• v1.3.1 678937f18b

    v1.3.1
    All checks were successful
    Build / flatpak-build-and-test (push) Successful in 7m38s
    Stable

    spalencsar released this 2026-10-18 17:25:05 +02:00 | 0 commits to main since this release

    Security and maintenance release: SSRF defense for station artwork and discovery, owner-only permissions for persisted stream credentials, plain-text metadata rendering against rich-text injection, and native desktop window decorations.

    Security

    • Artwork & Discovery SSRF Defense (NetworkUrlGuard): Block private, loopback, link-local, and special network targets during station artwork and icon discovery. Hostnames are resolved asynchronously before network requests, unsafe DNS responses are rejected, requests are pinned to validated IP addresses with HTTP/2 and proxy bypass, and redirects are re-validated.
    • Protected File Permissions: Restrict the BearWave configuration directory to owner-only (0700) and persisted JSON files (my_stations.json, favorites.json, state.json) to 0600 using atomic QSaveFile writes to safeguard sensitive stream credentials.
    • Literal Plain-Text Rendering: Force untrusted remote station metadata, ICY playback status, session track history, tags, and codec information to render as literal plain text (Text.PlainText) across QML components to eliminate rich-text HTML/SSRF injection vectors.

    Fixed

    • Native Window Decorations: Restored standard native window decorations across Linux desktops (resolves missing title bar and window controls on Linux Mint Cinnamon).
    • Test Isolation: Playback and Radio Browser unit tests now run against isolated XDG test paths instead of developer configuration, cached API data, or live network calls.

    Installation & Updates

    • Flatpak:
      flatpak update de.nerdbear.bearwave
      
    Downloads
  • v1.3.0 c385b5813e

    BearWave 1.3.0
    Some checks failed
    Publish to AUR / aur-publish (release) Has been cancelled
    Stable

    spalencsar released this 2026-08-10 17:29:13 +02:00 | 19 commits to main since this release

    Major multi-desktop UI release: universal Linux positioning, Now Playing stage,
    responsive transport, My stations, and a redesigned station list.

    Added

    • System light/dark appearance (xdg-desktop-portal, gsettings, Qt style hints,
      optional shell session files). Override with BEARWAVE_THEME=light|dark.
    • Now Playing stage (right column): active stream only, large artwork,
      current/previous track cards, session track history from ICY metadata
      (max 30, deduped; cleared on stop/station change).
    • My stations library for manually added streams
      (~/.config/bearwave/my_stations.json), separate from Favorites; edit and
      remove; country via localized dropdown.
    • Shared monochrome MediaIcon / IconButton set (no emoji chrome).
    • Shared PlayerTransport used by stage dock and bottom bar.
    • Three transport layouts driven by window size:
      • wide + tall (width ≥ 1240, height ≥ 960): transport dock in the stage
      • wide + short (e.g. 1440×900): stage keeps Now Playing (compact cover);
        bottom strip is transport-only
      • narrow (width < 1240): full bottom player bar with station meta

    Changed

    • Product framing: Qt 6 Linux desktop app (not KDE-only, not tied to a
      compositor or shell). About, AppStream, desktop entry, README, packaging.
    • Flatpak: keep org.kde.Platform/Sdk 6.10 as the official Qt stack on
      Flathub; document that this is not a Plasma requirement. Finish-args and
      cleanup tidied.
    • Control D-Bus interface: org.kde.BearWave.Control →
      de.nerdbear.BearWave.Control.
    • Desktop entry drops FreeDesktop KDE category; German Comment/Keywords.
    • Radio Browser HTTP User-Agent: BearWave/<version>.
    • Outside KDE sessions: Fusion Quick Controls, no KDE platform theme,
      frameless client chrome with BearTheme drag (startSystemMove).
    • Left sidebar restyled (Browse / Library, DE·NL chips, monochrome icons).
    • Station list: card layout, meta chips, Live marker, header with count,
      clearer empty states; single-click plays.
    • Add/Edit station dialogs restyled to BearTheme.
    • Responsive layout: detail column below ~1240px width; list margins keep
      card borders clear of the stage edge.

