2.1.7.2461

Highlights 🌟

• 🛡️ Hardened device sync
  A full round of security and robustness hardening on the sync path:
  sync connections and control requests strictly verify peer identity,
  file transfers validate path legitimacy and cap resource usage, and
  malformed data can no longer disrupt normal syncing (#4705–#4716).

• 🔗 More reliable connections
  A corrupted device record no longer prevents the device list from
  loading; metadata read failures no longer reset the device identity;
  device state changes propagate reliably across the UI; devices now
  show as connected the moment an incoming connection is established,
  instead of waiting for the next liveness poll; and HarmonyOS
  devices are recognized with their own icon (#4695 #4720 #4722 #4724
  #4728 #4747).

• 🚀 The main window now opens on first launch
  Fixed an issue on some platforms where the first launch only showed a
  tray icon and no window at all, making it look like the app "wouldn't
  open". The main window now opens automatically on first launch on
  every desktop platform (#4696 #4697).

• 🗄️ Customizable size limit for large clipboard entries
  A new setting customizes the maximum size for text, HTML, rich text,
  and link content written into the history (8MB by default). Entries
  over the limit are not recorded, so meaninglessly huge text can't
  bloat the database or slow down the UI; sync skips them too, without
  breaking pull continuity. Files and images are not affected
  (#4699 #4701 #4703 #4704).

• 🎨 New Appearance settings page
  Settings now has an Appearance page with a customizable side search
  window height and live preview. Card title bars in the side window
  scale proportionally with card size (#4664 #4674 #4676).

• 🍎 macOS: hide the Dock icon
  A new macOS-only setting hides CrossPaste from the Dock, keeping only
  the menu bar icon (#4659 #4677 #4678).

• 🔒 URL preview fetching can now be turned off
  A new setting disables fetching a copied link's title and icon, so
  CrossPaste makes no network request for copied URLs — for privacy,
  or to avoid accidentally triggering one-time links. On by default,
  matching the previous behavior (#4742 #4744).

• 🧩 Chrome extension improvements
  The extension now decrypts encrypted paste pushes from the desktop
  app, supports the newer SAS/PIN-based pairing flows, and performs
  the authenticated WebSocket handshake so it can keep syncing with
  peers that require authenticated connections (#4683 #4729 #4730
  #4749).

Bug Fixes 🐛

• 🐛 Implement authenticated WebSocket handshake in the Chrome extension (#4749)
• 🐛 Resolve device state immediately when an inbound WebSocket session opens (#4747)
• 🐛 Dedupe search results by id in the shared search ViewModel (#4733)
• 🐛 Decrypt encrypted WS paste push in Chrome extension (#4730)
• 🐛 Tolerate corrupted hostInfo JSON per row in device-list mapping (#4728)
• 🐛 Never rotate device identity on metadata read failure (#4724)
• 🐛 Give SyncRuntimeInfo flow broadcast semantics (#4722)
• 🐛 Include network prefix in host info equality (#4720)
• 🐛 Make ErrorCode hashCode consistent with equals (#4718)
• 🐛 Validate file transfer path metadata correspondence (#4716)
• 🐛 Roll back push prepare on session capacity rejection (#4714)
• 🐛 Authenticate sync control requests (#4712)
• 🐛 Disambiguate WebSocket whole-file pulls (#4711)
• 🐛 Authenticate WebSocket sessions (#4710)
• 🐛 Bind WebSocket paste identity (#4709)
• 🐛 Bound remote file transfer resources (#4708)
• 🐛 Fail truncated file chunks (#4707)
• 🐛 Bind remote paste to authenticated identity (#4706)
• 🐛 Reject unsafe remote file paths (#4705)
• 🐛 Prevent paste pull cursor gaps (#4704)
• 🐛 Persist paste pull cursor for discarded oversized remote pastes (#4703)
• 🐛 Auto-show main window on first launch for all desktop platforms (#4697)
• 🐛 Allocate v2 exchange generations before async dispatch and make verifier acquisition atomic (#4693)
• 🐛 Release the responder's pending v2 exchange when the initiator abandons pairing (#4690)
• 🐛 Fix SPAKE2 session lifecycle races and fail closed pending constant-time EC review (#4663)

