{"id":"openSUSE-SU-2026:21815-1","summary":"Security update for waylyrics","details":"This update for waylyrics fixes the following issues:\n\nChanges in waylyrics:\n\n- Update to version 0.4.0 (CVE-2026-25541 bsc#1274106)\n  * Added plugin architecture and SakuraLLM translation plugin\n  * Added OpenCC support for Simplified/Traditional Chinese\n  * Added support for custom CSS themes and style presets\n  * Added auto theme switching based on light/dark mode\n  * Added shortcut keys for decoration, passthrough, and search\n  * Improved MPRIS and SMTC audio player integration\n  * Improved TOML config handling and automatic comment updates\n  * Optimized lyric search, fetch speed, and UI responsiveness\n  * Fixed window passthrough state and click-through toggles\n  * Updated dependencies and bumped MSRV requirement\n\n- Update to version 0.3.21:\n  * docs: update changelog [ci skip]\n  * chore: bump version to v0.3.21\n  * build: bump dependencies\n  * build(deps): bump tokio from 1.43.0 to 1.43.1\n  * build(deps): bump openssl from 0.10.71 to 0.10.72\n  * build(deps): bump rust_decimal from 1.36.0 to 1.37.1\n  * build(deps): bump async-trait from 0.1.86 to 0.1.88\n  * build(deps): bump reqwest from 0.12.12 to 0.12.15\n  * build(deps): bump rust_decimal_macros from 1.36.0 to 1.37.1\n  * build(deps): bump the serde group with 2 updates\n  * fix:.一个错误\n  * fix: 手动刷新歌词时清空歌词标签缓存\n  * style: :lipstick: cargo fmt\n  * perf: DashMap 作为歌词标签存在性缓存\n  * feat: 添加对从音乐文件元数据读取歌词的支持\n  * build(deps): bump ring from 0.17.11 to 0.17.13 (#303)\n  * chore: add script to export dup deps [ci skip]\n  * fix(CI): remove outdated test of qqmusic api initialization [ci skip]\n  * build: bump dependencies\n  * docs(readme): HotLyric, alternative on windows [ci skip]\n  * docs(readme): note on project status\n  * build(deps): bump openssl from 0.10.68 to 0.10.70 (#301)\n  * build(deps): bump serde_json from 1.0.134 to 1.0.138 in the serde group (#296)\n  * build(deps): bump thiserror from 2.0.9 to 2.0.11 (#297)\n  * build(deps): bump tokio from 1.42.0 to 1.43.0 (#298)\n  * build(deps): bump futures-lite from 2.5.0 to 2.6.0 (#299)\n  * build(deps): bump windows from 0.58.0 to 0.59.0 (#300)\n  * build(deps): bump dark-light to 2.0.0\n  * build(deps): bump reqwest from 0.12.9 to 0.12.12 (#291)\n  * build(deps): bump the serde group with 2 updates (#290)\n  * build(deps): bump gdk4-win32 from 0.9.3 to 0.9.5 (#292)\n  * build(deps): bump thiserror from 2.0.6 to 2.0.9 (#293)\n  * build(deps): bump glib-macros from 0.20.5 to 0.20.7 (#294)\n  * rust version problem (#289)\n  * enhance: switch to better tray-icon implementation for windows [ci skip]\n  * build: migrate to ksni 0.3\n  * chore: dedup code\n  * chore: fix deepsource lints\n  * refactor: extract set_by_mode\n  * ci: add .deepsource.toml\n  * docs(readme): add introduction [ci skip]\n  * docs(readme): add alternative `lyric-for-musixfox` [ci skip]\n  * docs(readme): add preview images [ci skip]\n  * docs(readme): replace text with logos\n  * docs: update changelog & metainfo\n  * chore: release v0.3.20\n  * enhance: comment for sub table in config\n  * log: capture panics\n  * fix: check if instance name used\n  * docs: update metainfo & changelog\n  * hotfix: build on windows\n  * chore: release v0.3.19\n  * chore(deps): bump dependencies\n  * build(deps): bump the serde group with 2 updates (#280)\n  * build(deps): bump tracing from 0.1.40 to 0.1.41 (#281)\n  * build(deps): bump tray-icon from 0.19.1 to 0.19.2 (#282)\n  * build(deps): bump rfd from 0.15.0 to 0.15.1 (#284)\n  * build(deps): bump url from 2.5.3 to 2.5.4 (#283)\n  * docs(build): check MSRV\n  * chore(clippy): fix clippy warnings\n  * chore: update lock file\n  * fix: setCookies for QQMusicApi\n  * fix: instance format\n  * feat: support multi-monitor setup (#278)\n  * feat: Implement color-scheme autoswitch (light/dark mode) (#277)\n  * enhance: unregister latest theme\n  * build(deps): bump rustls from 0.23.16 to 0.23.18 (#276)\n  * fix: LazyLock is not stable yet in 1.73 rustc\n  * chore: fix details URL in metainfo\n  * chore: bump version to 0.3.18\n  * test: search/query via lrclib\n  * feat: support LRCLib provider\n  * chore: apply clippy fix\n  * fix: `login_qqmusic` call was not awaited\n  * chore(deps): bump dependencies\n  * feat: show errors from providers in search_window\n  * fix: search failure dialog cannot be spawned outside GTK thread\n  * docs: fix typo in filename\n  * docs(i18n): translation for contribution.md and build guide ubuntu (#272)\n  * fix: add artists to QQMusic keyword\n  * fix(test): initialize QQMusic\n  * feat: set cookies for QQMusicApi in config\n  * chore: migrate to qqmusic-rs 0.2.0\n  * enhance: init lyric provider with any struct\n  * build(deps): bump the serde group with 2 updates (#266)\n  * build(deps): bump glib-macros from 0.20.4 to 0.20.5 (#267)\n  * build(deps): bump thiserror from 1.0.64 to 1.0.66 (#268)\n  * build(deps): bump regex from 1.11.0 to 1.11.1 (#269)\n  * build(deps): bump tray-icon from 0.19.0 to 0.19.1 (#270)\n  * chore: support nix flake (#264)\n  * fix: set text wrap to show very-long lyric\n  * docs(readme): add alternative `lyrica`\n  * chore(deps): bump once_cell to `1.20.2`\n  * chore: release v0.3.17\n  * fix(tray/unix): Avoid calling list_players() from tray thread (#262)\n  * fix(tray): export translated lyrics\n  * build(deps): bump reqwest from 0.12.7 to 0.12.8 (#261)\n  * fix(win32): crash with Motrix runnig\n  * i18n: Create Italian Translation  it_IT (#260)\n  * chore: release v0.3.16\n  * build(fix): \"\"desktop\n  * docs(build): fix i18n part (#259)\n  * chore(deps): bump dependencies\n  * docs(readme): intro SPlayer [ci skip]\n  * docs(readme): desktop support of desktop_lyric, #258\n  * fix: build error on linux\n  * refactor: dedup function signature\n  * docs(readme): add alternative\n  * i18n: translate tips\n  * test: add test for make_lrc_line\n  * build(fix): fix build with MSVC\n  * feat: show error dialog if search failed\n  * enhance: TrackMeta from Metadata will not fail now\n  * chore: release v0.3.15\n  * enhance: select output file after generation\n  * fix: sec field in exported lyric\n  * enhance: make import/export pormpt different\n  * chore: release v0.3.14\n  * i18n: update locale for 0.3.14\n  * build: enable export-lyric for win build [ci skip]\n  * chore(dep): bump dependencies\n  * chore: disable unused warn\n  * fix: build with export-lyric/import-lyric disabled\n  * feat: export-lyric\n  * refactor: dedup import-*-lyric\n  * enhance: dedup import-lyric\n  * build(deps): bump the serde group with 2 updates (#252)\n  * build(deps): bump opencc-rust from 1.1.18 to 1.1.19 (#253)\n  * build(deps): bump gettext-rs from 0.7.0 to 0.7.1 (#254)\n  * build(deps): bump reqwest from 0.12.5 to 0.12.7 (#255)\n  * build(deps): bump rust_decimal from 1.35.0 to 1.36.0 (#256)\n  * build(deps): bump orhun/git-cliff-action from 3 to 4 (#257)\n  * fix: build with `opencc` disabled\n  * refactor: unify naming of same component in different mod\n  * refactor: prefer lazy-binding rather than multiple `cfg` flag\n  * docs(readme): fix broken link for DeaDBeeF plugin [ci skip]\n  * build(deps): bump tokio from 1.39.1 to 1.39.2 (#248)\n  * build(deps): bump serde_json from 1.0.120 to 1.0.121 in the serde group (#247)\n  * docs: mark issue/workaround for Better Comments\n  * fix: support new type of HWND inner\n  * docs(readme): intro DeaDBeeF close #245\n  * fix: migrate to window-rs 0.58\n  * build(deps): bump openssl from 0.10.64 to 0.10.66 (#246)\n  * refactor: migrate to new-style clone!\n  * refactor: migrate to gtk4-rs clone! new style\n  * chore: bump dependencies\n  * build(deps): bump serde_json from 1.0.118 to 1.0.119 in the serde group (#244)\n","modified":"2026-09-10T18:23:47.700079927Z","published":"2026-09-08T10:00:08Z","related":["CVE-2026-25541"],"upstream":["CVE-2026-25541"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1274106"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25541"}],"affected":[{"package":{"name":"waylyrics","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/waylyrics&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"waylyrics-lang":"0.4.0-bp160.1.1","waylyrics":"0.4.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21815-1.json"}}],"schema_version":"1.9.0"}