Version bump across Cargo/tauri/npm/snap/flake, metainfo release entry,
and TAG_DETAILS for 1.2.15. flake.nix hashes cleared (filled post-tag
via nix build once v1.2.15 exists).
cc
- version: Cargo.toml, tauri.conf.json, package.json (+ Cargo.lock, package-lock.json)
- metainfo.xml: add 1.2.14 release entry
- About modal codename -> "Just cleaning"
- docs/release-1.2.14: TAG_DETAILS.md + CHANGELOG_FULL.md
Snap and Nix flake are intentionally left at 1.2.13: they pin a source
tag, and this is a no-tag, build-only cycle (no distribution).
cc
Version bumped across Cargo.toml, tauri.conf.json, package.json, snapcraft.yaml (version + source-tag), flake.nix, and the lockfiles. metainfo.xml gains a 1.2.13 release entry, the About modal codename becomes "400+ stars", and the README contributors list adds @Vudgekek and @DoubleGate.
cc
GitHub Security advisory for file-type < 21.3.1: malformed ASF input
with a zero-size sub-header triggers an infinite loop in the ASF parser
(medium severity). Our exposure is transitive — node-vibrant → jimp →
file-type — and only reached when extracting palette colors from album
artwork. Trusted Qobuz CDN + user-local library limit the practical
attack surface to near zero, but the alert is real and easy to close.
The upstream fix is a 6-line position-advance guard in core.js
(commit 319abf87). Cleanly backports to our 16.5.4 with identical
semantics. Applied via patch-package so the change survives every
`npm install` and is visible in the repo.
Direct upgrade to 21.3.1 wasn't viable: file-type went ESM-only at
17.0.0, and our jimp 0.22.x chain still uses CommonJS `require()` —
an override would have broken vibrant at runtime. Patch-package is
the right tool when upstream's only fix lives behind a breaking
module-system change.
Added `postinstall: patch-package` to package.json so the patch
applies automatically on fresh installs.
cc
Pre-pretext, the karaoke gradient applied to a single span shared the same
horizontal cut across every wrapped visual line — line 2 appeared partially
sung when only line 1's worth of vocals had played. Pretext lays out the
active lyric into visual lines; each renders as its own block-level span
with its own 0->100% gradient, so progress fills sequentially.
Also adds race/perf safeguards layered on top:
- Cancellation token on tick().then(layoutActiveLine) so rapid activeIndex
changes (seek-scrub, fast songs) don't queue stale microtasks against
the current DOM.
- ResizeObserver coalesces via rAF and ignores sub-pixel width deltas, so
window-drag and the active-line scale animation don't trigger Pretext
re-measurement every callback.
- segmentBounds prefix array memoizes cumulative widths, dropping per-
segment progress lookup from O(i) to O(1) inside the each-block.
- EMA writes equality-guard measuredBlockMs/Delta and lookaheadEnabled so
Svelte signals don't fan out no-op updates 60 times per second.
- Lookahead clamped at 1/30 and disabled on backward dp so a coarse audio
jump or in-line seek can't poison the visual lead.
- measuredBlockMs seed lowered (>=20ms, dur * 0.01) since rAF-rate data
converges the EMA within 2-3 ticks; the prior 80ms floor visibly lagged
the gradient on the first frame of every new line.
- LyricsLine type unified from store (single source of truth).
Hotfix release. Reverts titlebar-mode-selector and PR #406 (broken
window chrome on Linux); preserves PR #407 (sticky home header) and
adds PR #408 (macOS native icon and tray variants by @Vudgekek).
cc
Drains the wiki "23 warnings" baseline back to zero so future regressions
stand out:
* Drop 16 unprefixed \`app-region\` CSS lines across TitleBar, TitleBarNav,
ImmersiveHeader, ImmersivePlayer, MiniPlayerFooter and MiniPlayerWindowControls.
Tauri's webview is WebKit / Chromium on every platform we ship to, so
\`-webkit-app-region\` already covers the chrome-drag region; the
unprefixed property only existed to keep stylelint quiet but the CSS
spec doesn't define it and svelte-check warns on every site.
* Remove 2 empty rulesets in AlbumCreditsModal and NowPlayingBar (leftover
comment-only blocks from earlier refactors).
* Pair \`-moz-appearance: textfield\` with the standard \`appearance: textfield\`
in LocalLibraryTagEditorModal so the rule no longer trips the
property-companion warning.
* Delete the unused \`.quality-text\` selector in NowPlayingBar.backup.svelte
(file is a frozen snapshot of an older NPB iteration; the live NPB
doesn't use that class).
