chore(main): release 1.5.0

[github-actions]

🤖 I have created a release beep boop

1.5.0 (2026-06-13)

Features

• core: add postgres feature + PostgresProfileRepository (75ad434)
• core: add postgres feature + PostgresProfileRepository (#181) (3ab43f0)
• core: project track.album_id in postgres list + get + insert + update (4354fec)
• core: project track.album_id in postgres list + get + insert + update (b793b16)
• core: rename_for_user returns the updated row (#184) (bfb899b)
• core: tenant-scoped methods on PostgresProfileRepository (#183) (24ffa58)
• core: tenant-scoped PostgresLibraryRepository (Phase 1.b.5a) (#185) (0473647)
• core: tenant-scoped PostgresPlaylistRepository (Phase 1.b.5c) (#188) (25b9ada)
• core: tenant-scoped PostgresTrackRepository (Phase 1.b.5b) (#186) (101aff5)
• layout: add sidebar hide/show toggle for tighter screens (#167) (5c5f193)
• layout: add sidebar hide/show toggle for tighter screens (#167) (95e7287)
• lyrics: add waveflow-syncedlyrics crate with multi-provider lookup (b610c3c)
• lyrics: add waveflow-syncedlyrics crate with multi-provider lookup (e7ca8de)
• lyrics: opt-in centering for synced lyrics in fullscreen (#168) (6dc101a)
• lyrics: opt-in centering for synced lyrics in fullscreen (#168) (5162942)
• plugin-sdk: bind host imports + permission gates (phase 2b) (fab60bc)
• plugin-sdk: bind host imports + permission gates (RFC-002 phase 2b) (882bc3d)
• plugin-sdk: manifest + sidecar assets foundation (RFC-002 phase 1) (5a81b7d)
• plugin-sdk: manifest + sidecar assets foundation (RFC-002) (a267f26)
• plugin-sdk: settings panel for installed plugins (phase 3.2) (00c57f0)
• plugin-sdk: settings panel for installed plugins (phase 3.2) (edc7902)
• plugin-sdk: wasmtime runtime skeleton + sandbox (phase 2a) (09af2ba)
• plugin-sdk: wasmtime runtime skeleton + sandbox (RFC-002 phase 2a) (d76d082)
• plugin-sdk: wire runtime into Tauri app + commands (phase 3.1) (b396dd2)
• plugin-sdk: wire runtime into Tauri app + commands (phase 3.1) (176ada1)
• plugin-sdk: wire wasi p2 + ship web-radio plugin crate (phase 4.a) (04c3560)
• plugin-sdk: wire wasi p2 + ship web-radio plugin crate (phase 4.a) (3ff74c6)
• server-auth: oauth-loopback browser handshake (Phase 1.f.desktop.1b) (#190) (d2366c4)
• server-auth: waveflow-server account binding (Phase 1.f.desktop.1) (#189) (f33a2ec)
• share: phase 1.g.3 desktop — canonical_id plumbing + share modal (05be1e5)
• share: phase 1.g.3 desktop — canonical_id plumbing + share modal (6d8acef)
• sync: drain task pushes pending ops to waveflow-server (Phase 1.f.desktop.4a) (#196) (1357bd8)
• sync: emit per-track snapshots in playlist tracks ops (phase 1.j.b) (acd9215)
• sync: emit per-track snapshots in playlist tracks ops (phase 1.j.b) (fab8d77)
• sync: lamport clock + pending-ops queue infrastructure (Phase 1.f.desktop.2) (#191) (21b19a2)
• sync: library + liked + rating hooks (Phase 1.f.desktop.5) (6f9dfad)
• sync: library + liked_track + rating hooks (Phase 1.f.desktop.5) (90f42fd)
• sync: per-profile sync mode toggle (Phase 1.f.desktop.3) (#194) (1e274fb)
• sync: track sync emit from scanner + duplicates (phase 4.d.0.3) (4bec4bf)
• sync: track sync emit from scanner + duplicates (phase 4.d.0.3) (94e4fd9)
• sync: wire playlist CRUD enqueue hooks (Phase 1.f.desktop.2b) (#192) (3d13a60)
• sync: ws subscriber + canonical-id mapping (Phase 1.f.desktop.4b) (928335e)
• sync: ws subscriber + canonical-id mapping (Phase 1.f.desktop.4b) (7aa6147)
• web-radio: bundle wasm in app + invocation commands + ui (phase 4.b) (6f6410f)
• web-radio: bundle wasm in app + invocation commands + ui (phase 4.b) (82a7e84)
• web-radio: route live streams through the cpal engine (phase 4.c) (6f0059e)
• web-radio: route live streams through the cpal engine (phase 4.c) (a836d85)