New Features ✨

• ✨ Add option to disable URL preview fetching (#4744)
• ✨ Add chunked WebSocket payload transfer negotiated via the pairing v3 handshake (dormant until v3 rollout) (#4732)
• ✨ Discard oversized non-file paste items to prevent huge database rows (#4699)
• ✨ Add HarmonyOS platform support with system icon (#4695)
• ✨ Add pairing v2 (SAS) and v3 (SPAKE2 PIN) support to the browser extension (#4683)
• ✨ Render pairing v3 acceptor sessions as per-device token cards with auto-close on trust (#4681)
• ✨ Add macOS setting to hide the Dock icon (#4677)
• ✨ Add appearance settings page with customizable search window height (#4674)
• ✨ Add development-only pairing v3 interop flag (#4667)
• ✨ Add pairing v3 scenarios (pair-v3, all-v3) to e2e harness (#4665)
• ✨ Pairing v3: real SPAKE2/P-256 PakeProvider with RFC 9382 vectors (#4658)
• ✨ Pairing v3 Phase 4: desktop UI (#4656)
• ✨ Pairing v3 Phase 3: network protocol service, routing, and client API (#4654)
• ✨ Pairing v3 foundation: per-device sessions, PIN + SPAKE2 building blocks (#4652)

Multiplatform · Refactor · Code Style 🔨

• 🔨 Scale side paste title bar proportionally with card size (#4676)
• 🔨 Harden pairing v3 interop handshake and trust dialog UX (#4669)
• 🔨 Extract PairingV3Transport seam for in-process pairing v3 tests (#4661)
• 🔨 Split stored paste JSON codec from sync format and fix hashing and size accounting (#4648)
• 🔨 Separate QR bearer token from SAS code at the type level (#4644)
• 🔨 Harden paste process plugin pipeline and cap max non-file paste size input (#4701)

Build & CI 👷

• 👷 Add Microsoft Store publish automation (#4738)
• 👷 Speed up CI with per-job Gradle caches, konan cache, and superseded-run cancellation (#4689)
• ✅ Move platform-agnostic tests to core commonTest and cover core/shared in CI (#4646)

Documentation 📝

• 📝 Replace contact email with support@crosspaste.com (#4671)
• 📝 Add Video link to README navigation
• 📝 Bump README download badge to v2.1.6

Dependencies ⬆️

• ⬆️ Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 (#4741)
• ⬆️ Bump com.squareup.okio:okio from 3.18.0 to 3.18.1 (#4740)
• ⬆️ Bump ktor from 3.5.1 to 3.5.2 (#4739)
• ➖ Drop unused Compose plugin and runtime from shared (#4726)
• ⬆️ Bump logback-classic from 1.5.38 to 1.6.1 (#4687)
• ⬆️ Bump io.modelcontextprotocol:kotlin-sdk-server (#4686)
• ⬆️ Bump kotter from 1.3.0 to 1.4.0 (#4685)
• ⬆️ Bump metadata-extractor from 2.20.0 to 2.21.0 (#4650)
• ⬆️ Bump okio from 3.17.0 to 3.18.0 (#4649)
• ⬆️ Bump compose-shimmer (#4642)
• ⬆️ Bump richeditor-compose
• ⬆️ Bump kotlin from 2.4.0 to 2.4.10
• ⬆️ Bump imageio from 3.13.1 to 3.14.0

2.1.6.2390

Highlights 🌟

• 🔁 Fixed a clipboard loop between the Chrome extension and desktop
  Running the Chrome extension and the desktop app on the same machine
  could bounce the same clipboard entry back and forth endlessly,
  flooding the history with duplicates. Both sides now recognize
  content written by the other and no longer re-trigger each other
  (#4619 #4620).

