f6777ee559
release(mobile): release v0.5.8
2026-08-01 17:45:07 +08:00
6a8c07c000
docs(mobile): prepare release metadata
2026-08-01 17:44:47 +08:00
e291c3d1da
fix(mobile): comply with Android media permissions policy
2026-08-01 17:41:46 +08:00
07dd7e27ab
Merge pull request #5063 from RSSNext/mobile-main
...
chore(sync): merge mobile-main into dev
2026-07-31 18:39:13 +08:00
376e6e0343
docs(mobile): restore desktop release inputs
2026-07-31 16:31:48 +08:00
eb782e0389
release(mobile): release v0.5.7
2026-07-31 16:31:13 +08:00
c8a0aa0b4f
docs(desktop): restore mobile release inputs
2026-07-31 16:29:28 +08:00
e0c5d6186a
release(desktop): release v1.12.0
2026-07-31 16:28:50 +08:00
8a2babfd4f
docs(mobile): prepare release metadata
2026-07-31 16:27:59 +08:00
2d9c026cca
docs(desktop): prepare release inputs
2026-07-31 16:27:49 +08:00
a27db571b3
fix(mobile): use product IDs for Apple IAP verification
2026-07-30 19:27:59 +08:00
dd2c933936
chore(ci): format integration URL scheme test
2026-07-28 13:52:45 +08:00
bd91b015ee
fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme ( #5056 )
...
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
2026-07-28 13:40:13 +08:00
2350884eae
fix(mobile): handle RSSHub subscription limit errors
2026-07-26 07:29:14 +08:00
52f587dacb
fix(desktop): dismiss share popover after actions
2026-07-25 20:23:44 +08:00
3d65478fb6
fix(subscription): recover past-due Stripe checkout
2026-07-25 20:22:55 +08:00
22c8a667e6
fix(desktop): restore category chevron rotation
2026-07-25 20:18:50 +08:00
764c70b48c
fix(mobile): restore dark mode text colors
2026-07-25 18:20:36 +08:00
110960a6f0
fix(ssr): restore shared user profiles
2026-07-25 15:06:20 +08:00
cf224d63f5
fix(ssr): escape hydration data in inline scripts
2026-07-25 12:38:49 +08:00
192a7139ce
fix(desktop): use js-yaml ESM exports for Windows metadata
2026-07-13 13:03:42 +08:00
c3eb7285f9
Merge pull request #5044 from RSSNext/main
...
chore(sync): merge main into dev
2026-07-13 12:37:24 +08:00
d90cdfe2b3
fix(desktop): package jsdom runtime dependencies
2026-07-13 12:13:57 +08:00
713c53352d
fix(desktop): package jsdom runtime dependencies
2026-07-13 12:12:50 +08:00
c231c05ed9
Merge pull request #5043 from RSSNext/mobile-main
...
chore(sync): merge mobile-main into dev
2026-07-13 11:47:28 +08:00
57fd759f25
fix(desktop): use js-yaml ESM exports
2026-07-13 11:33:09 +08:00
d726ccccb2
fix(desktop): use js-yaml ESM exports
2026-07-13 11:32:42 +08:00
06135760ba
docs(mobile): restore desktop release inputs
2026-07-13 11:14:43 +08:00
7c4d51a642
release(mobile): release v0.5.6
2026-07-13 11:14:04 +08:00
c3fae852aa
docs(desktop): restore mobile release inputs
2026-07-13 11:13:00 +08:00
c77e60e161
release(desktop): release v1.11.0
2026-07-13 11:11:44 +08:00
ce905f8c5a
docs(mobile): prepare release metadata
2026-07-13 11:10:19 +08:00
5318b9e156
docs(desktop): prepare release inputs
2026-07-13 11:10:13 +08:00
212db8a584
fix(mobile): restore push notification registration
2026-07-12 19:43:36 +08:00
451e263db4
chore(sync): merge mobile-main into dev
2026-07-12 18:32:36 +08:00
c3e1c26194
fix(desktop): set referrerpolicy on youtube embed iframes ( #5039 )
2026-07-12 18:07:09 +08:00
cde24e2614
fix(mobile): declare Expo Babel preset
2026-07-11 09:45:08 +08:00
c144c36baa
fix(mobile): restore scrolled header background
2026-07-11 09:05:16 +08:00
87862b4b93
fix(mobile): prevent timeline view selector overflow
2026-07-11 09:04:44 +08:00
8ae78f747f
fix(mobile): restore signed-out launch login
2026-07-11 09:03:59 +08:00
1158281f59
chore(deps): update frontend dependencies ( #5038 )
...
* chore(deps): update frontend dependencies
* fix(ci): format OTA verification commands
2026-07-10 22:36:12 +08:00
e48a8f4f2e
fix(mobile): use folo callback for social auth
2026-07-03 17:41:58 +08:00
72e289bb3e
fix(tracker): sample PostHog events at five percent
2026-07-03 16:46:26 +08:00
c782efa65e
fix(landing): bundle legal markdown content
2026-06-22 20:57:58 +08:00
aa91b25bff
docs(mobile): restore desktop release inputs
2026-06-22 14:59:02 +08:00
5d6b5ed40f
release(mobile): release v0.5.5
2026-06-22 14:58:32 +08:00
195a2a71f4
docs(desktop): restore mobile release inputs
2026-06-22 14:57:45 +08:00
ddef59d1bc
release(desktop): release v1.10.0
2026-06-22 14:57:04 +08:00
8305a5caf4
docs(desktop): prepare release inputs
2026-06-22 14:48:43 +08:00
7cb35c4d7c
docs(mobile): prepare release metadata
2026-06-22 14:48:30 +08:00
DIYgod
Sebastion
Tony