Bug Fixes

• address CodeRabbit finding — keep serde tests un-gated (68f894d)
• address CodeRabbit findings on PR #181 (e27059b)
• audio: auto-rebuild cpal output on DeviceNotAvailable (#175) (85ccd8e)
• audio: auto-rebuild cpal output on DeviceNotAvailable (#175) (5bb43e3)
• audio: drain ring before forcing pause + reset crossfade buffers on seek (#173) (052f2ac)
• audio: eliminate 500 ms pop on seek (#173) (999748c)
• audio: eliminate 500 ms pop on seek (#173) (9e7a738)
• audio: negotiate WASAPI Exclusive format chain S24/S16 (#174) (0dec8e5)
• audio: negotiate WASAPI Exclusive format chain S24/S16 (#174) (9e68bf7)
• audio: preserve duration_ms + replay-gain on device-rebuild resume (#175) (669c94c)
• audio: stop orphaned output handle when send fails on rebuild (#175) (e3aa210)
• core: also project album_id in update_for_library RETURNING (60550e1)
• core: inline TrackRow SELECT in postgres list/get methods (#187) (062c550)
• layout: mark hidden sidebar with inert to block tab + pointer (#167) (923414f)
• lyrics: address review findings in syncedlyrics crate + integration (b671366)
• lyrics: drop panic-prone SyncedLyricsClient::new fallback (405a956)
• lyrics: roll back optimistic flip on persistence failure (#168) (f6a3b88)
• maintenance: restart unconditionally to avoid half-teardown zombie (#180) (430d636)
• maintenance: silence cpal output before stop_and_wait (#180) (a4a174f)
• plugin-sdk: add HTTP timeouts + offline-mode short-circuit hook (d655b2b)
• plugin-sdk: address cr round 1 — defence-in-depth + clarifications (6a90a6c)
• plugin-sdk: allow uninstall to clean up orphans with missing manifest (b3ddeaf)
• plugin-sdk: bound plugin.wasm read via take() + reject non-files (b3b7b49)
• plugin-sdk: build PluginRuntime on spawn_blocking to avoid reqwest panic (58122ad)
• plugin-sdk: build PluginRuntime on spawn_blocking to avoid reqwest panic (454eb66)
• plugin-sdk: cap HTTP response body + lock HostCtx invariants (561f6bc)
• plugin-sdk: cap plugin.wasm size at 50 MB before reading (ba6c196)
• plugin-sdk: clarify wasi defaults + tighten test + handle empty url_resolved (45d9a58)
• plugin-sdk: disable HTTP redirect following to close SSRF gap (79b4de8)
• plugin-sdk: exclude orphan .tmp files from state quota tally (1ae48ff)
• plugin-sdk: existence gate + spawn_blocking on FS-heavy commands (1fddc96)
• plugin-sdk: label storageRead as "storage read" not "asset read" (fb0ef54)
• plugin-sdk: offline first per CLAUDE.md + lock state/http_client (05b17f0)
• plugin-sdk: per-plugin mutex to close TOCTOU on enable/uninstall (104cf6c)
• plugin-sdk: pin manifest id + drop exists() precheck on remove (c79c7c2)
• plugin-sdk: race-free state writes + offline ordering + id source (c74983b)
• plugin-sdk: restore WIT permission-first order + pin manifest id (2bcbe62)
• plugin-sdk: split storage.read + assets chips in plugins settings panel (9823c48)
• plugin-sdk: strict char-class gate on plugin id before any state work (cf3cf50)
• plugin-sdk: upsert full app_setting columns to satisfy schema NOT NULLs (02f6a14)
• server-auth: render OAuth callback page as HTML (74e13b7)
• server-auth: render OAuth callback page as HTML (4b7a6d9)
• settings: wire reset app button + factory reset command (#180) (f8adeda)
• settings: wire reset app button + factory reset command (#180) (69a4c45)
• share: cr round 1 — type-only dep, race guards, neutral errors (d1151c9)
• spotify: render OAuth callback page as HTML + share helper with server_auth (bdfc45c)
• sync: address coderabbit review (4b) (a1f0386)
• sync: address coderabbit round 3 (4b) (15b8431)
• sync: derive toggle_like_track post-state from rows_affected (e03c295)
• syncedlyrics: address pre-merge review findings (security + correctness) (38e58c1)
• syncedlyrics: apply review follow-ups for client reuse, throttle, attribution, validation (265f150)
• syncedlyrics: drop duplicate Musixmatch from fallback + tolerate malformed lrclib ids (0043bdf)
• sync: emit per-track delete sync ops on folder removal (4.d.0 follow-up) (8619252)
• sync: emit per-track delete sync ops on folder removal (4.d.0 follow-up) (0bee857)
• sync: per-field nullability in string_value_from_payload (d1a4413)
• sync: reject malformed payload types instead of coercing (d2373b7)
• sync: reject value=null on every field, pin DB state in test (bebb213)
• sync: tighten set-value payload + harden mixed-array test (35fab60)
• sync: use tauri::async_runtime::spawn in drain + ws spawn hooks (7925e64)
• sync: warn loudly when ws:// JWT upgrade hits a non-loopback host (98a82c6)
• sync: warn loudly when ws:// JWT upgrade hits a non-loopback host (53cafcb)
• web-radio: cancel in-flight async on back + stop paths (c95864b)
• web-radio: log missing resources + close async races + remove desync sources (e9f84b0)
• web-radio: radio-aware ui controls + log redaction + offline guard (9ed9fdd)
• web-radio: separate loading state from playing so clicks survive the probe (8ba6fb3)
• web-radio: separate loading state from playing so clicks survive the probe (2a148a8)
• web-radio: swallow benign AbortError when switching stations fast (9b1a561)

---

This PR was generated with Release Please. See documentation.