Skip to content

v1.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Oct 10:42
· 10 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.2.1
This tag was signed with the committer’s verified signature.
qt715 Sxlvia
GPG key ID: 2CB6524BB54B2CDA
Verified
Learn about vigilant mode.
99620f5
This commit was signed with the committer’s verified signature.
qt715 Sxlvia
GPG key ID: 2CB6524BB54B2CDA
Verified
Learn about vigilant mode.

Dashboard

  • Show catalog card art from release downloads. Available tool cards and catalog overlay cards showed initials and no banner or preview because release downloads (GitHub included) serve SVG art as application/octet-stream, which browsers do not render. The dashboard now loads catalog art through GET /api/tools/catalog/art: vosu fetches only URLs the loaded catalog lists, with the catalog download rules (HTTPS, public destinations, at most 5 redirects, 1 MiB), types it from its content (SVG, PNG, WebP, or JPEG), caches it in memory per catalog revision, and serves it as a sandboxed, inert document, so an SVG opened directly can run nothing on the dashboard origin. See the tool protocol.

Tools

  • Install valid packages whose compressed data happens to contain ZIP end-record bytes. vosu treated every PK\x05\x06 in a file as a possible end of central directory, so a 221-entry tool package was refused with "unsafe ZIP entry: entry limit exceeded" because bytes inside a deflated binary read as 31,185 entries. Only the end record that ends exactly at the end of the file now decides the entry count, as in the ZIP specification; the opened archive must list that many entries. Data after the archive and a second end record inside the archive comment are still refused, ZIP64 records must sit right before that end record, and a ZIP64 record inside entry data stays capped. Tool packages, overlay downloads, and update archives share the same check.
  • Refresh skin file listings and case-insensitive lookups when directory contents change even if directory timestamps do not advance, including deferred NTFS updates on Windows. Cache validation now checks bounded directory membership signatures as well as existing file sizes and modification times.

Updater

  • Keep the Windows update helper alive through transient record sharing and delete-pending errors after authorizing the live owner. These errors now use the same bounded two-second retry window as truncated records instead of aborting handoff on a busy machine.

Code signing policy

SignPath signing is not active yet, so this release's Windows executable is unsigned. See the code signing policy.

Privacy policy · Security and installation disclosure

Assets 13
Loading