lokal-music/desktop v14.1.6

Release v14.1.6

on GitHub

Merge pull request #746 from lokal-music/release/v14.1.6

Changelog

Windows builds: free code signing provided by SignPath.io, certificate by SignPath Foundation (code signing policy).

FYI:
Lokal is 100% local; the library, history, anything in database, or any info that is used for API's such as yt-dlp, LRCLIB, is NOT seen by us.

What's Changed

• Fix LastWave DASH 403 by decoding XML-escaped signed segment URLs (#744)

  Details

  Failure identified in desktop log (Nov 6, 2026)

  LastWave search works; stream metadata returns HTTP 200; 28–60 DASH segments are planned. Every initialization segment (index 0) fails HTTP 403. No media bytes are staged, so this is a CDN request failure, not decoding or search.

  Desktop / mobile discrepancy

  Mobile uses XmlDocument.parse, which decodes XML entities in SegmentTemplate attributes and BaseURL text. Desktop's regex MPD parser used raw strings. Signed DASH CDN URLs containing & or & were requested with an incorrect literal amp; / #38; query parameter. A signature-protected CDN can reject these malformed requests with 403.

  Fix

  • Decode XML entities once for SegmentTemplate attributes and BaseURL, preserving URL-encoded values such as %26.
  • Request DASH bytes with Accept-Encoding: identity as on mobile.
  • Keep the existing URL validation and redirect protections.
  • Log only Boolean indicators for XML-escaped separators and init-query presence, never CDN signed URLs or tokens.

  Tests

  • Unit regression reproduces malformed XML-signed CDN URLs and a mock 403; validates all three HTTP requests use correctly decoded signed query parameters and staging succeeds.
  • Covers numerical XML escape and BaseURL text.
  • Checks diagnostic records don't expose signed URLs.

  Important: The log proves the first-segment HTTP 403, but doesn't include the actual MPD (deliberate credential privacy). XML entity handling is a concrete bug and strong candidate; live playback must still be verified with a new desktop build. If HTTP 403 remains, the new booleans distinguish this from request-origin/CDN entitlement failure.

  Summary by CodeRabbit

  • Bug Fixes
    • Fixed DASH manifest URL handling so query parameters encoded as XML entities are correctly interpreted. Initialization and segment URLs now resolve with their query parameters intact, improving playback and staging for content delivered through signed CDN links.
    • Improved compatibility with DASH manifests that encode URL values in attributes or BaseURL text.

• Default album and artist pages to Online mode (#745)

  Details

  Summary

  • Add Online mode by default at the top of Settings → Library (enabled by default).
  • Apply the global default to library album and artist pages while preserving manual per-page mode choices, including explicit OFF choices.
  • Keep existing legacy online-on selections and catalogue loading behavior.
  • Add regression coverage for default behavior, toggling, persistence, and legacy page choices.

  Verification

  • Regression test added to scripts/online-browse.test.mjs (execution pending CI).

  Summary by CodeRabbit

  • New Features
    • Added an “Online mode by default” setting for library album and artist pages. Online content is enabled by default, and you can turn this off in Settings.
    • Individual page choices take precedence over the default. Previously saved online selections remain enabled when you change the default.

Contributors: @CHEYCKIT

Full Changelog: v14.1.5...v14.1.6

Setup

See README.md for full setup instructions.

macOS: this build is ad-hoc signed, not notarized (no Developer ID certificate is configured). The first time, right-click Lokal in Applications and choose Open, or run xattr -dr com.apple.quarantine /Applications/Lokal.app.

Binary Checksums (SHA-256)

Lokal-14.1.6-arm64-mac.zip: [0DE3A3739E8886482D70F7EC75A8D21F4FDD51E1BD4B29AC1907043BEA07A70C]
Lokal-14.1.6-arm64-mac.zip.blockmap: [E74E822D252B3BA4ED1FCFA870F2AAE4925A6164B39AD19BAA58B4D496226EFD]
Lokal-14.1.6-arm64.AppImage: [4DE63BF988573C3F5BA50C37B3E8A232ED1A14F8D542AAC0EDC6BD1D7F759316]
Lokal-14.1.6-arm64.dmg: [E58C65CD242FD79F44481A8E99945731F06D854961BA14422D59B13AD4FB0EF1]
Lokal-14.1.6-arm64.dmg.blockmap: [131744B90D1C5EEDBC8BEC1EC91E70C35E711BD00F74B22CDDB53A6F1740F643]
Lokal-14.1.6-mac.zip: [8304EEA0CC2C3971984100BE5D020D019E3B63DFD7AA043B0258E71C08E86BE8]
Lokal-14.1.6-mac.zip.blockmap: [4F91D187B56E26C26A6702743F93C4B7AB6389A981313EF9D755BEB409D52AE1]
Lokal-14.1.6.AppImage: [3DCC11E16928286A042475E7A788187A6C505BED3A41EAAE4D1AC23E6D13D912]
Lokal-14.1.6.dmg: [004BB55FEE703540E70D5991EF0260857E2B745142F363B0B1076F26B962C689]
Lokal-14.1.6.dmg.blockmap: [5C359D11F97F7ED638DD0D230C78E01A44B21B16ADC5204405AB762F3074781E]
Lokal-14.1.6.exe: [9C27F935850B0D9A2A023298EF0D3AFA9BAC0DA6609D3151458194EAE2C78099]
Lokal-Setup-14.1.6.exe: [09DBB6EC27031B002F43FF9B8232498E3999DCEDBC86A770B46DF5AE73850956]
Lokal-Setup-14.1.6.exe.blockmap: [76359332325E0F20CA40F9F81BECAFC5CCBF3F10F5A26C662FEE47A715C16589]
builder-debug.yml: [924029F63C15FEADC571860CEE8636E53C19780A34C64A2AB2ED4FFF27214548]
latest-linux-arm64.yml: [63771F2E2C1155917B3F7DF4A3EAC78FBF1F7AEA3B5DF658717DB3EB59BF5246]
latest-linux.yml: [2EB6E53049FF26D36E7A87139A29E33861C173350CCE3C87600259198968D372]
latest-mac.yml: [30546D6BE1F3B29EDC764BE869FF623EA09C14D00BBF2ED2981450459FDED9F3]
latest.yml: [01E7A5DE064D58FDC2BDEC0607E0E6B6F6D6B07F9091CAC1E3F6340ED920C954]
lokal-music_14.1.6_amd64.deb: [4EF0F95752DF092D3EF0949FC2BC3BBA054798100FCE79949E38CE6C79F177D9]
lokal-music_14.1.6_arm64.deb: [CA65A9B31C5ACA3CDC463EB8AAA5475A30156910DB50B493D9D217066F116CD2]