• 🪟 Same-machine pause protection now actually works on Windows
  The native messaging bridge that lets the extension detect a running
  desktop app never launched on Windows: the host manifest pointed to
  the bridge script with a forward-slash path, which cmd.exe — used by
  Chromium to launch non-exe hosts — cannot execute. The manifest now
  keeps native backslashes, the bridge script resolves the pid file at
  run time (immune to code-page path garbling on non-ASCII user
  profiles), and stdin draining is Windows PowerShell 5.1-safe. While
  the desktop app is running, the extension on the same machine now
  pauses its clipboard capture as designed (#4633 #4634).

• 🪟 Upgraded clipboard monitoring on Windows
  Clipboard monitoring on Windows now uses the AddClipboardFormatListener
  event mechanism, so copied content is picked up faster and more
  reliably. The "copied from" app is now resolved via GetClipboardOwner
  — the program that actually wrote to the clipboard — instead of
  whichever window happened to be in the foreground (#4597 #4606).

• 🪟 Works on newer Windows builds without wmic
  Newer Windows 11 builds have removed the wmic tool, which prevented
  CrossPaste from generating a device identifier. It now reads the
  registry MachineGuid instead (#4580).

• 🧩 Extension zip from GitHub Releases now connects to the desktop app
  Loading the Chrome extension zip via "Load unpacked" used to fail with
  "Access to the specified native messaging host is forbidden", because
  Chrome assigned it a different extension ID on every machine. The
  extension ID is now pinned to the Chrome Web Store ID, so unpacked
  installs connect to the desktop app just like the store version
  (#4631 #4632).

• 🔍 Search window resets properly on reopen
  Reopening the search window or changing the query now scrolls the
  list back to the top and selects the newest entry, instead of keeping
  a stale position or selection (#4595 #4600).

• 📶 Device discovery prefers your LAN
  When a computer has multiple network connections (such as a cellular
  modem or a phone hotspot), CrossPaste now ranks local network
  interfaces first when discovering nearby devices (#4568).

• 🐧 New Linux ARM64 build
  CrossPaste now ships a Linux ARM64 (aarch64) package, so ARM-based
  Linux devices are supported too (#4581 #4582 #4626).

Bug Fixes 🐛

• 🐛 Keep native backslashes in the native messaging host path so cmd.exe can launch the bridge script, resolve the pid file via %~dp0, and make the stdin drain PowerShell 5.1-safe (#4634)
• 🐛 Read lastError on native host disconnect to log the reason and silence unchecked-error noise (#4634)
• 🐛 Pin Chrome extension ID via manifest key so unpacked installs can reach the native messaging host (#4632)
• 🐛 Build Linux ARM64 in releases and survive the apt-repo site layout (#4626)
• 🐛 Fix endless clipboard duplication loop between Chrome extension and desktop (#4620)
• 🐛 Force PNG output for README avatars to keep circle-mask corners transparent (#4615)
• 🐛 Migrate Windows clipboard monitoring to AddClipboardFormatListener (#4606)
• 🐛 Reset side search selection and scroll to newest on reopen and query change (#4600)
• 🐛 Resolve Windows clipboard source via GetClipboardOwner instead of foreground window (#4597)
• 🐛 Pass signing_key to Conveyor in the Linux beta workflow (#4584)
• 🐛 Replace deprecated wmic with registry MachineGuid for Windows device UUID (#4580)
• 🐛 Lower WindowsProcessUtils version-resource log from error to debug (#4578)
• 🐛 Capture network errors in ResourcesClient.request() instead of throwing (#4577)
• 🐛 Rank LAN interfaces above cellular for device discovery (#4568)

New Features ✨

• ✨ Add Linux aarch64 (ARM64) build target (#4582)
• ✨ Add telnet scenario to e2e harness (#4562)

Performance ⚡

• ⚡ Use plain remember for RichTextState in side preview views (#4618)

