineups. The mobile TrackLineup previously waited a 100ms debounce before dispatching loadNextPage, then waited again for the parent's isFetching to round-trip back through tanquery before any skeleton rows appeared — so users would scroll to the bottom, see nothing happen, then see late skeletons, then tracks. The threshold is now bumped from 0.5 to a full viewport ahead, the debounce and the duplicate onScroll handler are removed, and a synchronous local "load triggered" flag flips skeletons on in the same tick the scroll handler fires.
• 432167f: Migrate seven legacy redux-saga packages to tan-query hooks (recovery-email, change-password, playlist-updates, search-users-modal, dashboard-page, cache/tracks, recommendation, and the dead search-ai-bar). Mobile-facing changes: AccountSettings now uses useResendRecoveryEmail, ChatUserListScreen uses useSearchUsersModal infinite query, track edit/delete flows go through useUpdateTrack/useDeleteTrack hooks instead of the saga + confirmer queue.
• 98ad217: Forward the running CodePush bundle label to Optimizely as an otaVersion attribute (or "native" when no OTA is applied), so feature flags can be gated on a specific OTA cut in addition to the native binary version.
• 791b612: Hide the profile Contests tab unless the CONTESTS feature flag is enabled and the artist hosts at least one remix contest. Previously the desktop and mobile-web profiles always rendered the tab for any artist (ignoring the flag entirely), and the React Native side respected the flag but still showed the tab for artists who don't run any contest — both led to an empty/unreachable destination. Adds a shared useUserHasRemixContest hook that paginates the global remix-contest list (matching ContestsTab's page cap) and matches event.userId against the host. Direct visits to /:handle/contests on a non-qualifying profile fall back to the default tab so the body stays in sync with the (now hidden) tab list.
• f3d55fa: Remove FingerprintJS from all clients and services. Sign-in no longer collects a visitorId, the identity service's fingerprint-based OTP bypass is gone (new devices always require OTP), and the anti-abuse-oracle drops the per-fingerprint device-count scoring and UI section.
• b52d005: Rename the Feed page's "Chronological" tab to "Latest" on web and mobile. The persisted feed-page:tab localStorage value is migrated transparently so existing users land on the same tab they had selected.
• Updated dependencies [b803e5e]
• Updated dependencies [272b8db]
• Updated dependencies [6bd5c27]
• Updated dependencies [98ad217]
• Updated dependencies [da6c724]
• Updated dependencies [be0537f]
• Updated dependencies [5d9d4e4]
• Updated dependencies [791b612]
• Updated dependencies [f3d55fa]
• Updated dependencies [8662a56]
• Updated dependencies [f97f1ac]
• Updated dependencies [b52d005]
  • @audius/sdk@16.0.0
  • @audius/common@1.5.79

@audius/protocol-dashboard@0.1.19

Patch Changes

• Updated dependencies [b803e5e]
• Updated dependencies [272b8db]
• Updated dependencies [6bd5c27]
• Updated dependencies [98ad217]
• Updated dependencies [da6c724]
• Updated dependencies [be0537f]
• Updated dependencies [5d9d4e4]
• Updated dependencies [791b612]
• Updated dependencies [f3d55fa]
• Updated dependencies [8662a56]
• Updated dependencies [f97f1ac]
• Updated dependencies [b52d005]
  • @audius/sdk@16.0.0
  • @audius/common@1.5.79
  • @audius/sdk-legacy@6.0.29

@audius/web@1.5.180

Patch Changes

• 64740af: Fix profile and track cover photo banners being clipped horizontally. An inline position: relative on the inner photo div was overriding the CSS module's position: absolute, which dropped the photo into the parent flex container alongside the edit button — both flex items competed for space, shrinking the banner below full width.
• 8359c3f: Right-align the Host tag in contest comments to match the track-page CommentBlock layout. Previously the badge sat inline next to the username; now the header uses justifyContent='space-between' with user link + timestamp on the left and the Host badge in a flexShrink: 0 wrapper on the right. Applies to both top-level contest comments and nested replies.
• 0bc145f: Fix artist hover card blur overlay overflowing the card. The .artistCoverPhoto banner div lacked a positioning context, so the blur overlay's position: absolute; inset: 0 escaped to the nearest positioned ancestor and bled outside the cover photo banner. Adding position: relative (and overflow: hidden) to the banner contains the blur to the intended 136px header.
• 4cf2bee: Honor "Request Desktop Site" on mobile browsers: when a mobile browser flips its User-Agent to a desktop one (via the browser's "Request Desktop Site" toggle, or iPadOS Safari's default Mac UA), serve the desktop web app instead of the mobile experience.
• 791b612: Hide the profile Contests tab unless the CONTESTS feature flag is enabled and the artist hosts at least one remix contest. Previously the desktop and mobile-web profiles always rendered the tab for any artist (ignoring the flag entirely), and the React Native side respected the flag but still showed the tab for artists who don't run any contest — both led to an empty/unreachable destination. Adds a shared useUserHasRemixContest hook that paginates the global remix-contest list (matching ContestsTab's page cap) and matches event.userId against the host. Direct visits to /:handle/contests on a non-qualifying profile fall back to the default tab so the body stays in sync with the (now hidden) tab list.
• f3d55fa: Remove FingerprintJS from all clients and services. Sign-in no longer collects a visitorId, the identity service's fingerprint-based OTP bypass is gone (new devices always require OTP), and the anti-abuse-oracle drops the per-fingerprint device-count scoring and UI section.
• b52d005: Rename the Feed page's "Chronological" tab to "Latest" on web and mobile. The persisted feed-page:tab localStorage value is migrated transparently so existing users land on the same tab they had selected.
• 519da44: Smooth out lineup infinite-scroll on Trending, Feed, and other tanquery-driven track lists. The scroll-to-bottom "chunk" had three causes stacked: a small fixed 500px threshold, skeletons that gated on tanquery's isFetching (so they only painted after a multi-tick state round-trip), and a per-page skeleton count of just pageSize (4 on Trending, ~480px tall on desktop) that didn't fill the loading window. The threshold is now ~2× the scroll parent's viewport, a synchronous trigger flag renders skeletons on the next frame, and the skeleton count is sized to fill the threshold area so the bottom stays populated even when the user scrolls in faster than the next page can return.
• Updated dependencies [b803e5e]
• Updated dependencies [272b8db]
• Updated dependencies [6bd5c27]
• Updated dependencies [98ad217]
• Updated dependencies [da6c724]
• Updated dependencies [be0537f]
• Updated dependencies [5d9d4e4]
• Updated dependencies [791b612]
• Updated dependencies [f3d55fa]
• Updated dependencies [8662a56]
• Updated dependencies [f97f1ac]
• Updated dependencies [b52d005]
  • @audius/sdk@16.0.0
  • @audius/common@1.5.79

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.