chore(release): v0.14.0

mpv plays all video on Linux and Windows, and the built-in web video
player is gone from every platform. Windows plays audio through mpv.
mpv commands can no longer be injected through a title, and mpv now
verifies TLS; the page loses its network access. Subtitles and audio
tracks work in desktop video.

CHANGELOG.md

@@ -9,6 +9,53 @@ generated trace matrix lives in [docs/traceability.md](docs/traceability.md).
 For how long each fixed defect had been shipping before it was found, see
 [docs/defect-windows.md](docs/defect-windows.md).
 
+## v0.14.0
+
+Video on the desktop is played by mpv, on Linux and now on Windows, and the
+built-in web player is gone from every platform. Windows gets real audio
+playback too.
+
+### 🔒 Security
+
+- **A track title can no longer run a command on Linux.** mpv was handed stream
+  URLs and downloaded-file paths as a single command string, in which `;` starts
+  a new command — so a file whose title tag carried one could run a program
+  when it played. Every mpv command now passes its arguments separately.
+  (DR-298)
+- **mpv checks the server's certificate.** It did not by default, and the
+  addresses it opens carry your login token, so anyone able to intercept the
+  connection could read it. It also no longer hands a failed address to
+  youtube-dl. (DR-299)
+- **The app's web page can no longer reach the network.** It needed that only
+  for the web video player; everything now goes through the backend, so the
+  permission was just a way out for anything injected into the page.
+
+### ✨ Features
+
+- **mpv plays all video on Linux and Windows.** On Windows it draws into the app
+  window under the controls; on Linux it no longer needs the experimental
+  switch. Video still arrives transcoded to h264 for now — asking the server for
+  the original file is the next step. (DR-235, DR-237)
+- **Windows plays audio through mpv**, so volume, the equalizer, volume
+  normalization and gapless playback now work there. The installer ships
+  mpv's LGPL-licensed library and its licence text. (DR-237)
+
+### 🐛 Fixes
+
+- **Subtitles and audio-track switching work in desktop video.** mpv now loads
+  the subtitle list and switches subtitles and audio tracks itself; before this
+  they did nothing once mpv drew the picture. (DR-023, DR-024)
+- **Downloaded songs with a space in their title play offline on Linux.**
+  (DR-298)
+- **A queued download on Windows keeps the path it was saved under**, rather
+  than having its separators rewritten. (DR-211)
+
+### 🧹 Removed
+
+- **The built-in web video player and the "Native Video" setting.** There is
+  nothing left to switch between: every platform plays video natively.
+  (DR-235)
+
 ## v0.13.3
 
 ### 🐛 Fixes

docs/traceability.md

@@ -1,6 +1,6 @@
 # Code Traceability Matrix
 
-**Generated:** 9/24/2026, 11:06:05 PM
+**Generated:** 9/25/2026, 4:18:02 AM
 
 ## Summary
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jellytau",
-  "version": "0.13.3",
+  "version": "0.14.0",
   "description": "A cross-platform Jellyfin client built with Tauri, SvelteKit and Rust.",
   "author": "Duncan Tourolle <duncan@tourolle.paris>",
   "license": "MIT",

src-tauri/Cargo.lock

@@ -2275,7 +2275,7 @@ dependencies = [
 
 [[package]]
 name = "jellytau"
-version = "0.13.3"
+version = "0.14.0"
 dependencies = [
  "aes-gcm",
  "argon2",

src-tauri/Cargo.toml

@@ -4,7 +4,7 @@ name = "jellytau"
 # `player-conformance`, and a second binary makes a bare `cargo run` —
 # which `tauri dev` issues — ambiguous.
 default-run = "jellytau"
-version = "0.13.3"
+version = "0.14.0"
 description = "A cross-platform Jellyfin client"
 authors = ["Duncan Tourolle <duncan@tourolle.paris>"]
 license = "MIT"

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "JellyTau",
-  "version": "0.13.3",
+  "version": "0.14.0",
   "identifier": "com.dtourolle.jellytau",
   "build": {
     "beforeDevCommand": "bun run dev",