Multiplatform · Refactor · Code Style 🔨

• 🔨 Remove runBlocking from DesktopAppLaunchState DI assembly (#4575)
• 🔨 Group Koin module declarations by sub-domain with regions (#4573)
• 🔨 Make ImageHandler and ImageWriter I/O methods suspend (#4570)

Build & CI 👷

• 👷 Decouple update-site publishing from release builds (#4630)
• 👷 Drop the nested apt repo from versioned release assets (#4627)
• 👷 Replace contrib.rocks with manually triggered contributors README workflow (#4613)
• 👷 Add manual Linux beta build workflow (#4583)
• 👷 Serve updates from the OSS-backed CDN site (#4560)
• 👷 Mirror the Conveyor update site to a stable OSS prefix (#4559)

Documentation 📝

• 📝 Fix checkered flag emoji code in commit guide (#4598)

Dependencies ⬆️

• ⬆️ Gradle Wrapper 9.5.1 → 9.6.1 (#4589 #4608)
• ⬆️ logback-classic 1.5.34 → 1.5.37 (#4592 #4611)
• ⬆️ MCP Kotlin SDK Server 0.13.0 → 0.14.0 (#4628)
• ⬆️ Ktor 3.5.0 → 3.5.1 (#4607)
• ⬆️ web build deps vite / @babel/core security bump (#4593)
• ⬆️ composenativetray-jvm bump (#4591)
• ⬆️ webp-imageio 0.10.2 → 0.11.0 (#4588)
• ⬆️ Koin 4.2.1 → 4.2.2 (#4585)
• ⬆️ Coil 3.4.0 → 3.5.0 (#4566)
• ⬆️ filekit-dialogs 0.14.1 → 0.14.2 (#4565)
• ⬆️ HikariCP 7.0.2 → 7.1.0 (#4564)
• ⬆️ JNA 5.19.0 → 5.19.1 (#4563)

New Contributors 👋

• @swording-k made their first contribution in #4598

Full Changelog: 2.1.5.2343...2.1.6.2390

CrossPaste Linux Beta (build 2360)

Linux beta (amd64+aarch64) for #4581 ARM testing. Unsigned packages — do not use the in-app auto-updater.

2.1.5.2343

Highlights 🌟

This is an urgent hotfix release with a single purpose. We recommend all users upgrade.

• 🛠️ Fixed "Check for Updates" failing with an error
  Clicking Check for Updates while a newer version was available threw
  "Cannot call invokeAndWait from the event dispatcher thread" and the
  update flow stopped there. This affected the Windows installer and
  macOS builds; the Microsoft Store and Windows portable zip channels
  were not affected (#4554).

Bug Fixes 🐛

• 🐛 Guard update-check trigger against invokeAndWait on the EDT (#4555)

Full Changelog: 2.1.4.2340...2.1.5.2343

2.1.4.2340

Highlights 🌟

• 🔄 Faster, more reliable reconnection
  This release focuses on the connection between your devices. When you
  switch Wi-Fi networks, your network address changes, or your computer
  wakes from sleep, CrossPaste now rediscovers your other devices and
  reconnects much faster — no more being stuck "offline" for a long
  time. Even when a device's IP address changes, it reconnects reliably
  (#4506 #4510 #4515 #4519 #4521 #4527 #4529).

• 🆕 In-app changelog and upgrade reminder
  You can now see what each update brings right inside the app. When a
  new version is available, a small dot appears in the left menu to
  remind you to upgrade (#4525).

• ⬆️ Windows (portable zip): update from within the app
  The Windows portable (zip) build can now update itself. When a new
  version is available, CrossPaste downloads and verifies it, then swaps
  in the new build and restarts — no more manually downloading and
  extracting a fresh zip (#4537).

• 🖱️ Fixed an endless paste loop
  Fixed an issue where pressing Cmd/Ctrl+V could trigger an endless
  paste loop in some situations. Pasting is now more reliable (#4501
  #4502).

• ✨ Smoother device list
  The device list no longer flickers while re-checking offline devices,
  so it stays steady (#4508).

