chore(main): release 1.8.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.7.0"
+  ".": "1.8.0"
 }

CHANGELOG.md

@@ -1,5 +1,97 @@
 # Changelog
 
+## [1.8.0](https://github.com/InstaZDLL/WaveFlow/compare/v1.7.0...v1.8.0) (2026-08-10)
+
+
+### Features
+
+* **artist:** spotify-style hero backdrop on the artist page ([#482](https://github.com/InstaZDLL/WaveFlow/issues/482)) ([4b3f120](https://github.com/InstaZDLL/WaveFlow/commit/4b3f120e455f93e70559582d4aede4b977b67dbd))
+* **canvas:** opt-in local cache for plugin Canvases ([#473](https://github.com/InstaZDLL/WaveFlow/issues/473)) ([70cd206](https://github.com/InstaZDLL/WaveFlow/commit/70cd2064e4d0309b31d42ebfb285cd702764c595))
+* **canvas:** opt-in local cache for plugin Canvases ([#473](https://github.com/InstaZDLL/WaveFlow/issues/473)) ([8ce04be](https://github.com/InstaZDLL/WaveFlow/commit/8ce04be0bab0f117e4b19f93ea3fd73124a5313c))
+* **canvas:** per-track looping Canvas behind the now-playing view ([#442](https://github.com/InstaZDLL/WaveFlow/issues/442)) ([b5a8909](https://github.com/InstaZDLL/WaveFlow/commit/b5a89095fbb1abfa8c8a11e62453af64a4b9e2c1))
+* **canvas:** per-track looping Canvas behind the now-playing view ([#442](https://github.com/InstaZDLL/WaveFlow/issues/442)) ([f57d162](https://github.com/InstaZDLL/WaveFlow/commit/f57d162728e7163d6938522fee7e6a25219e4cf9))
+* **canvas:** waveflow:canvas/v1 world for per-track canvas plugins ([#473](https://github.com/InstaZDLL/WaveFlow/issues/473)) ([fcdc1e5](https://github.com/InstaZDLL/WaveFlow/commit/fcdc1e5de77eb1fb7f7bd398f48bf41634a952d5))
+* **canvas:** waveflow:canvas/v1 world for per-track Canvas plugins ([#473](https://github.com/InstaZDLL/WaveFlow/issues/473)) ([de01b35](https://github.com/InstaZDLL/WaveFlow/commit/de01b35b083d1929114d0ed46e3f21a1ac91f97c))
+* **context-menu:** open the track menu from the keyboard everywhere ([fc554b3](https://github.com/InstaZDLL/WaveFlow/commit/fc554b35f8a0fa06f2d870fbeb5d1e1e0055e756))
+* **context-menu:** open the track menu from the keyboard everywhere ([0fb44c3](https://github.com/InstaZDLL/WaveFlow/commit/0fb44c393d4070a72347a3a45b440b5251cb3cd6)), closes [#436](https://github.com/InstaZDLL/WaveFlow/issues/436)
+* **library:** deep rescan for the whole library, not just one folder ([c4f25ac](https://github.com/InstaZDLL/WaveFlow/commit/c4f25acbbd02f01e1b13c62d0d88e2624b423fa0)), closes [#457](https://github.com/InstaZDLL/WaveFlow/issues/457)
+* **library:** grid tab for user playlists ([542a0ff](https://github.com/InstaZDLL/WaveFlow/commit/542a0ff7178a4f5cf71821ec82d2d22ea5b23f54)), closes [#461](https://github.com/InstaZDLL/WaveFlow/issues/461)
+* **lyrics:** progressive fill on the word being sung ([8965f09](https://github.com/InstaZDLL/WaveFlow/commit/8965f097618c12e6941ced0c6a2504afa7289c70))
+* **lyrics:** progressive fill on the word being sung ([917b331](https://github.com/InstaZDLL/WaveFlow/commit/917b3311a7276aa5cac9478c519c58075a94fa20))
+* **maintenance:** one-time cleanup of cached album covers for art-having albums ([#493](https://github.com/InstaZDLL/WaveFlow/issues/493)) ([d9db659](https://github.com/InstaZDLL/WaveFlow/commit/d9db65939cf767a31481b3ee766577a519f8c3cf))
+* **mpd:** serve the MPD protocol so existing clients can drive playback ([b250be6](https://github.com/InstaZDLL/WaveFlow/commit/b250be6c253b7bd31d304c384f4d6e4de6bd170f))
