From a67452bc805712c6dc8d9f221501f0200769a7c6 Mon Sep 17 00:00:00 2001 From: Duncan Tourolle Date: Fri, 25 Sep 2026 04:19:06 -0400 Subject: [PATCH] chore(release): v0.14.0 mpv plays all video on Linux and Windows, and the built-in web video player is gone from every platform. Windows plays audio through mpv. mpv commands can no longer be injected through a title, and mpv now verifies TLS; the page loses its network access. Subtitles and audio tracks work in desktop video. --- CHANGELOG.md | 47 +++++++++++++++++++++++++++++++++++++++ docs/traceability.md | 2 +- package.json | 2 +- src-tauri/Cargo.lock | 2 +- src-tauri/Cargo.toml | 2 +- src-tauri/tauri.conf.json | 2 +- 6 files changed, 52 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e9c6b68ac..f688d6970 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,53 @@ generated trace matrix lives in [docs/traceability.md](docs/traceability.md). For how long each fixed defect had been shipping before it was found, see [docs/defect-windows.md](docs/defect-windows.md). +## v0.14.0 + +Video on the desktop is played by mpv, on Linux and now on Windows, and the +built-in web player is gone from every platform. Windows gets real audio +playback too. + +### ๐Ÿ”’ Security + +- **A track title can no longer run a command on Linux.** mpv was handed stream + URLs and downloaded-file paths as a single command string, in which `;` starts + a new command โ€” so a file whose title tag carried one could run a program + when it played. Every mpv command now passes its arguments separately. + (DR-298) +- **mpv checks the server's certificate.** It did not by default, and the + addresses it opens carry your login token, so anyone able to intercept the + connection could read it. It also no longer hands a failed address to + youtube-dl. (DR-299) +- **The app's web page can no longer reach the network.** It needed that only + for the web video player; everything now goes through the backend, so the + permission was just a way out for anything injected into the page. + +### โœจ Features + +- **mpv plays all video on Linux and Windows.** On Windows it draws into the app + window under the controls; on Linux it no longer needs the experimental + switch. Video still arrives transcoded to h264 for now โ€” asking the server for + the original file is the next step. (DR-235, DR-237) +- **Windows plays audio through mpv**, so volume, the equalizer, volume + normalization and gapless playback now work there. The installer ships + mpv's LGPL-licensed library and its licence text. (DR-237) + +### ๐Ÿ› Fixes + +- **Subtitles and audio-track switching work in desktop video.** mpv now loads + the subtitle list and switches subtitles and audio tracks itself; before this + they did nothing once mpv drew the picture. (DR-023, DR-024) +- **Downloaded songs with a space in their title play offline on Linux.** + (DR-298) +- **A queued download on Windows keeps the path it was saved under**, rather + than having its separators rewritten. (DR-211) + +### ๐Ÿงน Removed + +- **The built-in web video player and the "Native Video" setting.** There is + nothing left to switch between: every platform plays video natively. + (DR-235) + ## v0.13.3 ### ๐Ÿ› Fixes diff --git a/docs/traceability.md b/docs/traceability.md index be0ede63e..f018fe7b6 100644 --- a/docs/traceability.md +++ b/docs/traceability.md @@ -1,6 +1,6 @@ # Code Traceability Matrix -**Generated:** 9/24/2026, 11:06:05 PM +**Generated:** 9/25/2026, 4:18:02 AM ## Summary diff --git a/package.json b/package.json index f31f66e1c..2b5ff0a2e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "jellytau", - "version": "0.13.3", + "version": "0.14.0", "description": "A cross-platform Jellyfin client built with Tauri, SvelteKit and Rust.", "author": "Duncan Tourolle ", "license": "MIT", diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 748763b4a..a51732c0e 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -2275,7 +2275,7 @@ dependencies = [ [[package]] name = "jellytau" -version = "0.13.3" +version = "0.14.0" dependencies = [ "aes-gcm", "argon2", diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 1a26a5507..02542a379 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -4,7 +4,7 @@ name = "jellytau" # `player-conformance`, and a second binary makes a bare `cargo run` โ€” # which `tauri dev` issues โ€” ambiguous. default-run = "jellytau" -version = "0.13.3" +version = "0.14.0" description = "A cross-platform Jellyfin client" authors = ["Duncan Tourolle "] license = "MIT" diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json index 4bcf2d28c..e9e21caa7 100644 --- a/src-tauri/tauri.conf.json +++ b/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "JellyTau", - "version": "0.13.3", + "version": "0.14.0", "identifier": "com.dtourolle.jellytau", "build": { "beforeDevCommand": "bun run dev",