-
v1.3.1
StableAll checks were successfulBuild / flatpak-build-and-test (push) Successful in 7m38sreleased this
2026-10-18 17:25:05 +02:00 | 0 commits to main since this releaseSecurity and maintenance release: SSRF defense for station artwork and discovery, owner-only permissions for persisted stream credentials, plain-text metadata rendering against rich-text injection, and native desktop window decorations.
Security
- Artwork & Discovery SSRF Defense (
NetworkUrlGuard): Block private, loopback, link-local, and special network targets during station artwork and icon discovery. Hostnames are resolved asynchronously before network requests, unsafe DNS responses are rejected, requests are pinned to validated IP addresses with HTTP/2 and proxy bypass, and redirects are re-validated. - Protected File Permissions: Restrict the BearWave configuration directory to owner-only (
0700) and persisted JSON files (my_stations.json,favorites.json,state.json) to0600using atomicQSaveFilewrites to safeguard sensitive stream credentials. - Literal Plain-Text Rendering: Force untrusted remote station metadata, ICY playback status, session track history, tags, and codec information to render as literal plain text (
Text.PlainText) across QML components to eliminate rich-text HTML/SSRF injection vectors.
Fixed
- Native Window Decorations: Restored standard native window decorations across Linux desktops (resolves missing title bar and window controls on Linux Mint Cinnamon).
- Test Isolation: Playback and Radio Browser unit tests now run against isolated XDG test paths instead of developer configuration, cached API data, or live network calls.
Installation & Updates
- Flatpak:
flatpak update de.nerdbear.bearwave
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- Artwork & Discovery SSRF Defense (
-
BearWave 1.3.0
StableSome checks failedPublish to AUR / aur-publish (release) Has been cancelledreleased this
2026-08-10 17:29:13 +02:00 | 19 commits to main since this releaseMajor multi-desktop UI release: universal Linux positioning, Now Playing stage,
responsive transport, My stations, and a redesigned station list.Added
- System light/dark appearance (xdg-desktop-portal, gsettings, Qt style hints,
optional shell session files). Override withBEARWAVE_THEME=light|dark. - Now Playing stage (right column): active stream only, large artwork,
current/previous track cards, session track history from ICY metadata
(max 30, deduped; cleared on stop/station change). - My stations library for manually added streams
(~/.config/bearwave/my_stations.json), separate from Favorites; edit and
remove; country via localized dropdown. - Shared monochrome MediaIcon / IconButton set (no emoji chrome).
- Shared PlayerTransport used by stage dock and bottom bar.
- Three transport layouts driven by window size:
- wide + tall (
width ≥ 1240,height ≥ 960): transport dock in the stage - wide + short (e.g. 1440×900): stage keeps Now Playing (compact cover);
bottom strip is transport-only - narrow (
width < 1240): full bottom player bar with station meta
- wide + tall (
Changed
- Product framing: Qt 6 Linux desktop app (not KDE-only, not tied to a
compositor or shell). About, AppStream, desktop entry, README, packaging. - Flatpak: keep org.kde.Platform/Sdk 6.10 as the official Qt stack on
Flathub; document that this is not a Plasma requirement. Finish-args and
cleanup tidied. - Control D-Bus interface:
org.kde.BearWave.Control→
de.nerdbear.BearWave.Control. - Desktop entry drops FreeDesktop
KDEcategory; German Comment/Keywords. - Radio Browser HTTP
User-Agent:BearWave/<version>. - Outside KDE sessions: Fusion Quick Controls, no KDE platform theme,
frameless client chrome with BearTheme drag (startSystemMove). - Left sidebar restyled (Browse / Library, DE·NL chips, monochrome icons).
- Station list: card layout, meta chips, Live marker, header with count,
clearer empty states; single-click plays. - Add/Edit station dialogs restyled to BearTheme.
- Responsive layout: detail column below ~1240px width; list margins keep
card borders clear of the stage edge.
Fixed
- Live streams no longer stick on Buffering… while audio is already
playing (Qt BufferingMedia on radio). - ICY metadata: force HTTP/1.1 (HTTP/2 breaks metaint), wait for headers,
abort cleanly when a stream has no titles, broader StreamTitle parsing. - Light mode when the desktop prefers light but Qt alone stayed dark.