+* **mpd:** serve the MPD protocol so existing clients can drive playback ([0bae7ad](https://github.com/InstaZDLL/WaveFlow/commit/0bae7ad2c996cdc55620e9197ed1b56ef685061f)), closes [#471](https://github.com/InstaZDLL/WaveFlow/issues/471)
+* **now-playing:** cover ↔ artist crossfade slideshow ([#466](https://github.com/InstaZDLL/WaveFlow/issues/466)) ([62b33ed](https://github.com/InstaZDLL/WaveFlow/commit/62b33ed666e1b0e5dc91740844ef326a0e5a81d0))
+* **now-playing:** cover ↔ artist crossfade slideshow ([#466](https://github.com/InstaZDLL/WaveFlow/issues/466)) ([fd90186](https://github.com/InstaZDLL/WaveFlow/commit/fd901869d0d2ef6c79cbe7b53d338de475727216))
+* **player:** user-selectable spectrum visualizer colors ([#468](https://github.com/InstaZDLL/WaveFlow/issues/468)) ([b5ef338](https://github.com/InstaZDLL/WaveFlow/commit/b5ef338a25b73d6ce3ff1b8ada818ff9b7181214))
+* **player:** user-selectable spectrum visualizer colors ([#468](https://github.com/InstaZDLL/WaveFlow/issues/468)) ([904b652](https://github.com/InstaZDLL/WaveFlow/commit/904b6525890037f8883e6c8068001679e147617c))
+* **plugins:** add waveflow:ui/v1 world host surface + redacted library read ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443)) ([a48cab8](https://github.com/InstaZDLL/WaveFlow/commit/a48cab8c9b18f73d261b16bca9648a849cb15cc1))
+* **plugins:** disclose ui library.read_artists permission in the store ([afe2d62](https://github.com/InstaZDLL/WaveFlow/commit/afe2d6297e1d3a0b664cf9e5e5ee32e61dca3b6a))
+* **plugins:** disclose ui library.read_artists permission in the store ([92fada3](https://github.com/InstaZDLL/WaveFlow/commit/92fada310646e1031b613a9387d8077e44280f48))
+* **plugins:** localized manifest descriptions & option labels ([a39e1cf](https://github.com/InstaZDLL/WaveFlow/commit/a39e1cf24b468e94f43e9465e400d822459c84c6)), closes [#440](https://github.com/InstaZDLL/WaveFlow/issues/440)
+* **plugins:** publish-safe `*_i18n` sibling for localized strings ([e76b70f](https://github.com/InstaZDLL/WaveFlow/commit/e76b70fb519ea981e9854425d2f3ebd2bf1c3c35)), closes [#440](https://github.com/InstaZDLL/WaveFlow/issues/440)
+* **plugins:** render ui-world plugin views + dynamic sidebar ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443) Part 2) ([d4c44eb](https://github.com/InstaZDLL/WaveFlow/commit/d4c44eb5024a7b8e3aa42170c0ab5bd693788297))
+* **plugins:** render ui-world plugin views + dynamic sidebar ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443) Part 2) ([7b8cd27](https://github.com/InstaZDLL/WaveFlow/commit/7b8cd278b79e001b8f3eb6bb123023d98340edf2))
+* **plugins:** support direct download_url in registry entries ([c6d4bc7](https://github.com/InstaZDLL/WaveFlow/commit/c6d4bc74757d45c8581aefb55d3f13eccf8b34c0))
+* **plugins:** support direct download_url in registry entries ([cd54eb8](https://github.com/InstaZDLL/WaveFlow/commit/cd54eb8c62f0092914222b5609f3d2cc8429f4c6))
+* **plugins:** waveflow:ui/v1 world host surface + redacted library read ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443) Part 1) ([5885099](https://github.com/InstaZDLL/WaveFlow/commit/58850991d5943d5e9eade539705ff5399c7ebabf))
+
+
+### Bug Fixes
+
+* **album:** carry the full track row so Properties isn't half empty ([c2515fb](https://github.com/InstaZDLL/WaveFlow/commit/c2515fb5fdd4cf1ea0523001d7d10943cc5f2a5f)), closes [#458](https://github.com/InstaZDLL/WaveFlow/issues/458)
+* **artist:** address review on the hero backdrop ([58d8348](https://github.com/InstaZDLL/WaveFlow/commit/58d83486c99ab35ef3878727411a836e5e5655cf))