Bug Fixes 🐛

• 🐛 Gate /sync/telnet address-push to already-paired peers (#4529)
• 🐛 Harden network discovery: non-blocking mDNS teardown, debounced rebuild, offline gate (#4515)
• 🐛 Stop device list flicker when re-probing offline devices (#4508)
• 🐛 Decouple device identity from IP for reliable reconnection (#4506)
• 🐛 Suppress shortcut recognition during simulated paste (#4502)
• 🐛 Stop swallowing CancellationException in sync resolve loop (#4504)
• 🐛 Prevent infinite paste loop from Cmd+V shortcut binding (#4501)
• 🐛 Round drag preview corners on web paste cards (#4485)
• 🐛 Fix CLI native build after appInstanceId moved out of AppConfig (#4482)

New Features ✨

• ✨ In-app self-update for the Windows portable-zip distribution (#4537)
• ✨ Discovery-driven fast reconnect for paired peers (#4527)
• ✨ In-app What's New changelog screen with upgrade badge (#4525)
• ✨ Push subnet-matched address on steady-state heartbeat (#4521)
• ✨ Push subnet-matched address on /sync/telnet to cut mDNS reconnection latency (#4519)
• ✨ Self-heal mDNS discovery on OS network changes (#4510)

Multiplatform · Refactor · Code Style 🔨

• 🔨 Remove Jewel dependency in favor of native Compose Window (#4489)
• 🎨 Reduce SyncResolver connection-polling log noise (#4523)

Build & CI 👷

• 👷 Regenerate web version and translation artifacts (#4487)
• 👷 Upgrade GitHub Actions to Node.js 24 runtime (#4480)

Documentation 📝

• 📝 Default to Chinese for developer interaction in CLAUDE.md (#4512)

Dependencies ⬆️

• ⬆️ composenativetray-jvm bump (#4535)
• ⬆️ logback-classic 1.5.32 → 1.5.34 (#4497 #4534)
• ⬆️ web build deps rollup / postcss security bump (#4533)
• ⬆️ Kotlin 2.3.21 → 2.4.0 (#4513)
• ⬆️ Compose Multiplatform 1.11.0 → 1.11.1 (#4511)
• ⬆️ MCP Kotlin SDK Server bump (#4517)
• ⬆️ JNA 5.18.1 → 5.19.0 (#4516)
• ⬆️ ph-css 8.1.1 → 8.2.1 (#4498)
• ⬆️ Gradle Wrapper 9.5.0 → 9.5.1 (#4491)
• ⬆️ kotlin-logging 8.0.03 → 8.0.4 (#4492)
• ⬆️ MockK 1.14.9 → 1.14.11 (#4493)
• ⬆️ Caffeine bump (#4494)
• ⬆️ atomicfu 0.32.1 → 0.33.0 (#4495)

Full Changelog: 2.1.3.2297...2.1.4.2340

2.1.3.2297

Highlights 🌟

• 📤 Faster file sharing across devices
  Sharing files between your devices is now snappier and more reliable.
  The device you copied from delivers files directly to your other
  devices, instead of making them ask for the data first. This also
  paves the way for the upcoming iOS Share Extension, letting you share
  files straight from any app on your iPhone or iPad to your desktop
  (#4456 #4457 #4467 #4468).

• 🛡️ Windows: heads-up when your network blocks CrossPaste
  On Windows, if your network is set to "Public", the Windows Firewall
  silently blocks CrossPaste from finding nearby devices. CrossPaste
  now detects this and offers a one-click shortcut to the Windows
  setting where you can switch the network to Private (#4402 #4404).

• 🖱️ Smoother drag-and-drop from CrossPaste
  Dragging items from the CrossPaste side panel into other apps is
  now much better. On macOS, the drag preview no longer hides behind
  the paste window — you can finally see what you're dragging. The
  side panel also handles edge cases more gracefully, so drags don't
  get blocked while previews are still loading, and dragging stays
  smooth even with lots of items on screen. Bonus: you can now drag
  to reorder your search tags too (#4361 #4357 #4377 #4388).