- Arch packaging:
qt6-toolsmakedepend; drop unusedextra-cmake-modules. - Flatpak: persist favorites, My stations, and state via XDG config/cache
paths (GenericConfigLocation/GenericCacheLocation) instead of a hard-coded
~/.config/bearwaveunder$HOME, which the sandbox cannot write without
overrides (#7). Optional
one-shot migration from the legacy host path when the new dir is empty.
Downloads
-
Source code (ZIP)
2 downloads
-
Source code (TAR.GZ)
2 downloads
- System light/dark appearance (xdg-desktop-portal, gsettings, Qt style hints,
-
BearWave 1.2.0 Stable
released this
2026-07-25 20:14:20 +02:00 | 25 commits to main since this releaseBearWave 1.2.0 is a feature and stability release for the KDE-focused desktop radio app.
Highlights
- Dutch UI translation and a persistent language selector for German, English, Dutch, Russian, and the system default
- Bundled CLDR country names and localized country search
- More resilient Radio Browser discovery with bounded retries, cooldown, fallback nodes, and API caching
- Validated, asynchronous station artwork with homepage icon discovery and a bounded 50 MiB cache
- Visible connecting, buffering, retrying, paused, and unavailable playback states
- Redesigned About area with an embedded changelog and consistent keyboard-accessible buttons
- Numerous layout, translation, null-safety, stale-network-reply, and stream URL validation fixes
- Correct direct Flatpak installation by aligning the download reference with the published repository branch
Existing favorites, player state, and cached artwork remain compatible; no manual migration is required.
Full changelog: https://hostbw.de/spalencsar/bearwave/compare/v1.1.1...v1.2.0
Downloads
-
Source code (ZIP)
3 downloads
-
Source code (TAR.GZ)
1 download
-
BearWave 1.1.1 Stable
released this
2026-07-21 08:48:07 +02:00 | 32 commits to main since this releasePatch release 1.1.1 over the 1.1.0 desktop redesign.
Security
- Validate stream URLs (
http/httpsonly) before every playback attempt and when loading favorites/history/resume state from disk
Added
- SVG app and tray icon (
bearwave.svg); PNG kept as fallback - Flatpak package version 1.1.1
Changed
- Updated screenshots and demo video for the 1.1 layout
Fixed
- Light/white borders on search and dialog buttons in dark UI
- About-page header/navigation consistency
- Flatpak deploy rsync permission attribute errors
Install
- Flatpak:
flatpak update de.nerdbear.bearwave(from https://flatpak.bearwave.app/) - Arch AUR:
bearwave-git - Source: tag
v1.1.1
Full notes: CHANGELOG.md
Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
2 downloads
- Validate stream URLs (
-
BearWave 1.1.0 Stable
released this
2026-06-27 13:36:05 +02:00 | 40 commits to main since this releaseDesktop UI redesign with sidebar navigation, station details panel, embedded About page, and Russian translations.
Added
- Russian language support (thanks to @aaly11)
- Mac-inspired layout: sidebar, flat station rows, details panel, compact player bar
- Embedded About page with full GPLv3 license text and third-party technology notes
Changed
- Replaced modal About dialog with in-app About page
- Refreshed neutral dark theme and responsive search/filter/player layout
- BearWave line logo in sidebar; cleaner top toolbar branding
Fixed
- German and Russian translation updates after QML refactor
- GPL text loading via C++ context property
- About-page navigation and layout clipping issues
- Reduced Denglish in German UI (keeps common terms like Votes and Bitrate)
Install
- Flatpak:
flatpak install --from https://flatpak.bearwave.app/bearwave.flatpakref - Arch AUR:
bearwave-git - Source: tag
v1.1.0
See CHANGELOG.md for full details.
Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
2 downloads
-
BearWave 1.0.5 Stable
released this
2026-06-21 08:59:48 +02:00 | 75 commits to main since this releaseBearWave 1.0.5
Stability, security, and UI refactor release. Includes all changes from 1.0.4 plus CI fixes.