+* **artist:** clear the read stamp on profile change ([da06a78](https://github.com/InstaZDLL/WaveFlow/commit/da06a78033356380ab9f563f60a4cd27ebb7a7c3))
+* **artist:** keep an in-flight read from clobbering an optimistic toggle ([4ebc933](https://github.com/InstaZDLL/WaveFlow/commit/4ebc9330e126d9a778e20ee35f2ae441b32d69b5))
+* **artist:** reset the hero preference when the profile changes ([5ad81f2](https://github.com/InstaZDLL/WaveFlow/commit/5ad81f2a79c00c51b834127cb12810e143684bcc))
+* **artist:** scope the hero preference's resolved flag to the profile ([d9605ff](https://github.com/InstaZDLL/WaveFlow/commit/d9605ffb917da7e730cd2a9a4394f7172889cce8))
+* **canvas:** atomic mp4 publish + profile-scoped Canvas cache ([fe909ff](https://github.com/InstaZDLL/WaveFlow/commit/fe909ff9838870dd5a285c8ca83672a48eebcbba))
+* **canvas:** harden Canvas cache profile isolation + atomic mp4 publish ([d07be8f](https://github.com/InstaZDLL/WaveFlow/commit/d07be8f866cc1e13b9fe2a97554fb7d3b1b8f611))
+* **canvas:** re-validate cache-download redirects (SSRF) + doc canvas world ([10f904b](https://github.com/InstaZDLL/WaveFlow/commit/10f904b2e0ad99a840100dd3ae6184bd17ed4d35))
+* **canvas:** treat an unsafe cache redirect as a hard security failure ([8d87e8c](https://github.com/InstaZDLL/WaveFlow/commit/8d87e8c24e26f416e5acb844ac412d72f5eb3553))
+* **context-menu:** drop a dead tab stop and a mislabelled row ([db09a80](https://github.com/InstaZDLL/WaveFlow/commit/db09a803bbe511b3f1d8fe71aa7700196f5fc497)), closes [#436](https://github.com/InstaZDLL/WaveFlow/issues/436)
+* **deezer:** cross-profile-safe cover prune + preserve hash on skipped download ([73b4482](https://github.com/InstaZDLL/WaveFlow/commit/73b44822658dd228433ed509eb3f11b446c55c51))
+* **deezer:** don't let a cover-less cache row block a re-fetch ([#493](https://github.com/InstaZDLL/WaveFlow/issues/493) review) ([94badcf](https://github.com/InstaZDLL/WaveFlow/commit/94badcf728943e0cd46c94fb911ca48b09821401))
+* **deezer:** only disk-cache an album cover when the album lacks local art ([#493](https://github.com/InstaZDLL/WaveFlow/issues/493)) ([5281d9d](https://github.com/InstaZDLL/WaveFlow/commit/5281d9d2ed9e356e63974dc45f68b0dd68ba3656))
+* **deezer:** only disk-cache an album cover when the album lacks local art ([#493](https://github.com/InstaZDLL/WaveFlow/issues/493)) ([ea14ec5](https://github.com/InstaZDLL/WaveFlow/commit/ea14ec579934a2ac5d1db409407cf5d146120685))
+* **deps:** force fast-uri >= 3.1.5 and resync the Flatpak sources ([e0ee50c](https://github.com/InstaZDLL/WaveFlow/commit/e0ee50ced6092a9c174c2aee4f8ab503f10af885))
+* **library:** one shared lock for every rescan control ([bca21df](https://github.com/InstaZDLL/WaveFlow/commit/bca21dfaebdcf996e1a53006eb89075961bea175)), closes [#457](https://github.com/InstaZDLL/WaveFlow/issues/457)
+* **library:** reach the playlists empty state instead of a missing key ([83ea6b2](https://github.com/InstaZDLL/WaveFlow/commit/83ea6b279955e541545c52ef443dcbf67c8c9b77)), closes [#461](https://github.com/InstaZDLL/WaveFlow/issues/461)
+* **library:** surface scan failures instead of silently succeeding ([0f867fe](https://github.com/InstaZDLL/WaveFlow/commit/0f867feee24748fc8e44c95102c2799a85e411cd)), closes [#457](https://github.com/InstaZDLL/WaveFlow/issues/457)