    Fixed

    • Live streams no longer stick on Buffering… while audio is already
      playing (Qt BufferingMedia on radio).
    • ICY metadata: force HTTP/1.1 (HTTP/2 breaks metaint), wait for headers,
      abort cleanly when a stream has no titles, broader StreamTitle parsing.
    • Light mode when the desktop prefers light but Qt alone stayed dark.
    • Arch packaging: qt6-tools makedepend; drop unused extra-cmake-modules.
    • Flatpak: persist favorites, My stations, and state via XDG config/cache
      paths (GenericConfigLocation / GenericCacheLocation) instead of a hard-coded
      ~/.config/bearwave under $HOME, which the sandbox cannot write without
      overrides (#7). Optional
      one-shot migration from the legacy host path when the new dir is empty.
    Downloads
  • v1.2.0 3ff7e23d8a

    spalencsar released this 2026-07-25 20:14:20 +02:00 | 25 commits to main since this release

    BearWave 1.2.0 is a feature and stability release for the KDE-focused desktop radio app.

    Highlights

    • Dutch UI translation and a persistent language selector for German, English, Dutch, Russian, and the system default
    • Bundled CLDR country names and localized country search
    • More resilient Radio Browser discovery with bounded retries, cooldown, fallback nodes, and API caching
    • Validated, asynchronous station artwork with homepage icon discovery and a bounded 50 MiB cache
    • Visible connecting, buffering, retrying, paused, and unavailable playback states
    • Redesigned About area with an embedded changelog and consistent keyboard-accessible buttons
    • Numerous layout, translation, null-safety, stale-network-reply, and stream URL validation fixes
    • Correct direct Flatpak installation by aligning the download reference with the published repository branch

    Existing favorites, player state, and cached artwork remain compatible; no manual migration is required.

    Full changelog: https://hostbw.de/spalencsar/bearwave/compare/v1.1.1...v1.2.0

    Downloads
  • v1.1.1 d4a15bce5c

    spalencsar released this 2026-07-21 08:48:07 +02:00 | 32 commits to main since this release

    Patch release 1.1.1 over the 1.1.0 desktop redesign.

    Security

    • Validate stream URLs (http/https only) before every playback attempt and when loading favorites/history/resume state from disk

    Added

    • SVG app and tray icon (bearwave.svg); PNG kept as fallback
    • Flatpak package version 1.1.1

    Changed

    • Updated screenshots and demo video for the 1.1 layout

    Fixed

    • Light/white borders on search and dialog buttons in dark UI
    • About-page header/navigation consistency
    • Flatpak deploy rsync permission attribute errors

    Install

    Full notes: CHANGELOG.md

    Downloads
  • v1.1.0 dcbec82b53

    spalencsar released this 2026-06-27 13:36:05 +02:00 | 40 commits to main since this release

    Desktop UI redesign with sidebar navigation, station details panel, embedded About page, and Russian translations.

    Added

    • Russian language support (thanks to @aaly11)
    • Mac-inspired layout: sidebar, flat station rows, details panel, compact player bar
    • Embedded About page with full GPLv3 license text and third-party technology notes

    Changed

    • Replaced modal About dialog with in-app About page
    • Refreshed neutral dark theme and responsive search/filter/player layout
    • BearWave line logo in sidebar; cleaner top toolbar branding

    Fixed

    • German and Russian translation updates after QML refactor
    • GPL text loading via C++ context property
    • About-page navigation and layout clipping issues
    • Reduced Denglish in German UI (keeps common terms like Votes and Bitrate)

    Install

    • Flatpak: flatpak install --from https://flatpak.bearwave.app/bearwave.flatpakref
    • Arch AUR: bearwave-git
    • Source: tag v1.1.0

    See CHANGELOG.md for full details.

    Downloads
  • v1.0.5 d42aa5e043

    spalencsar released this 2026-06-21 08:59:48 +02:00 | 75 commits to main since this release

    BearWave 1.0.5

    Stability, security, and UI refactor release. Includes all changes from 1.0.4 plus CI fixes.