Security (1.0.4)
- Validate manual station URLs: only
http://andhttps://schemes accepted - Restrict notification cover art downloads to HTTPS URLs
- Add network transfer timeouts for ICY metadata, cover art, and notification fetches
Fixed
- Playback index for history, resume, and next/previous navigation
- Radio Browser API race where stale responses could overwrite newer results
- Error banner when cached station data is still available
- Search filter persisting across page changes and compact-mode debounce
- Stale list index after station list reload
- Wayland system tray menu via native
QSystemTrayIcon - MPRIS metadata publishing for desktop media widgets (e.g. PlasMusic)
- 1.0.5: Unit tests in headless CI/Docker (Qt offscreen + FFmpeg backend)
Changed
- Refactor
Main.qmlinto reusable QML components andBearThemesingleton (~1800 → ~270 lines) - Remove unused Kirigami, I18n, and CoreAddons dependencies
- Add backend unit tests for playback navigation and API race handling
- CI runs
ctestand broaderqmllint
Install
Arch (AUR):
yay -S bearwave-gitSource build:
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release cmake --build build -j"$(nproc)" cmake --install build --prefix "$HOME/.local"Flatpak: see README
Full changelog: https://github.com/spalencsar/bearwave/blob/v1.0.5/CHANGELOG.md
Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
1 download
- Validate manual station URLs: only
-
BearWave 1.0.4 (git tag) Stable
released this
2026-06-21 08:52:45 +02:00 | 77 commits to main since this releaseBearWave 1.0.4 — git tag release (retroactive)
This release documents the v1.0.4 git tag. It was created before CI was fully green and was not published on GitHub at the time.
Recommended install: use v1.0.5 instead (same changes + CI test fixes).
Included in this tag
See CHANGELOG 1.0.4:
- Security: manual URL validation (http/https), HTTPS cover downloads, network timeouts
- Fixed: playback navigation, API races, tray, MPRIS, search UX
- Changed: modular QML refactor, unit tests, dependency cleanup
Downloads
-
Source code (ZIP)
2 downloads
-
Source code (TAR.GZ)
3 downloads
-
v1.0.3 Stable
released this
2026-05-30 10:11:36 +02:00 | 90 commits to main since this releaseAdded
- Dynamic World Categories dashboard showing country flags and popular genre tags.
- Dynamic country name localization mapping for German translation support.
- Local JSON caching for countries retrieved from the Radio Browser API.
Changed
- Optimized Categories view layout to prevent text clipping (dynamic grid columns and scroll margins).
Downloads
-
Source code (ZIP)
2 downloads
-
Source code (TAR.GZ)
2 downloads
-
BearWave v1.0.2 Stable
released this
2026-05-28 08:30:15 +02:00 | 91 commits to main since this releaseWhat's new in this release:
• Single Instance Check: Implemented a session DBus check at startup to ensure only one instance of the app runs at a time. Starting the app again will raise and focus the existing window.
• Wayland Crash Fix: Replaced blocking DBus calls with asynchronous pending calls to prevent segmentation faults and freezes under Wayland.
• Stream Metadata Improvements:
• Fixed a bug where QMediaPlayer metadata updates would overwrite and clear valid ICY stream metadata.
• Fixed a regex parsing issue that caused stream metadata to fail on song titles containing apostrophes.
• Fixed infinite loading of radio stations by introducing connection timeouts.
• Project License & Standards:
• Relicensed the project to GNU GPLv3 (GPL-3.0-or-later).
• Added SPDX license headers to all source files and OARS content rating metadata.Downloads
-
Source code (ZIP)
2 downloads
-
Source code (TAR.GZ)
4 downloads
-
Source code (ZIP)
-
BearWave v1.0.1 Stable
released this
2026-05-22 20:04:37 +02:00 | 122 commits to main since this releaseWhat's new in this release:
- Automatic Online Search Fallback: Automatically switches to searching the online
radio-browser.infodatabase after a short typing pause (600ms) if no local matching station is found. - Stream Details: Displays technical stream codec and bitrate badges directly in the player footer.
- Edit Custom Stations: Added support to edit manually added stations directly via a pencil icon (✏) in the UI.
- Desktop Notifications & Cover Art Caching: Song/metadata change notifications on the desktop now display matching cover art (or fallback to the station's favicon) using a localized cached directory.
- Mute Control: Click the speaker icon in the footer to mute/unmute audio playback.
Downloads
-
Source code (ZIP)
4 downloads
-
Source code (TAR.GZ)
3 downloads
- Automatic Online Search Fallback: Automatically switches to searching the online