+* **lyrics:** carry the fill across speed changes, stop at a full word ([23045ab](https://github.com/InstaZDLL/WaveFlow/commit/23045ab1f3e53da669e3a4b1421e89abd2124ab9))
+* **lyrics:** keep the fill responsive to seeks inside the active word ([8dfdc5c](https://github.com/InstaZDLL/WaveFlow/commit/8dfdc5ce12ca23f7a230df3c87c3185473186d53))
+* **lyrics:** re-anchor the fill when playback resumes ([15de90c](https://github.com/InstaZDLL/WaveFlow/commit/15de90cec35665aa8cfc094e2c56840d2bf4c492))
+* **lyrics:** retry LRCLIB fuzzily before the catch-all providers ([b733769](https://github.com/InstaZDLL/WaveFlow/commit/b733769f552d3bc03e9e136ef6165598d621b946)), closes [#463](https://github.com/InstaZDLL/WaveFlow/issues/463)
+* **maintenance:** fail the cover prune if the profile list can't be read ([1b12cc6](https://github.com/InstaZDLL/WaveFlow/commit/1b12cc6829235b70364acc04933729660ceb109c))
+* **motion-cache:** strip trailing-dot hosts in SSRF guard + allow 10 redirects ([fff142d](https://github.com/InstaZDLL/WaveFlow/commit/fff142d4e8228de620a3d93db20b2b5903b341dc))
+* **motion-cache:** validate the initial url inside cache_mp4 (defence-in-depth) ([198ba47](https://github.com/InstaZDLL/WaveFlow/commit/198ba47591e55da1352fb4e97ba8fa955df4b8f4))
+* **mpd:** address CodeRabbit review — protocol conformance + robustness ([#471](https://github.com/InstaZDLL/WaveFlow/issues/471)) ([35c768d](https://github.com/InstaZDLL/WaveFlow/commit/35c768d51bd8180a808ee2c61bc5a71c8b919a78))
+* **mpd:** consistent snapshots + atomic writes + hardened MPD settings UI ([#471](https://github.com/InstaZDLL/WaveFlow/issues/471)) ([e654ec0](https://github.com/InstaZDLL/WaveFlow/commit/e654ec0d2931f4ad40f3134b8abb542079d7dba2))
+* **mpd:** reject `single oneshot` instead of persisting it as durable ([#471](https://github.com/InstaZDLL/WaveFlow/issues/471)) ([4d0b9fe](https://github.com/InstaZDLL/WaveFlow/commit/4d0b9fe3096f6d7faefc2a3e1b9ecdd03fb79343))
+* **mpd:** seek-in-place + serialized settings saves + UI options sync ([#471](https://github.com/InstaZDLL/WaveFlow/issues/471)) ([473837d](https://github.com/InstaZDLL/WaveFlow/commit/473837dacb23a3ba2cd0de984821b97557ea7df0))
+* **now-playing:** dedupe artist enrichment + gate slideshow fetch ([#466](https://github.com/InstaZDLL/WaveFlow/issues/466)) ([1d04cce](https://github.com/InstaZDLL/WaveFlow/commit/1d04cce92e5c78a6a5c79652225f15fb6124eb0b))
+* **now-playing:** exclude radio/Spotify tracks from the cover slideshow ([#466](https://github.com/InstaZDLL/WaveFlow/issues/466)) ([ec41261](https://github.com/InstaZDLL/WaveFlow/commit/ec41261bdc2b61fc72428d83d5840a753e708a70))
+* **now-playing:** tag panel artist image by artist id to avoid a stale flash ([#466](https://github.com/InstaZDLL/WaveFlow/issues/466)) ([c2dc991](https://github.com/InstaZDLL/WaveFlow/commit/c2dc991a3aca50cda32aae971a7b039f017e021d))
+* **player:** gate visualizer color cycle until the profile's value loads ([858b206](https://github.com/InstaZDLL/WaveFlow/commit/858b20679ab60c5a391d3810de9f839b936e38f1))
+* **plugin-host:** dedup a cause against its parent, not the whole buffer ([5a7bff7](https://github.com/InstaZDLL/WaveFlow/commit/5a7bff7be30e2e1014d5a9ce27378ffa9850d5ad)), closes [#452](https://github.com/InstaZDLL/WaveFlow/issues/452)
+* **plugin-host:** surface the cause chain behind an http error ([8546324](https://github.com/InstaZDLL/WaveFlow/commit/854632449a6c989464bcb898350c2c3dd6abcf2f)), closes [#452](https://github.com/InstaZDLL/WaveFlow/issues/452)
