e0c5d6186a
release(desktop): release v1.12.0
2026-07-31 16:28:50 +08:00
2d9c026cca
docs(desktop): prepare release inputs
2026-07-31 16:27:49 +08:00
dd2c933936
chore(ci): format integration URL scheme test
2026-07-28 13:52:45 +08:00
bd91b015ee
fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme ( #5056 )
...
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
2026-07-28 13:40:13 +08:00
52f587dacb
fix(desktop): dismiss share popover after actions
2026-07-25 20:23:44 +08:00
3d65478fb6
fix(subscription): recover past-due Stripe checkout
2026-07-25 20:22:55 +08:00
22c8a667e6
fix(desktop): restore category chevron rotation
2026-07-25 20:18:50 +08:00
192a7139ce
fix(desktop): use js-yaml ESM exports for Windows metadata
2026-07-13 13:03:42 +08:00
713c53352d
fix(desktop): package jsdom runtime dependencies
2026-07-13 12:12:50 +08:00
57fd759f25
fix(desktop): use js-yaml ESM exports
2026-07-13 11:33:09 +08:00
c77e60e161
release(desktop): release v1.11.0
2026-07-13 11:11:44 +08:00
5318b9e156
docs(desktop): prepare release inputs
2026-07-13 11:10:13 +08:00
c3e1c26194
fix(desktop): set referrerpolicy on youtube embed iframes ( #5039 )
2026-07-12 18:07:09 +08:00
1158281f59
chore(deps): update frontend dependencies ( #5038 )
...
* chore(deps): update frontend dependencies
* fix(ci): format OTA verification commands
2026-07-10 22:36:12 +08:00
72e289bb3e
fix(tracker): sample PostHog events at five percent
2026-07-03 16:46:26 +08:00
ddef59d1bc
release(desktop): release v1.10.0
2026-06-22 14:57:04 +08:00
8305a5caf4
docs(desktop): prepare release inputs
2026-06-22 14:48:43 +08:00
43fb8f23a7
fix(desktop): avoid idle Spline AI indicator render
2026-06-22 11:38:31 +08:00
84f692ad35
fix(desktop): keep reading mode content when translated
...
Refs RSSNext/Folo#5023 .
2026-06-22 10:43:34 +08:00
4ab06f42b4
fix(desktop): stabilize streaming tts scheduling
2026-06-22 10:41:54 +08:00
c98f572cf8
fix: dedupe code blocks with nested line divs
...
fix: dedupe code blocks with nested line divs
2026-06-05 19:44:07 +08:00
73870a8170
fix(desktop): reset social timeline on view change
2026-06-05 11:42:37 +08:00
31c10ea635
fix(desktop): hide empty recent reader spacer
2026-06-02 10:38:16 +08:00
2ed4ac546b
fix(timeline): guard mark read during scroll reset
2026-06-02 10:04:30 +08:00
fe1fcff315
fix(timeline): scroll to top before refresh
2026-06-01 10:43:23 +08:00
0476396414
Merge remote-tracking branch 'origin/dev' into mobile-main
...
# Conflicts:
# apps/desktop/package.json
# apps/desktop/release.json
2026-05-29 15:57:13 +08:00
a1988abc0c
chore(mobile): keep release pr mobile-only
2026-05-29 15:35:59 +08:00
57741fe833
release(desktop): release v1.9.0
2026-05-29 15:31:55 +08:00
bf4f91fe91
docs(desktop): prepare release inputs
2026-05-29 15:18:57 +08:00
df8b8d0670
fix(actions): stabilize rule editor state
2026-05-29 14:00:19 +08:00
69202876ed
fix(collection): paginate starred entries by collection time
2026-05-29 11:56:26 +08:00
dc43e39711
fix: retry scroll mark-read after revisiting entries
2026-05-26 20:29:52 +08:00
a52ff66fb3
fix(desktop): clear stale web context menu
2026-05-26 14:31:53 +08:00
07cbf35de7
fix: batch scroll mark-read requests
2026-05-26 11:55:09 +08:00
27b30e0d47
fix(desktop): pause scroll read on timeline changes
2026-05-22 14:15:49 +08:00
8557b9f158
fix(desktop): scroll timeline to top before refresh
2026-05-21 14:31:56 +08:00
431ab0e0be
fix(desktop): preserve native image context menu
2026-05-14 18:55:17 +08:00
444f8e05a5
fix(desktop): prevent duplicate timeline page requests
2026-05-14 15:51:32 +08:00
9bfcfc805b
fix(desktop): sanitize Obsidian file path separators
2026-05-14 14:45:50 +08:00
ed1cc36af6
chore(release): update version to 1.8.0 in package.json and release.json
2026-05-14 14:27:11 +08:00
a48123476d
fix(desktop): improve Obsidian integration metadata
2026-05-14 13:58:30 +08:00
5e098f8d19
docs(mobile): prepare release metadata
2026-05-12 17:30:43 +08:00
500c40a4a3
docs(desktop): prepare release inputs
2026-05-12 17:27:24 +08:00
13cc719377
fix(desktop): add Eagle image context menu
2026-05-12 17:14:30 +08:00
4be035d37e
fix(desktop): keep tray instance when refreshing menu
2026-05-12 16:43:44 +08:00
98fcb71734
fix(desktop): persist auth cookies with max age
2026-05-12 16:12:34 +08:00
425e8610a3
fix: stabilize scroll mark-read footer boundary
2026-05-07 21:55:30 +08:00
2fa23362c3
fix: allow final entries to scroll past
2026-05-07 21:05:59 +08:00
43186b7ffb
fix(desktop): delay feed error indicator
2026-05-01 19:08:29 +08:00
ed40cb4de6
release(desktop): release v1.7.0
2026-04-30 17:54:13 +08:00
DIYgod
Sebastion
Tony