• 🖼️ Animated GIFs and real video thumbnails in the side preview
  GIFs in your clipboard history now actually animate (smoothly, even
  for large ones), and video files show a real thumbnail of the first
  frame in the side panel instead of a generic icon. We also fixed a
  rare crash that could happen while previews were loading (#4353 #4410
  #4422 #4438).

Bug Fixes 🐛

• 🐛 Pre-allocate file slots on push receive so the first chunk has somewhere to land (#4468)
• 🐛 Namespace nearby device LazyColumn keys to avoid a Compose 1.11 duplicate-key crash (#4470)
• 🐛 Bypass JVM system proxy for LAN sync traffic so peer sync no longer hangs behind a configured HTTP proxy (#4449)
• 🐛 Make smoke-test orphan-JVM kill order-independent so cleanup keeps working if the launcher reorders -D flags (#4452)
• 🐛 Replace dzirbel/compose-material-context-menu (incompatible with Compose 1.11 TextContextMenu API) with an in-tree Material context menu to fix text-field crash (#4448)
• 🐛 Stop smoke-test from killing user's PROD CrossPaste and aborting on macOS bash 3.2 (#4445)
• 🐛 Serialize Skia codec/bitmap close with in-flight readPixels (#4438)
• 🐛 Bring main window to front on every showMainWindow call (#4408)
• 🐛 Fix COM ref leak and false-positive warning in Windows network detection (#4404)
• 🐛 Composite translucent HTML/RTF preview bg over theme to avoid double-blending (#4400)
• 🐛 Sort nvm node versions by parsed semver in web build (#4390)
• 🐛 Reset selected index when the search window opens (#4382)
• 🐛 Stop surfacing CancellationException as a refresh failure (#4373)
• 🐛 Stop ClientEncryptPlugin throwing on bodyless GET and harden pull error handling (#4371)
• 🐛 Harden thumbnail extraction and fix .ts TypeScript misclassification (#4367)
• 🐛 Resolve npm absolute path in :web build to fix daemon Exec error 2 (#4365)
• 🐛 Lower mac paste window level so drag preview is visible (#4361)
• 🐛 Skip empty Apple sync tasks and harden side drag preview (#4357)
• 🐛 Skip iPhone/iPad peers for Apple Universal Clipboard pastes (#4355)
• 🐛 Accept java.net.URL transfer data in DesktopUrlTypePlugin (#4349)
• 🐛 Fix side search crashes on fast horizontal scroll (#4347)
• 🐛 Route Apple Universal Clipboard pastes to non-Mac peers (#4344)
• 🐛 Correct .gitignore entry to scheduled_tasks.lock

New Features ✨

• ✨ Add desktop file push protocol — /sync/paste push mode + /sync/file/push + /sync/paste/push/complete (M1+M2) (#4456)
• ✨ Add desktop-side client for the file push protocol (M4) (#4457)
• ✨ Redesign OCR language rows and add drag-to-reorder for loaded languages (#4473)
• ✨ Add PasteDao.filterExistingIds for stale-id filtering (#4428)
• ✨ Add bulk tag operations to PasteTagDao (#4426)
• ✨ Animate GIFs in image side preview via Skia codec (#4410)
• ✨ Add UserAttentionService to gate background pollers on window visibility (#4406)
• ✨ Detect Windows Public network profile and offer one-click jump to settings (#4402)
• ✨ Add drag-and-drop reordering for search tags (#4377)
• ✨ Add Chrome extension release tooling and marketing preview (#4363)
• ✨ Preview video files in side panel with native thumbnails (#4353)
• ✨ Make device info values selectable for copy (#4320)

UI Improvements 💄

• 🎨 Simplify settings description copy across all locales (#4315)