+* **plugins:** busy-gate open-url + reject null badge elements ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443)) ([3a39a0f](https://github.com/InstaZDLL/WaveFlow/commit/3a39a0f04922bdaf253e7e4a79a6ada61f760ecc))
+* **plugins:** clamp track_count to u32 range before narrowing ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443)) ([241e46d](https://github.com/InstaZDLL/WaveFlow/commit/241e46d6a7654313c06bc5d73706913658a3ebb1))
+* **plugins:** gate artist snapshot on permission + validate descriptor JSON ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443)) ([12bba19](https://github.com/InstaZDLL/WaveFlow/commit/12bba19a9efd5e4fec062961ffa6f197fe45e9eb))
+* **plugins:** harden ui view — separate flow tokens, a11y, text validation ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443)) ([a00a217](https://github.com/InstaZDLL/WaveFlow/commit/a00a2173479a2bcd55c74ca96f9e32a9847a22c9))
+* **plugins:** skip blank entries when resolving a localized string ([4784b4a](https://github.com/InstaZDLL/WaveFlow/commit/4784b4af9be9fc00521f88e8b4b6055a8c2cbcd0)), closes [#440](https://github.com/InstaZDLL/WaveFlow/issues/440)
+* **plugins:** validate download_url + install redirects with the SSRF guard ([977635b](https://github.com/InstaZDLL/WaveFlow/commit/977635bdec80d4f1b6ea1d10482c0e71a3b59447))
+* **plugins:** validate ui descriptor tree + loading states + hi grammar ([#443](https://github.com/InstaZDLL/WaveFlow/issues/443)) ([808fa09](https://github.com/InstaZDLL/WaveFlow/commit/808fa09b600a7ee52a589b5956ba814e7d5335b2))
+* **profile:** scope profile_setting reads and writes to a profile ([f1438f2](https://github.com/InstaZDLL/WaveFlow/commit/f1438f29cc6aacfa505b4355a7f25f8dd3d744cf))
+* **scan-toast:** a scan that hit errors no longer reads as a success ([7b9d39f](https://github.com/InstaZDLL/WaveFlow/commit/7b9d39f051952e88f97b6d5a51ec53fc3f442acb)), closes [#457](https://github.com/InstaZDLL/WaveFlow/issues/457)
+* **settings:** locale-aware MB formatting in the cover-prune status ([e748c11](https://github.com/InstaZDLL/WaveFlow/commit/e748c11da3dc0f39648ec1b1c797a256e4f17c36))
+* **settings:** tidy the cover-prune status timer + announce it to a11y ([848add8](https://github.com/InstaZDLL/WaveFlow/commit/848add8215031868278bd47924ec852e5d869f68))
+* **stats:** local artist images, ragged KPI row, clipped hour labels ([e6d1000](https://github.com/InstaZDLL/WaveFlow/commit/e6d10002d7a35303e1b96372ea06a656fafd9760)), closes [#453](https://github.com/InstaZDLL/WaveFlow/issues/453)
+* **web-radio:** let a 429 fall through to the next host ([cb8a31c](https://github.com/InstaZDLL/WaveFlow/commit/cb8a31c4da733bb380fc59bfa4979ea376cf8926)), closes [#452](https://github.com/InstaZDLL/WaveFlow/issues/452)
+* **web-radio:** try the round-robin host, and retry, before failing ([4a20483](https://github.com/InstaZDLL/WaveFlow/commit/4a20483e6cbfdf6e39e6778b20ccc54003d191a3)), closes [#452](https://github.com/InstaZDLL/WaveFlow/issues/452)
+* **wrapped:** give each banner key its own broadcast channel ([c74eb48](https://github.com/InstaZDLL/WaveFlow/commit/c74eb484e1eb9ee6b06ae5ec442004a588b3f8b5))
+* **wrapped:** withhold the banner until both keys have been read ([c83ebb7](https://github.com/InstaZDLL/WaveFlow/commit/c83ebb75e10d9c2a33b1a174536194a79a228787))
+
 ## [1.7.0](https://github.com/InstaZDLL/WaveFlow/compare/v1.6.0...v1.7.0) (2026-07-26)
 
