commit 635afe2d1e39ff359307f415c6cdbd270a535909
Author: JellyTau CI <ci@jellytau>
Date:   Fri Sep 25 10:07:48 2026 +0000

    chore(updater): manifest for v0.14.0

diff --git a/latest.json b/latest.json
new file mode 100644
index 000000000..0eef3e211
--- /dev/null
+++ b/latest.json
@@ -0,0 +1,15 @@
+{
+  "version": "0.14.0",
+  "notes": "\nVideo on the desktop is played by mpv, on Linux and now on Windows, and the\nbuilt-in web player is gone from every platform. Windows gets real audio\nplayback too.\n\n### 🔒 Security\n\n- **A track title can no longer run a command on Linux.** mpv was handed stream\n  URLs and downloaded-file paths as a single command string, in which `;` starts\n  a new command — so a file whose title tag carried one could run a program\n  when it played. Every mpv command now passes its arguments separately.\n  (DR-298)\n- **mpv checks the server's certificate.** It did not by default, and the\n  addresses it opens carry your login token, so anyone able to intercept the\n  connection could read it. It also no longer hands a failed address to\n  youtube-dl. (DR-299)\n- **The app's web page can no longer reach the network.** It needed that only\n  for the web video player; everything now goes through the backend, so the\n  permission was just a way out for anything injected into the page.\n\n### ✨ Features\n\n- **mpv plays all video on Linux and Windows.** On Windows it draws into the app\n  window under the controls; on Linux it no longer needs the experimental\n  switch. Video still arrives transcoded to h264 for now — asking the server for\n  the original file is the next step. (DR-235, DR-237)\n- **Windows plays audio through mpv**, so volume, the equalizer, volume\n  normalization and gapless playback now work there. The installer ships\n  mpv's LGPL-licensed library and its licence text. (DR-237)\n\n### 🐛 Fixes\n\n- **Subtitles and audio-track switching work in desktop video.** mpv now loads\n  the subtitle list and switches subtitles and audio tracks itself; before this\n  they did nothing once mpv drew the picture. (DR-023, DR-024)\n- **Downloaded songs with a space in their title play offline on Linux.**\n  (DR-298)\n- **A queued download on Windows keeps the path it was saved under**, rather\n  than having its separators rewritten. (DR-211)\n\n### 🧹 Removed\n\n- **The built-in web video player and the \"Native Video\" setting.** There is\n  nothing left to switch between: every platform plays video natively.\n  (DR-235)",
+  "pub_date": "2026-09-25T10:07:47Z",
+  "platforms": {
+    "linux-x86_64": {
+      "signature": "dW50cnVzdGVkIGNvbW1lbnQ6IHNpZ25hdHVyZSBmcm9tIHRhdXJpIHNlY3JldCBrZXkKUlVSczV4N1FMRVFQaW1OUkUwMmdMTnRzMm1HcFlpcUtyVU5VanZZQTBCS0NuWmRiaExvL3lWcDAwWEswR2tpN0FoZnR2bkJLVFlIeGVLUXR0V20yeUdQeVhNSGtpVnNodHdvPQp0cnVzdGVkIGNvbW1lbnQ6IHRpbWVzdGFtcDoxNzkwMzI4ODkzCWZpbGU6SmVsbHlUYXVfMC4xNC4wX2FtZDY0LkFwcEltYWdlCjVESjY4ZDZadDBZckFidE1tOERsNWtIeVhJQjArOW1yNGZvQUgwdWx6NU5lcWRLNUo0dkhUazNhQVRWUkJSM0kzWHFkelpwRmNVKyt0VFE3STBxVEJnPT0K",
+      "url": "https://gitea.tourolle.paris/dtourolle/jellytau/releases/download/v0.14.0/JellyTau_0.14.0_amd64.AppImage"
+    },
+    "windows-x86_64": {
+      "signature": "dW50cnVzdGVkIGNvbW1lbnQ6IHNpZ25hdHVyZSBmcm9tIHRhdXJpIHNlY3JldCBrZXkKUlVSczV4N1FMRVFQaWhSN3Z5b0YvQVMzRWxlWnNUT2I4WmUvelpBOFhYMTRQUWE2bUN5V3NBZGFQWXBSZjJ0MVdiczJOZE1YSGsybkptQnp6MG0rZUJoQjNCUkd3cVZpOGcwPQp0cnVzdGVkIGNvbW1lbnQ6IHRpbWVzdGFtcDoxNzkwMzI5NTk5CWZpbGU6SmVsbHlUYXVfMC4xNC4wX3g2NC1zZXR1cC5leGUKZ2xFYVZQU05wRVBKSElBUlgxcWVWRVZMM0x1VnFKbVRWc2YrSlBGOUZQOTBTNFBrdy9KU0F0eXRyWTllVFFkeUI4VGZjUFN6bWdaMy9xb0swZDdNQVE9PQo=",
+      "url": "https://gitea.tourolle.paris/dtourolle/jellytau/releases/download/v0.14.0/JellyTau_0.14.0_x64-setup.exe"
+    }
+  }
+}