From 30a9cb32f5278f218d64614152540c9ba2587c50 Mon Sep 17 00:00:00 2001 From: Duncan Tourolle Date: Fri, 21 Aug 2026 22:32:04 +0200 Subject: [PATCH] chore(release): v0.10.0 Two user-visible features -- the app can update itself, and it can hand you a redacted diagnostics bundle -- plus the supply-chain, release integrity and build work behind them. A minor bump rather than a patch, matching how v0.9.0 was cut off v0.8.2 for a single new user requirement. This one carries two (UR-077, UR-078), both with UI in Settings. The CHANGELOG entry is the release body now: build-release.yml publishes the `## v0.10.0` section and fails if it is missing, instead of the fixed block of install instructions that every release from v0.0.1 to v0.9.1 carried verbatim. --- CHANGELOG.md | 99 +++++++++++++++++++++++++++++++++++++++ package.json | 2 +- packaging/arch/PKGBUILD | 2 +- src-tauri/Cargo.lock | 2 +- src-tauri/Cargo.toml | 2 +- src-tauri/tauri.conf.json | 2 +- 6 files changed, 104 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 332f71d4..749a45ba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,105 @@ generated trace matrix lives in [docs/traceability.md](docs/traceability.md). For how long each fixed defect had been shipping before it was found, see [docs/defect-windows.md](docs/defect-windows.md). +## v0.10.0 + +Two things you can see, and a great deal of work on how this project builds and +ships itself. The app can now update itself, and it can tell you what it did +when something goes wrong — both of which existed as gaps rather than as bugs, +which is why they lasted so long. + +### ✨ Changes + +- **JellyTau can update itself.** Anyone who installed an AppImage or ran the + Windows installer was frozen on that version permanently: nothing in the app + ever mentioned that a newer one existed, and the release page was the only + announcement. Settings → Updates now checks, shows what changed, and installs + and restarts on request. Each download is verified against JellyTau's signing + key before anything is installed, so a substituted file is refused rather than + run. Android is deliberately not wired to this — an app may not replace its own + APK, that is the system installer's job — and is given a link to the releases + page instead of a button that would fail. (UR-077 → DR-217) + +- **You can export a diagnostics bundle.** Until now the app forgot everything it + had done the moment it closed. Logs went to standard output, which nobody sees + when launching from a desktop icon, and on Android went nowhere at all — so the + backend was invisible on the platform where the hardest playback bugs live. A + crash left nothing behind. Logs are now kept in a size-capped file that + survives a restart, a crash is recorded before the app dies, and Settings → + Diagnostics exports the lot as one file to attach to a bug report. Access + tokens and passwords are stripped before anything is written to disk, not + merely before it is exported. Nothing is transmitted anywhere; you attach the + file yourself. (UR-078 → DR-218) + +- **Linux gets an AppImage again.** The release notes have advertised one for + months while the build never produced it — the packaging step looked for the + file, found nothing, and said nothing. (DR-217) + +### 🐛 Fixes + +- **Releases no longer ship every Windows installer ever built.** Every release + from v0.1.0 to v0.8.2 carried its predecessors': sixteen installers on v0.8.2, + thirteen of them stale, and a download list on v0.5.0 reaching back to 0.1.0. + The build directory is never cleaned and the build machine reuses it, so each + release collected whatever was left behind. It went unnoticed for eight months + because nothing looked wrong — the files were real and the page merely looked + busy. The stale files have been removed from the published releases, the build + now clears that directory first, and a check refuses to publish a release + containing an artifact from a different version. (DR-220) + +- **Release notes now say what changed.** All 35 previous releases published the + same block of generic install instructions, whose "What's New" section was a + link to a file that does not resolve from a release page. Every release page + now carries its own entry from this changelog, and the past ones have been + filled in. (DR-219) + +### 🔒 Security and supply chain + +- **Dependencies are now checked against a vulnerability database on every + build.** They never had been. The first run found eight vulnerabilities and one + unsoundness in the Rust dependency graph — all of them fixed by an update + nobody had a reason to run. Licences are checked against an allow-list too, so + nothing gets redistributed inside a release that does not permit it. + (DR-216) + +- **Every release publishes checksums and a bill of materials.** `SHA256SUMS` + lets you verify a download (`sha256sum -c SHA256SUMS`); the SBOM lists what + went into the build, so "does this release contain ?" has + an answer that is not "rebuild it and find out". (DR-216) + +- **Builds are reproducible again.** Every CI job named a container image tag + that was rewritten in place, so rebuilding an old release did not necessarily + rebuild the same thing. Jobs now pin an immutable tag. The one dependency that + comes from a git branch rather than a package registry is pinned to an exact + revision, closing a path by which new upstream code could arrive unreviewed in + a library linked into the player. (DR-216) + +### 🧹 Under the hood + +- Formatting, linting and type-checking now run in CI. All three were configured + and enforced by nothing: 199 files did not match the project's own formatter, a + type error could sit on the main branch until somebody cut a release, and the + test-coverage command had been broken for months by a dependency mismatch. + Coverage now has a floor that only moves up. (DR-215) + +- The traceability matrix counts requirements implemented by configuration. + Several carried the necessary annotations and were being counted as uncovered + because the extraction tool only read source files. (DR-215) + +- The project now has a security policy, contribution guide, code of conduct, + issue and pull-request templates, and an operations document covering the + builder image, the release secrets, and what losing the signing key would mean. + +- The app framework moved from Tauri 2.9.5 to 2.11.5. Nothing about this is + visible in use, but it is worth recording that it did not go quietly: the + windowing layer beneath Tauri quietly stopped publishing the Android JavaVM + and application handle that this app's credential storage had been reading for + its whole life. Nothing here had changed; a side effect several dependencies + down had simply gone away, and the app aborted on launch on every Android + device. JellyTau now sets that handle itself rather than relying on someone + else to do it. Caught by installing on a real tablet before release — no test + suite runs the app. (UR-012 → DR-223) + ## v0.9.1 A one-line fix to the home screen, released on its own because it is the kind of diff --git a/package.json b/package.json index e5469ba1..987be0bc 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "jellytau", - "version": "0.9.1", + "version": "0.10.0", "description": "A cross-platform Jellyfin client built with Tauri, SvelteKit and Rust.", "author": "Duncan Tourolle ", "license": "MIT", diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD index c0ff89f0..7444eb8b 100644 --- a/packaging/arch/PKGBUILD +++ b/packaging/arch/PKGBUILD @@ -8,7 +8,7 @@ # tarball/VCS URL and drop the local-copy prepare() step. pkgname=jellytau -pkgver=0.9.1 +pkgver=0.10.0 pkgrel=1 pkgdesc="A cross-platform Jellyfin client" arch=('x86_64') diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index cf3e1c3d..a6ffd327 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -2181,7 +2181,7 @@ dependencies = [ [[package]] name = "jellytau" -version = "0.9.1" +version = "0.10.0" dependencies = [ "aes-gcm", "async-trait", diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 53af0d28..e7b17df6 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "jellytau" -version = "0.9.1" +version = "0.10.0" description = "A cross-platform Jellyfin client" authors = ["Duncan Tourolle "] license = "MIT" diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json index 5af99f73..4104ae08 100644 --- a/src-tauri/tauri.conf.json +++ b/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "JellyTau", - "version": "0.9.1", + "version": "0.10.0", "identifier": "com.dtourolle.jellytau", "build": { "beforeDevCommand": "bun run dev",