 

README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/static/v1?label=version&message=1.7.0&color=emerald&style=flat-square" alt="Version" /> <!-- x-release-please-version -->
+  <img src="https://img.shields.io/static/v1?label=version&message=1.8.0&color=emerald&style=flat-square" alt="Version" /> <!-- x-release-please-version -->
   <img src="https://img.shields.io/github/downloads/InstaZDLL/WaveFlow/total?style=flat-square&color=emerald&label=downloads" alt="Downloads" />
   <img src="https://img.shields.io/badge/tauri-2.11-blue?style=flat-square&logo=tauri" alt="Tauri 2" />
   <img src="https://img.shields.io/badge/react-19-61dafb?style=flat-square&logo=react" alt="React 19" />

package.json

@@ -1,7 +1,7 @@
 {
   "name": "waveflow",
   "private": true,
-  "version": "1.7.0",
+  "version": "1.8.0",
   "type": "module",
   "license": "GPL-3.0",
   "scripts": {

src-tauri/crates/app/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "waveflow"
-version = "1.7.0"
+version = "1.8.0"
 description = "Local music player for desktop — Spotify-inspired UI, real-time audio engine, your files stay on your machine."
 authors = ["InstaZDLL <github.105mh@8shield.net>"]
 edition = "2021"
@@ -187,7 +187,7 @@ fast_image_resize = "6"
 # rasterise text or embedded raster — the SVGs are pure shapes/gradients,
 # which trims ~2 MB of font + image-codec deps from the bundle.
 resvg = { version = "0.47", default-features = false }
-usvg = { version = "0.48", default-features = false }
+usvg = { version = "0.47", default-features = false }
 tiny-skia = "0.12"
 anyhow = "1"
 

src-tauri/crates/app/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "WaveFlow",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "identifier": "app.waveflow",
   "build": {
     "beforeDevCommand": "bun run dev",

src-tauri/crates/core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "waveflow-core"
-version = "1.7.0"
+version = "1.8.0"
 description = "Business logic shared between the WaveFlow desktop app and the future waveflow-server: scanning, metadata enrichment, DSD conversion, smart-playlist algorithms, repository traits."
 authors = ["InstaZDLL <github.105mh@8shield.net>"]
 edition = "2021"
@@ -132,7 +132,7 @@ symphonia = { version = "0.6", default-features = false, features = [
 # the desktop already applies — the SVG is pure shapes + gradients,
 # no embedded raster or text.
 resvg = { version = "0.47", default-features = false }
-usvg = { version = "0.48", default-features = false }
+usvg = { version = "0.47", default-features = false }
 tiny-skia = "0.12"
 
 # Time stamps for the smart-playlist generators (`play_event.played_at`