sunnypatell/sunnify-spotify-downloader v2.5.1 on GitHub

what's changed

a maintenance patch: two fixes that only reach you through an update, plus a hedge for youtube cookies.

fixed

the apple silicon app no longer needs rosetta to convert audio. its bundled FFmpeg was an Intel build, so every conversion on an M-series Mac ran through Rosetta. on a Mac that never installed Rosetta, downloads failed outright, and Apple has said macOS 27 is the last release where Intel-only code runs on Apple silicon. the arm64 app now ships a native arm64 FFmpeg, and the build refuses to ship one that doesn't match the architecture it is building. the Intel app is unchanged.
the certificate store inside the app no longer trusts a compromised authority. every HTTPS request the app makes is checked against a bundled list of certificate authorities, and that list included emSign ECC Root CA - G3, whose intermediate keys were compromised (PYSEC-2026-4320). it's gone in this release.
settings no longer oversells flac and wav (#116). the hints said "lossless" without saying where the audio comes from. they now say FLAC and WAV keep YouTube's stream with nothing further lost, and the readme's audio quality section explains why a spectrogram stops near 20 kHz in every format.
youtube cookies must belong to youtube.com itself. a cookie file holding only lookalike domains used to pass the check.

changed

youtube cookies work with node.js 22+ as well as deno. Deno's runtime only gets fixes for about another year now that its team has joined Cloudflare, so Sunnify now uses Deno or Node, whichever yt-dlp supports, and skips an outdated version up front instead of failing mid-download. sunnify doctor names the one in use. setup guide.
qt 6.11.2 under the hood.

not changed, on purpose

without cookies, nothing about how sunnify finds or downloads audio changes, and Windows, Linux and Intel Mac users get the same FFmpeg as 2.5.0. if something on your end looks off, the new troubleshooting section covers the questions that come up most.

the web demo already has its fixes (a critical Next.js patch and a smaller attack surface), so there's nothing to update there.

verifying this release: every asset is covered by SLSA build L3 provenance - gh attestation verify <asset> --repo sunnypatell/sunnify-spotify-downloader, or check checksums.txt with sha256sum -c.

install via homebrew (macos):

brew tap sunnypatell/sunnify https://github.com/sunnypatell/sunnify-spotify-downloader
brew install --cask sunnypatell/sunnify/sunnify

full changelog: v2.5.0...v2.5.1

⭐ if sunnify saved you time, star the repo - stars are how people find it.

attestations from this build

direct links to each attestation generated by the workflow run that produced these binaries (sigstore-signed, public-good rekor log entry, SLSA build L3 via the release-build.yml reusable workflow):

the *.sigstore.json assets attached above are the same attestations as offline-verifiable bundles. these get auto-refreshed on every release re-build, so the links above always correspond to the binaries currently attached to this release.