0.2.18

v0.2.18

v0.2.18 — real ad blocking with EasyList and cosmetic filtering

0.2.17

chore(v0.2.17): release v0.2.17

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dandelion 0.2.16 — fix “Present as Google Chrome” for open tabs

Fix: "Present as Google Chrome" now applies to already-open tabs

v0.2.15 shipped the opt-in Google-sign-in spoof, but it only registered on tabs
opened after you flipped the setting — a tab already open never got it, and a
reload didn't help. This fixes that: toggling the setting now (re)applies across all
open tabs, and it survives opening/closing DevTools.

To use it (Settings → Privacy → "Present as Google Chrome"):

1. Turn it on.
2. Reload the sign-in tab (the identity override applies at page load).
3. Sign in.

To verify it's active: with the tab loaded, open DevTools and run
await navigator.userAgentData.getHighEntropyValues(['brands']) — you should now see a
"Google Chrome" entry alongside "Chromium".

It remains a spoof, off by default, and Google can still detect and block it by
other signals — if it doesn't get you in, that's Google's policy, not a setting you can
push harder.

---

Windows SmartScreen: these builds are unsigned, so the first launch shows "Windows
protected your PC". Choose More info → Run anyway. Auto-updates work regardless.

Dandelion 0.2.15 — opt-in “Present as Google Chrome” for Google sign-in

Google sign-in — opt-in "Present as Google Chrome"

Earlier releases couldn't get past Google's "This browser or app may not be secure"
(ec=65620). Testing the live flow showed why: it's Google's disallowed_useragent
policy, which allows recognised standalone browsers (Chrome, Firefox, Edge, and the Chromium
forks Brave/Opera/Vivaldi/Arc) and blocks the generic embedded-Chromium identity that Electron
reports. It isn't cleanly fixable — the clean answer is "be a real browser fork," which Electron
isn't.

This release adds an opt-in spoof: Settings → Privacy → "Present as Google Chrome"
(off by default). When enabled, the browser presents Chrome's identity consistently — in both
the Sec-CH-UA request headers and the page's navigator.userAgentData — which is what lets
Google sign-in through.

Please read before enabling:

• It is a spoof. It runs a small script in every page to change the reported identity, and
  Google can still detect it by other signals and re-block at any time. It's off by default for
  that reason.
• Reload open tabs after turning it on.
• While it's on, DevTools on a tab pauses the spoof for that tab (both use the same debugger
  channel); the tab picks it back up on reload.

If Google still blocks you with it enabled, that's Google's policy tightening, not a setting you
can turn harder.

---

Windows SmartScreen: these builds are unsigned, so the first launch shows "Windows protected
your PC". Choose More info → Run anyway. Auto-updates work regardless of signing.

Dandelion 0.2.14 — omnibox, notes and documentation fixes

Bug fixes

• Omnibox autocomplete could point the wrong way. Typing a plain word that matched a visited site
  (e.g. github with github.com in history) could show inline-completion ghost text for that site
  while Enter ran a web search instead. The completion now only ever sits on the top result and always
  matches where Enter goes.
• Notes could lose the last keystrokes. If the sidebar closed within the autosave window without
  the editor losing focus (a keyboard shortcut, another panel, closing the window), the most recent
  edits were dropped. The editor now flushes on close.
• Documentation repair. Fixed a corrupted directory tree in the project-structure doc and removed
  leftover git conflict markers from the bug log.

---

Windows SmartScreen: these builds are unsigned, so the first launch shows "Windows protected your
PC". Choose More info → Run anyway. Auto-updates work regardless of signing.

Dandelion 0.2.13 — bookmark import, reading list, notes, recent tabs, screenshots

New features

• Import bookmarks from other browsers. Bookmarks → Import now reads a Chromium Bookmarks file
  from Chrome, Edge, Brave, Opera, Vivaldi and Arc (they all share one JSON format), in addition to
  the Netscape HTML export it already accepted. The format is detected automatically from the file.
• Reading list. A new sidebar panel for pages saved to read later, with a read/unread lifecycle —
  "Save this page" queues the current tab, opening an item marks it read, and "Clear read" empties
  what's done.
• Notes. Free-text notes in the sidebar, autosaved as you type; the first line becomes the title.
• Recently closed. A quick-reopen row of the last-closed tabs on the new tab page.
• Screenshot tool. The camera in the toolbar (or ⌘⇧S / "Screenshot Page") saves a
  full-resolution PNG of the page to Downloads, where Open and Show-in-folder work on it like any other
  download.

---

Windows SmartScreen: these builds are unsigned, so the first launch shows "Windows protected your
PC". Choose More info → Run anyway. Auto-updates work regardless of signing.

Dandelion 0.2.12 — Google sign-in: clear the “browser may not be secure” block

Google sign-in fix

Signing into Google services (Gmail, YouTube, "Sign in with Google", OAuth) could still end on
"Couldn't sign you in — This browser or app may not be secure", even after the earlier cookie and
user-agent fixes.

The remaining cause was a mismatch between the User-Agent string and the User-Agent Client Hints:
the UA presented as stock Chrome, but Chromium still advertised an "Electron" brand — and never
"Google Chrome" — through Sec-CH-UA, which is one of the signals Google uses to flag a browser as
insecure. Dandelion now harmonises the client hints with the UA on every request: it drops the
"Electron" brand and adds a "Google Chrome" brand mirroring Chromium's real reported version, so
the browser presents one consistent identity instead of contradicting itself.

This clears the specific "may not be secure" block. Any further gating Google chooses to apply to
embedded browsers (enterprise SSO policy, some WebAuthn flows) is outside the browser's control.

---

Windows SmartScreen: these builds are unsigned, so the first launch shows "Windows protected your
PC". Choose More info → Run anyway. Auto-updates work regardless of signing.

Dandelion 0.2.11 — crash-proof popup/window teardown

A follow-up to v0.2.10 that fully closes the "A JavaScript error occurred in the main process — Object has been destroyed" crash.

v0.2.10 added a check for whether a window was still alive before talking to it, but that check can go stale in the split second a window is closing. v0.2.11 wraps the send so that even if a window disappears at exactly the wrong moment, the browser skips it and carries on instead of crashing.

Upgrades v0.2.10. No settings changes required.

Dandelion 0.2.10 — fix a crash when closing popups/windows

Fixes a crash that showed the dialog "A JavaScript error occurred in the main process — Object has been destroyed" and took the browser down.

It happened when the app tried to update a window that was in the middle of closing — most easily triggered when a small popover (like the download bubble that pops up when a download finishes) lost focus as a window or popup was being dismissed. The browser now checks that a window is really still there before talking to it.

Upgrades v0.2.9. No settings changes required.

Dandelion 0.2.9 — Google sign-in popup fix (user agent)

Fixes "Sign in with Google" being turned away with Google's unsupported-browser page.

The sign-in popup was still identifying itself as an Electron app in its User-Agent — only browser tabs had been switched to a stock Chrome identity, and the popup used a different, un-updated one. Google refuses sign-in to a browser that announces itself as Electron. Now every window — tabs and popups alike — presents the same stock Chrome User-Agent (with the real Chromium version, nothing spoofed).

Upgrades v0.2.8. No settings changes required.

If a "Sign in with Google" popup still refuses after updating, please report the exact message shown — there is a secondary browser-identity signal (client hints) that may need the same treatment.