Tributary v0.7.2 Alpha

A small feature and bug-fix release, with security updates.

Added

• Jump to the playing track: press Ctrl+J (Cmd+J on macOS), choose Jump to Playing Track in the main menu, or click the song's title in the header bar to scroll the track list back to the playing song and select it. It works while the list shows the source the song is playing from. (#457, part of #434)

Fixed

• EQ button icon when installed: the EQ button's icon is now built into Tributary, so it shows when Tributary is installed system-wide (for example in /usr/bin) instead of a broken-image placeholder, and it follows the desktop's text colour so it stays visible with a dark theme. Thanks to @ggtrigg! (#453)

Security

• Network library updates: updated the QUIC and TLS certificate-checking libraries to fix published vulnerabilities: a malicious server could crash Tributary or make it use excessive memory, and certificates from distrusted authorities could be accepted. (#455)
• Hashing library update: updated a constant-time helper library used by Tributary's SHA-256 hashing to fix a published timing weakness (RUSTSEC-2026-0385). (#458)

Changed

• Maintenance: routine dependency updates, including SeaORM, Tokio, rustls, mDNS discovery and translation support, plus the Flatpak build tooling and the GitHub Actions used to build and test releases.

Upgrading from 0.6.x

If you're coming straight from 0.6.x, see the 0.7.0 release notes. In particular, Flatpak users need to move their library to the new app ID before first launch.

Verifying downloads

SHA256SUMS.txt lists every file's checksum, and each file has a build-provenance attestation:

gh attestation verify <downloaded-file> --repo jm2/tributary

Full Changelog: v0.7.1...v0.7.2