900API v0.2.1

900API v0.2.1 is a maintenance release focused on predictable builds and safer release publishing.

What changed

• Pin Rust 1.97.0 for consistent local and CI builds.
• Update GitHub Actions to current supported versions.
• Build every platform from the immutable commit resolved from the release tag.
• Recheck the tag before publishing assets and checksums.
• Validate exact 900API artifact names and reject missing, stale, duplicate, empty, or unrelated files.
• Keep package, Cargo, Tauri, and visible application versions aligned at 0.2.1.
• Refresh installation, contribution, quality, release, and roadmap documentation.

Downloads

• macOS Apple Silicon: 900API_0.2.1_aarch64.dmg
• macOS Intel: 900API_0.2.1_x64.dmg
• Windows: MSI or setup EXE
• Linux: AppImage, DEB, or RPM
• File hashes: SHA256SUMS.txt

Verification

Local and GitHub release gates passed, including 28 frontend and script tests, 130 Rust tests, TypeScript and Svelte checks, production builds, dependency audits, documentation links, privacy scans, and a native macOS package smoke test.

Signing

The binaries are currently unsigned. macOS and Windows can show security warnings. See docs/PUBLIC_RELEASE.md for platform-specific installation guidance.

900API v0.2.0

900API v0.2.0 is the first public release of the local-first 900 Labs API workbench. It runs without accounts, subscriptions, telemetry, or a hosted workspace.

Highlights

• REST, GraphQL, WebSocket, SSE, and gRPC request tools
• Local collections, environments, history, examples, mocks, and Git Sync
• Headless CLI with console, JSON, and JUnit reporting
• Shared portable collection format and bounded JavaScript tests
• Transactional imports, recoverable local state, standards-correct SSE framing, visible stream errors, and connection cleanup
• Public contribution, support, security, release, privacy, and architecture documentation

See CHANGELOG.md for the complete change list and README.md for installation and use.

Downloads

• macOS arm64: aarch64 DMG or app archive
• macOS Intel: x64 DMG or app archive
• Linux x86_64: AppImage, Debian package, or RPM package
• Windows x86_64: MSI or setup executable

Verify any download against SHA256SUMS.txt from this release.

Signing status

The macOS bundles use ad-hoc signing and are not Developer ID signed or notarized. Windows installers are not Authenticode signed. Linux packages are not distribution-repository signed. Review the documented installation guidance before running unsigned artifacts.

v0.1.1 - Security Hardening & Audit Remediation

Security hardening release addressing external audit findings.

Security

• Fix HTML injection in docs generation (desktop and CLI)
• Bind mock server to loopback-only by default; disable permissive CORS unless explicit
• Add Boa runtime limits for sandboxed pre-request and test scripts
• Harden docs file writes against path traversal and symlink attacks
• Add CLI request timeouts to prevent hanging
• Add XML escaping in CLI docs output
• Add shell-safe cURL export (proper quoting)
• Add HTML escaping in generated API docs

Fixed

• Wire test runner environments, pre-request scripts, and test scripts end-to-end
• Correct stale docs that claimed OpenAPI/cURL import/export and api900.expect were implemented

Full details: AUDIT_REMEDIATION_REPORT.md

v0.1.0 - Initial Release

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.1.0] - 2026-06-29

Added

• HTTP request builder with support for GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS
• GraphQL query builder with variables and operation names
• WebSocket client with real-time message handling
• Server-Sent Events (SSE) client
• gRPC unary call support with TLS and plaintext
• Mock server with configurable routes, status codes, headers, and delays
• Git sync for collection versioning
• Collection management with import/export (Postman and custom JSON formats)
• Environment variable management with {{variable}} interpolation
• Test runner with assertions (status, header, body, JSON path, response time)
• Pre-request and test scripts using sandboxed Boa JS engine
• API documentation generation (Markdown and HTML)
• Plugin system with manifest-based permissions and lifecycle hooks
• Team workflows with workspaces, members, roles, and activity tracking
• Authentication support: Basic, Bearer, API Key, OAuth 1/2, AWS SigV4, Hawk
• Internationalization (i18n) with 6 locales: English, Spanish, French, German, Japanese, Chinese
• CLI tool (900api) for headless collection execution, export, and docs generation
• SQLite local storage with WAL mode
• Privacy gate CI check for hardcoded secrets, telemetry, and local paths
• Cargo audit in CI for dependency vulnerability scanning

Security

• Path traversal prevention in write_text_file command (restricted to user home directory)
• Sandboxed JavaScript engine (Boa) for pre-request and test scripts
• TLS certificate validation enabled by default
• Minimal Tauri capabilities (core, shell, dialog only)
• No telemetry or analytics collection
• Mutex lock poison recovery to prevent panics on thread failures