stemdeckapp/stemdeck v0.7.0-alpha.5 on GitHub

Important

macOS first launch (no code signing yet). After dragging StemDeck to Applications, clear the Gatekeeper quarantine flag or macOS will say the app is damaged:

xattr -dr com.apple.quarantine /Applications/StemDeck.app

Optional: fresh-install cleanup. To reproduce a true first-run with no leftover state from earlier builds, open each path in Finder via the Go menu, then Go to Folder (Shift+Cmd+G), and move the folders to Trash:

~/Library/Application Support/StemDeck
~/Library/WebKit/app.stemdeck.desktop
~/Library/Caches/stemdeck
~/Library/Caches/app.stemdeck.desktop

You can also delete ~/Library/Preferences/app.stemdeck.desktop.plist the same way. This is optional; the app will work without it.

What's new in 0.7.0 Alpha 5

Reliability

Fixed the Windows waveform/playback freeze and Safari audio choppiness. alpha.4's new Web Audio playback engine stalled the Windows/WebView2 client: the waveform would hang for up to 60s then show nothing, and audio wouldn't play, because the waveform renderer and the engine both loaded all stems at once and saturated the connection limit. The engine is now WebView-safe. It loads the audio once and the visuals reuse those decoded buffers. Playback is smooth on Safari/macOS, the Windows freeze is gone, and waveforms plus meters render on every platform. (#185)
Fixed missing waveforms when the audio engine is active. With the WebView-safe engine driving playback, the waveform lanes were left blank because the fallback visual layer stayed hidden. The lanes now render from the precomputed peaks whenever the engine owns playback. Verified end-to-end in Safari/WebKit. (#185)
Fixed studio audio not loading under the new CSP. The hardened CSP (see Security) was blocking the waveform library's internal data: fetch, leaving blank lanes, 0:00, and no playback. The policy now permits data:/blob:, which are inline/same-origin schemes only, so no new network access is opened and the script protections are untouched. (#186)
Clicking a track while it's still processing no longer wipes the progress view with the previous extraction's stale audio. (#185)
Fixed the lanes shaking when scrolling the waveform vertically. On a short window the stems overflow vertically; smooth scrolling combined with the mixer-and-lane scroll sync formed a feedback loop that made the lanes oscillate instead of settling. Vertical scrolling in the studio is now instant, so it settles immediately. (#182)

Security

Content-Security-Policy added to the desktop webview. script-src 'self' with no unsafe-inline or eval. Injected markup can no longer run script or reach the Tauri API. Inline scripts and onclick handlers moved out of index.html into a proper module. (#177)
Stored XSS via library folder names fixed. Folder names are now escaped on render, and input validation rejects markup/symbols at creation time (letters, numbers, spaces, and - _ ' & ( ) . , only; 100-char max). (#176)
SoundCloud share shortener removed from URL allowlist. on.soundcloud.com redirects to arbitrary targets; dropped it and added a yt-dlp extractor allowlist so only YouTube and SoundCloud extractors can run. (#176)

Library

Unsorted folder is now protected from deletion. It's the default landing folder for unorganized tracks, so the delete button is hidden and the operation is blocked. (#178)

Version

Version now derived from the git tag. Source/Docker/self-hosted installs report the correct version via /api/health automatically. No more stale 0.6.0-alpha.2. (#176)

Installing

macOS: drop the .app into Applications and launch (run the xattr command above first).
Windows: unzip the downloaded .zip, then run StemDeck.exe from the extracted folder.

Artifact scan

Windows portable packages were scanned with ClamAV in CI before upload.

Artifact build

macOS arm64 and x64 DMGs and runtime packs were built and inspected on a macOS Woodpecker agent before upload.