* Annotate Tooltip.svelte and immersive/panels/VinylPanel.svelte with
\`svelte-ignore a11y_no_static_element_interactions\` plus a comment
explaining the context — both are decorative wrappers (a tooltip hit
area; a 3D tilt effect on artwork) where adding an ARIA role would
misrepresent the semantics.
* Add \`@types/node\` as a devDependency (^22) so the tsconfig resolution
for the SvelteKit-extended config stops complaining about the missing
type definition.
cc
Extracts the dominant color from album artwork (via node-vibrant) and
paints it as a soft top-down gradient behind the album header, with an
appearance toggle to opt out. Adds the .has-art-bg state class plus
contrast-lifted overrides for back button, info text, and artist link.
cc
Adds @kawarp/core (vanilla TS, zero deps, MIT) as a dev dep and mounts
it on a full-bleed canvas inside KawarpPanel, behind the existing
artwork/title content. The panel signals ImmersivePlayer to skip the
global ImmersiveBackground when active so the comparison vs Static
isn't a double-blur.
Settings tuned for album art ambience:
- warpIntensity 0.65 (subtle organic motion, not hallucinatory)
- blurPasses 12 (avoids visible bands on high-contrast covers)
- animationSpeed 0.6 (slow drift, doesn't fight the music)
- transitionDuration 1000 ms (matches the gapless lead-time so the
background is already on the new artwork before the audio swap)
- tintIntensity 0.12 (gentle dark anchor for low-key covers)
Lifecycle:
- onMount creates the renderer, loads the current artwork, starts
- $effect reloads on artwork change (kawarp does its own crossfade)
- ResizeObserver keeps the WebGL backing store in sync with layout
- onDestroy disposes the GL context
Compositing layer hint (will-change/translateZ) mirrors the fix used
on the 1.2.10 sticky headers — keeps WebKitGTK from repainting
surrounding chrome on every animation frame.
cc
Hotfix on top of 1.2.9 to address the gapless-play regression
introduced by dee987c1a's tightened isGaplessTransition gate combined
with a long-standing race in the player's transition-swap atomics.
Bumped:
- src-tauri/Cargo.toml + Cargo.lock
- src-tauri/tauri.conf.json
- package.json + package-lock.json
- snapcraft.yaml (version + source-tag) — packaging/snap/snapcraft.yaml
follows automatically via symlink
- packaging/flatpak/com.blitzfc.qbz.metainfo.xml (new release entry)
cc
Quiet Polish: QConnect cleanup (#316) and a long round of Linux
tray polish. Sticky-header gap fix (no more padding-top on scroll
containers), Edit folder shortcut from the playlist sidebar (#364),
shift-range + Ctrl/Cmd+A multi-select across the remaining views,
opt-in resume of seek position (#317), and Qobuz subtitle/edition
propagated through queue / MPRIS / scrobbling (#360).
Bumped:
- src-tauri/Cargo.toml + Cargo.lock
- src-tauri/tauri.conf.json
- package.json + package-lock.json
- snapcraft.yaml (version + source-tag)
- packaging/flatpak/com.blitzfc.qbz.metainfo.xml (new release entry)
packaging/snap/snapcraft.yaml is a symlink to the root snapcraft.yaml
so it tracks automatically.
cc
Validated on this branch:
- npm run check (svelte-check): 0 errors, 41 warnings (identical to 5.9.3)
- npm run build (vite production): succeeds in ~57s
- npm run test:run (vitest): same 2 pre-existing failures as pre-release,
no new regressions
Replaces closed dependabot PR #347.
cc
Mixtapes & Collections release. Bumps all version references
(Cargo.toml, tauri.conf.json, package.json, snapcraft.yaml, both
Cargo.lock, package-lock.json), adds the 1.2.8 entry to the Flatpak
metainfo, and sets the About modal codename to "My QBZ".
cc
* src-tauri/Cargo.toml and Cargo.lock: 1.2.4 -> 1.2.5
* src-tauri/tauri.conf.json: 1.2.4 -> 1.2.5
* package.json (+ package-lock.json regenerated): 1.2.4 -> 1.2.5
* snapcraft.yaml: 1.2.4 -> 1.2.5
* packaging/flatpak/com.blitzfc.qbz.metainfo.xml: new <release> entry
dated 2026-04-15 covering the visual refresh (new logo + login
branding), Plasma/Klassy auto-detect for window controls,
opt-in match-system-chrome rounded corners, Editor's Picks
ribbon cleanup, the two sidebar menu positioning fixes shipped
alongside this bump, and the DAC wizard contrast fix.
Tag not applied per request — release notes are staged, ready for
the screenshots pass and manual tag afterward.
cc
Supersedes PR #306 (dependabot conflict with pre-release).
Includes security fixes for redirect validation and BODY_SIZE_LIMIT
enforcement on chunked requests.
cc
vicrodh