48ce50d034
* release(desktop): release v1.11.0 * docs(desktop): restore mobile release inputs * fix(desktop): use js-yaml ESM exports * fix(desktop): use js-yaml ESM exports * fix(desktop): package jsdom runtime dependencies * fix(desktop): package jsdom runtime dependencies * fix(desktop): use js-yaml ESM exports for Windows metadata * build(deps): bump actions/setup-node from 6 to 7 (#5046) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(ssr): escape hydration data in inline scripts * fix(ssr): restore shared user profiles * fix: make Codex worktree setup portable * fix(mobile): restore dark mode text colors * fix(styles): avoid DaisyUI border token collision * fix(desktop): restore category chevron rotation * fix(subscription): recover past-due Stripe checkout * fix(desktop): dismiss share popover after actions * fix(mobile): handle RSSHub subscription limit errors * fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056) The 'integration.openURLScheme' IPC method invokes 'shell.openExternal' with a renderer-supplied string after only checking that it contains '://'. Electron's documentation explicitly warns that passing untrusted URLs to 'shell.openExternal' is unsafe: schemes such as 'file://', 'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:', 'data:' and 'vbscript:' have well-known abuse chains (local file disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style RCE, etc.). Because the renderer process can also reach this IPC via any XSS sink in untrusted RSS feed content, the previous validation was not sufficient. Replace the substring check with strict URL parsing plus an allowlist of protocols that match the integration use-cases documented in the UI (Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic http/https/mailto. All other protocols are rejected with a clear error. Adds vitest cases for representative dangerous schemes (verifying that 'shell.openExternal' is never invoked) and for every scheme shipped as a built-in example, so future regressions on either side are caught. * chore(ci): format integration URL scheme test * fix(mobile): use product IDs for Apple IAP verification * docs(desktop): prepare release inputs * docs(mobile): prepare release metadata * release(mobile): release v0.5.7 * docs(mobile): restore desktop release inputs --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sebastion <sebastion@sebastion.dev> |
||
|---|---|---|
| .agents | ||
| .codex/environments | ||
| .github | ||
| .vscode | ||
| api | ||
| apps | ||
| docs/superpowers | ||
| icons/mgc | ||
| locales | ||
| packages | ||
| patches | ||
| plugins | ||
| scripts | ||
| wiki | ||
| .cursorignore | ||
| .easignore | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| .npmrc | ||
| .nvmrc | ||
| .prettierignore | ||
| .prettierrc.mjs | ||
| .worktreeinclude | ||
| AGENTS.md | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| README.md | ||
| SECURITY.md | ||
| buildServer.json | ||
| changelogithub.config.ts | ||
| conductor.json | ||
| eslint.config.mjs | ||
| package.json | ||
| pnpm-lock.yaml | ||
| pnpm-workspace.yaml | ||
| tsconfig.json | ||
| tsslint.config.ts | ||
| turbo.json | ||
| vercel.json | ||
| vitest.workspace.js | ||
| vitest.workspace.ts | ||
README.md
Folo
As they say, your thoughts are what you read—and we’ve been consuming noisy feeds for too long! Folo organizes content into one timeline, keeping you updated on what matters, noise-free. Share lists, explore collections, and enjoy distraction-free browsing.
👋🏻 Getting Started & Join Our Community
Whether for users or professional developers, Folo will be your open information playground. Please be aware that Folo is currently under active development, and feedback is welcome for any issue encountered.
Feel free to try it using the following methods:
| Operating System | Source |
|---|---|
| Any | |
| iOS | |
| Android | |
| macOS | |
| Windows | |
| Linux |
You can also install using the following methods maintained by our community:
- If you are using Arch Linux, you can install the package folo-appimage that is maintained by timochan and grtsinry43.
- If you are using Nix, you can install the package follow that is maintained by iosmanthus.
- If you are using macOS with Homebrew, you can install the cask folo that is maintained by realSunyz.
- If you are using Windows with Scoop, you can install the manifest folo that is maintained by cscnk52.
|
Join our Discord server to connect with developers, request features, and receive support. |
|---|---|
 |
Follow us on X/Twitter for product updates and to join in on reward activities. |
!IMPORTANT] **Star Us**, You will receive all release notifications from GitHub without any delay \~
✨ Features
Customized Information Hub
Subscribe to a vast range of feeds and curated lists. Curate your favorites and keep track of what matters most to you.
AI At Your Fingertips
A smarter and more efficient browsing with AI-powered features like translation, summary, and more.
Dynamic Content Support
Because we know content is more than just text. From articles to videos, images to audio — Folo gets it all covered.
More Than Just An App
This isn’t just another app. Folo is a community — introducing a new era of openness and community-driven experience.
🤝 Contributing
You are welcome to join the open source community to build together, please check our Contributing Guide for more details.
🔏 Code signing policy
Folo for Windows uses free code signing provided by SignPath.io, a certificate by SignPath Foundation.
Folo for macOS and iOS is signed and notarized by Apple Developer Program.
All released files are verified with GitHub artifact attestations to ensure their provenance and integrity.
📝 License
Folo is licensed under the GNU Affero General Public License version 3 with the addition of the following special exception:
All content in the icons/mgc directory is copyrighted by https://mgc.mingcute.com/ and cannot be redistributed.