chore(main): release 1.8.0

[github-actions]

🤖 I have created a release beep boop

1.8.0 (2026-08-05)

Features

• artist: spotify-style hero backdrop on the artist page (#482) (4b3f120)
• canvas: opt-in local cache for plugin Canvases (#473) (70cd206)
• canvas: opt-in local cache for plugin Canvases (#473) (8ce04be)
• canvas: per-track looping Canvas behind the now-playing view (#442) (b5a8909)
• canvas: per-track looping Canvas behind the now-playing view (#442) (f57d162)
• canvas: waveflow:canvas/v1 world for per-track canvas plugins (#473) (fcdc1e5)
• canvas: waveflow:canvas/v1 world for per-track Canvas plugins (#473) (de01b35)
• context-menu: open the track menu from the keyboard everywhere (fc554b3)
• context-menu: open the track menu from the keyboard everywhere (0fb44c3), closes #436
• library: deep rescan for the whole library, not just one folder (c4f25ac), closes #457
• library: grid tab for user playlists (542a0ff), closes #461
• mpd: serve the MPD protocol so existing clients can drive playback (b250be6)
• mpd: serve the MPD protocol so existing clients can drive playback (0bae7ad), closes #471
• now-playing: cover ↔ artist crossfade slideshow (#466) (62b33ed)
• now-playing: cover ↔ artist crossfade slideshow (#466) (fd90186)
• player: user-selectable spectrum visualizer colors (#468) (b5ef338)
• player: user-selectable spectrum visualizer colors (#468) (904b652)
• plugins: add waveflow:ui/v1 world host surface + redacted library read (#443) (a48cab8)
• plugins: disclose ui library.read_artists permission in the store (afe2d62)
• plugins: disclose ui library.read_artists permission in the store (92fada3)
• plugins: localized manifest descriptions & option labels (a39e1cf), closes #440
• plugins: publish-safe *_i18n sibling for localized strings (e76b70f), closes #440
• plugins: render ui-world plugin views + dynamic sidebar (#443 Part 2) (d4c44eb)
• plugins: render ui-world plugin views + dynamic sidebar (#443 Part 2) (7b8cd27)
• plugins: support direct download_url in registry entries (c6d4bc7)
• plugins: support direct download_url in registry entries (cd54eb8)
• plugins: waveflow:ui/v1 world host surface + redacted library read (#443 Part 1) (5885099)

Bug Fixes

• album: carry the full track row so Properties isn't half empty (c2515fb), closes #458
• artist: address review on the hero backdrop (58d8348)
• artist: clear the read stamp on profile change (da06a78)
• artist: keep an in-flight read from clobbering an optimistic toggle (4ebc933)
• artist: reset the hero preference when the profile changes (5ad81f2)
• artist: scope the hero preference's resolved flag to the profile (d9605ff)
• canvas: atomic mp4 publish + profile-scoped Canvas cache (fe909ff)
• canvas: harden Canvas cache profile isolation + atomic mp4 publish (d07be8f)
• canvas: re-validate cache-download redirects (SSRF) + doc canvas world (10f904b)
• canvas: treat an unsafe cache redirect as a hard security failure (8d87e8c)
• context-menu: drop a dead tab stop and a mislabelled row (db09a80), closes #436
• library: one shared lock for every rescan control (bca21df), closes #457
• library: reach the playlists empty state instead of a missing key (83ea6b2), closes #461
• library: surface scan failures instead of silently succeeding (0f867fe), closes #457
• lyrics: retry LRCLIB fuzzily before the catch-all providers (b733769), closes #463
• motion-cache: strip trailing-dot hosts in SSRF guard + allow 10 redirects (fff142d)
• motion-cache: validate the initial url inside cache_mp4 (defence-in-depth) (198ba47)
• mpd: address CodeRabbit review — protocol conformance + robustness (#471) (35c768d)
• mpd: consistent snapshots + atomic writes + hardened MPD settings UI (#471) (e654ec0)
• mpd: reject single oneshot instead of persisting it as durable (#471) (4d0b9fe)
• mpd: seek-in-place + serialized settings saves + UI options sync (#471) (473837d)
• now-playing: dedupe artist enrichment + gate slideshow fetch (#466) (1d04cce)
• now-playing: exclude radio/Spotify tracks from the cover slideshow (#466) (ec41261)
• now-playing: tag panel artist image by artist id to avoid a stale flash (#466) (c2dc991)
• player: gate visualizer color cycle until the profile's value loads (858b206)
• plugin-host: dedup a cause against its parent, not the whole buffer (5a7bff7), closes #452
• plugin-host: surface the cause chain behind an http error (8546324), closes #452
• plugins: busy-gate open-url + reject null badge elements (#443) (3a39a0f)
• plugins: clamp track_count to u32 range before narrowing (#443) (241e46d)
• plugins: gate artist snapshot on permission + validate descriptor JSON (#443) (12bba19)
• plugins: harden ui view — separate flow tokens, a11y, text validation (#443) (a00a217)
• plugins: skip blank entries when resolving a localized string (4784b4a), closes #440
• plugins: validate download_url + install redirects with the SSRF guard (977635b)
• plugins: validate ui descriptor tree + loading states + hi grammar (#443) (808fa09)
• scan-toast: a scan that hit errors no longer reads as a success (7b9d39f), closes #457
• stats: local artist images, ragged KPI row, clipped hour labels (e6d1000), closes #453
• web-radio: let a 429 fall through to the next host (cb8a31c), closes #452
• web-radio: try the round-robin host, and retry, before failing (4a20483), closes #452

---

This PR was generated with Release Please. See documentation.