# Linthra v0.1.9 — release notes

**Linthra is an Android music player for local files and self-hosted music
servers.** v0.1.9 is a **connectivity fix & sync improvement release**. It
makes self-hosted HTTPS servers that use a user-installed CA certificate work
on Android, brings two-way playlist & favorites sync to Navidrome/Subsonic,
and lets you favorite or unfavorite any track straight from its menu. No new
permissions, no behavior changes beyond the merged work below.

- **Version:** `0.1.9` (`versionName`), `versionCode` `109999`
- **Platform:** Android
- **Application ID:** `io.github.thezupzup.linthra`
- **License:** [MPL-2.0](../../LICENSE)
- **Get it:** Available from the
  [GitHub Releases page](https://github.com/TheZupZup/Linthra/releases) first
  (signed APKs); [Obtainium](https://github.com/ImranR98/Obtainium) can track
  this repository for updates. The
  [F-Droid](https://f-droid.org/packages/io.github.thezupzup.linthra/) build
  follows after F-Droid's build process runs.

## What's new

### HTTPS & certificates

- **User-installed CA certificates are now trusted for HTTPS.** Since
  Android 7, apps only trust user-installed CA certificates when they opt in —
  so a self-hosted Jellyfin or Navidrome server behind a private CA or
  self-signed certificate was rejected even after you installed the CA on the
  device. Linthra now trusts the system store **and** the user store: install
  your CA under *Settings → Security → Encryption & credentials → User
  credentials* and the server just connects. TLS is not weakened — certificate
  chains and hostnames are still fully verified, and a certificate not anchored
  in either store is still rejected with the clear "couldn't verify your
  server's certificate" message. Plain-HTTP LAN servers are unchanged.
  (Fixes [#266](https://github.com/TheZupZup/Linthra/issues/266).)

### Navidrome / Subsonic

- **Two-way playlist & favorites sync.** Playlists and hearts now mirror both
  ways with your Navidrome/Subsonic server, behind the same sync seam Jellyfin
  uses.
- **Reliable hearts.** A favorite that fails while offline (or mid-hiccup) is
  queued and retried on the next refresh — never silently reverted.
- **No manual syncing.** Changes made on the server are picked up automatically
  on app resume and screen opens, throttled so it stays battery-friendly, and
  the first sync starts on its own after sign-in.
- **Non-destructive throughout.** Local-only playlists are untouched and remote
  deletes only happen behind an explicit confirmation.

### Library

- **Favorite from any track menu.** Every track-level overflow menu — Songs
  list, album and artist detail, search results, Favorites, smart-mix detail,
  and playlist detail — now has an *Add to favorites* / *Remove from favorites*
  action, so you can like or unlike a song without starting playback. It routes
  through the same favorites store as the heart on Now Playing, including the
  Navidrome/Subsonic sync path.

### Docs

- **Shorter README.** The README is now a scannable overview; the full
  documentation index moved to [docs/README.md](../README.md).

## Support note

- Linthra remains **free and open source**, and **works on its own**.
- The Support / donation screen stays **optional** and **cosmetic / support-only**.
- **No gating, no telemetry, no billing SDK, and no required account.**
- **No core feature is locked behind donation.**

The repository shows a **Sponsor** button (GitHub Sponsors). It points at the
same handle as the in-app **Settings → About → Support Linthra** screen, and is
entirely voluntary — see [docs/SUPPORT.md](../SUPPORT.md).

## Technical summary

- **Android user-installed CA trust for HTTPS**
  ([PR #269](https://github.com/TheZupZup/Linthra/pull/269), fixes
  [#266](https://github.com/TheZupZup/Linthra/issues/266)): the network
  security config adds `trust-anchors` for the `system` and `user` certificate
  stores; chains and hostnames stay fully verified, cleartext support for LAN
  servers is unchanged, and a guard test pins the config.
- **Navidrome/Subsonic playlist & favorites sync**
  ([PR #264](https://github.com/TheZupZup/Linthra/pull/264)): Subsonic
  `star`/`unstar`/`getStarred2` and playlist CRUD behind a provider-agnostic
  gateway seam shared with Jellyfin; queued/retried hearts, throttled
  auto-refresh, automatic first sync after sign-in.
- **Favorite toggle in track overflow menus**
  ([PR #265](https://github.com/TheZupZup/Linthra/pull/265)): shared TrackTile
  menu and playlist-detail row menu toggle through the existing
  FavoritesRepository; never starts playback or modifies the queue.
- **README & docs index cleanup**
  ([PR #267](https://github.com/TheZupZup/Linthra/pull/267),
  [PR #268](https://github.com/TheZupZup/Linthra/pull/268)): shorter README,
  documentation table moved to `docs/README.md`, wording pass.

No provider, sync, playback, or theme behaviour changes beyond the merged work
above — this is a version bump, changelog, and release-notes change only.

## Manual QA checklist (Pixel / Android)

- [ ] Install the debug APK on a Pixel / Android device.
- [ ] Confirm the Play Protect warning appears (expected **only** for a
      sideloaded debug build) and the app installs and launches.
- [ ] HTTPS with a private CA: install the CA on the device (*Settings →
      Security → Encryption & credentials*), connect to a Jellyfin or
      Navidrome server behind it, and verify sign-in, sync, and playback work.
- [ ] HTTPS with an untrusted certificate (CA **not** installed): verify the
      clear "couldn't verify your server's certificate" message still appears.
- [ ] Plain-HTTP LAN server: verify connecting still works (unchanged).
- [ ] Navidrome: favorite/unfavorite and create/edit a playlist on the server
      and in the app; verify both directions sync without a manual refresh.
- [ ] Toggle a favorite while offline; verify it is retried and not reverted
      once the server is reachable again.
- [ ] Verify *Add to favorites* / *Remove from favorites* appears in the track
      overflow menus (Songs list, album detail, playlist detail) and toggles
      the heart without starting playback.
- [ ] Verify Jellyfin sync and playback still work.
- [ ] Verify background playback and the media notification.
- [ ] Verify no unexpected permissions are requested.

## Upgrade notes

- **Nothing to do.** Upgrading keeps your existing settings and library.
- **Don't mix install sources.** A GitHub-release APK is signed with Linthra's
  key, while the F-Droid build is signed with F-Droid's key; the two can't
  update each other. Stick with one source.

No ads, no tracking, no analytics, no telemetry. No Spotify, stream-ripping, or
DRM-bypass claims — Linthra plays music you already own or that your own server
provides.