    Security (1.0.4)

    • Validate manual station URLs: only http:// and https:// schemes accepted
    • Restrict notification cover art downloads to HTTPS URLs
    • Add network transfer timeouts for ICY metadata, cover art, and notification fetches

    Fixed

    • Playback index for history, resume, and next/previous navigation
    • Radio Browser API race where stale responses could overwrite newer results
    • Error banner when cached station data is still available
    • Search filter persisting across page changes and compact-mode debounce
    • Stale list index after station list reload
    • Wayland system tray menu via native QSystemTrayIcon
    • MPRIS metadata publishing for desktop media widgets (e.g. PlasMusic)
    • 1.0.5: Unit tests in headless CI/Docker (Qt offscreen + FFmpeg backend)

    Changed

    • Refactor Main.qml into reusable QML components and BearTheme singleton (~1800 → ~270 lines)
    • Remove unused Kirigami, I18n, and CoreAddons dependencies
    • Add backend unit tests for playback navigation and API race handling
    • CI runs ctest and broader qmllint

    Install

    Arch (AUR): yay -S bearwave-git

    Source build:

    cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
    cmake --build build -j"$(nproc)"
    cmake --install build --prefix "$HOME/.local"
    

    Flatpak: see README

    Full changelog: https://github.com/spalencsar/bearwave/blob/v1.0.5/CHANGELOG.md

    Downloads
  • v1.0.4 f4b3109c32

    spalencsar released this 2026-06-21 08:52:45 +02:00 | 77 commits to main since this release

    BearWave 1.0.4 — git tag release (retroactive)

    This release documents the v1.0.4 git tag. It was created before CI was fully green and was not published on GitHub at the time.

    Recommended install: use v1.0.5 instead (same changes + CI test fixes).

    Included in this tag

    See CHANGELOG 1.0.4:

    • Security: manual URL validation (http/https), HTTPS cover downloads, network timeouts
    • Fixed: playback navigation, API races, tray, MPRIS, search UX
    • Changed: modular QML refactor, unit tests, dependency cleanup
    Downloads
  • v1.0.3 0c6cfbce75

    v1.0.3 Stable

    spalencsar released this 2026-05-30 10:11:36 +02:00 | 90 commits to main since this release

    Added

    • Dynamic World Categories dashboard showing country flags and popular genre tags.
    • Dynamic country name localization mapping for German translation support.
    • Local JSON caching for countries retrieved from the Radio Browser API.

    Changed

    • Optimized Categories view layout to prevent text clipping (dynamic grid columns and scroll margins).
    Downloads
  • v1.0.2 954157e605

    spalencsar released this 2026-05-28 08:30:15 +02:00 | 91 commits to main since this release

    What's new in this release:

    • Single Instance Check: Implemented a session DBus check at startup to ensure only one instance of the app runs at a time. Starting the app again will raise and focus the existing window.
    • Wayland Crash Fix: Replaced blocking DBus calls with asynchronous pending calls to prevent segmentation faults and freezes under Wayland.
    • Stream Metadata Improvements:
    • Fixed a bug where QMediaPlayer metadata updates would overwrite and clear valid ICY stream metadata.
    • Fixed a regex parsing issue that caused stream metadata to fail on song titles containing apostrophes.
    • Fixed infinite loading of radio stations by introducing connection timeouts.
    • Project License & Standards:
    • Relicensed the project to GNU GPLv3 (GPL-3.0-or-later).
    • Added SPDX license headers to all source files and OARS content rating metadata.

    Downloads
  • v1.0.1 f05c234fb1

    spalencsar released this 2026-05-22 20:04:37 +02:00 | 122 commits to main since this release

    What's new in this release:

    • Automatic Online Search Fallback: Automatically switches to searching the online radio-browser.info database after a short typing pause (600ms) if no local matching station is found.
    • Stream Details: Displays technical stream codec and bitrate badges directly in the player footer.
    • Edit Custom Stations: Added support to edit manually added stations directly via a pencil icon (✏) in the UI.
    • Desktop Notifications & Cover Art Caching: Song/metadata change notifications on the desktop now display matching cover art (or fallback to the station's favicon) using a localized cached directory.
    • Mute Control: Click the speaker icon in the footer to mute/unmute audio playback.
    Downloads