Multiplatform · Refactor · Code Style 🔨

• 🔨 Extract push out of SyncPasteTaskExecutor into SharePushOrchestrator (#4467)
• 🔨 Extract DesktopBootstrap to consolidate process-wide hooks (#4450)
• 🔨 Opt in to ExperimentalRichTextApi in HTML/RTF side previews (#4424)
• 🔨 Catch block exceptions inside launchWhileAttentive so a single failed tick doesn't kill the poller (#4415)
• 🔨 Regenerate web/package-lock.json and i18n/translations.generated.ts (#4386)
• 🔨 Lazy-resolve npm in :web Gradle config, drop interactive-shell probe (#4384)
• 🔨 Consolidate MacAcrylicEffect and tidy small readability issues (#4369)
• 🔨 Extract hbitmapToBufferedImage and add Platform.isApple (#4359)
• 🔨 Introduce PasteSourceContext to bundle paste origin metadata (#4342)
• 🔨 Use Duration form for kotlinx.coroutines.delay calls (#4340)
• 🔨 Extract AbstractGlobalCopywriter to commonMain (#4338)
• 🔨 Hoist shared i18n primitives to commonMain (#4336)
• 🔨 Clarify DiscoveryDriver.browse contract and make TargetCache atomic (#4334)
• 🔨 Harden DiscoveryDriver.close() and use DateUtils in e2e (#4332)
• 🔨 :e2e harness review follow-ups (#4329)
• 🔨 Harden appInstanceId loadOrCreate and surface OneFilePersist write failures (#4322)
• 🔨 Harden appInstanceId migration against corrupt metadata (#4317)
• 🔨 Extract appInstanceId out of AppConfig (#4313)
• 🔨 Lazy-init deviceId / deviceName in EndpointInfoFactory (#4311)

Performance ⚡

• ⚡ Decode GIF frames off the UI thread with double buffering (#4422)
• ⚡ Defer dragOffsetX read to layer phase in SearchTagsView (#4388)
• ⚡ Stop firing side search load-more on every scroll frame (#4351)

Testing ✅

• ✅ Regression tests for MaterialContextMenu hover-index and submenu position (#4454)
• ✅ Regression test for SkiaAnimatedImageView close ordering (#4444)
• ✅ Add :e2e real-device test harness (#4318)

Build & CI 👷

• 👷 Auto-update GitHub Sponsors avatars in README, with historical sponsors and rounded avatar rendering (#4458 #4462 #4464)
• 👷 Add desktop startup smoke test to CI (#4442)
• 👷 Drop /hyperframes-demo/ from .gitignore (#4412)
• 👷 Ignore /.claude/worktrees/
• 👷 Ignore scheduled_task.lock and skills-lock.json
• 👷 Ignore /hyperframes-demo/ directory
• 👷 Ignore /.dev-context/ directory (#4309)

Documentation 📝

• 📝 Require English for GitHub issue and PR content
• 📝 Refresh README, CHANGELOG and Roadmap for v2.0.0 release (#4327)

Dependencies ⬆️

• ⬆️ kotlinx-coroutines 1.10.2 → 1.11.0 (#4474)
• ⬆️ kotlinx-serialization-json bump (#4475)
• ⬆️ kotlin-logging 8.0.02 → 8.0.03 (#4477)
• ⬆️ kotter 1.2.1 → 1.3.0 (#4478)
• ⬆️ Compose Multiplatform → 1.11.0 (#4417)
• ⬆️ Ktor 3.4.2 → 3.5.0 (#4305 #4429)
• ⬆️ Kotlin 2.3.20 → 2.3.21 (#4324)
• ⬆️ Jewel 0.34.0-253 → 0.36.0-261 (#4307 #4432 #4434)
• ⬆️ Compose Shimmer → 1.5.0-beta02 (#4325 #4436)
• ⬆️ richeditor-compose → 1.0.0-rc14 (#4419)
• ⬆️ filekit-dialogs 0.13.0 → 0.14.1 (#4430)
• ⬆️ Gradle Wrapper 9.4.0 → 9.5.0 (#4394)
• ⬆️ atomicfu 0.31.0 → 0.32.1 (#4391)
• ⬆️ kotlin-logging 8.0.01 → 8.0.02 (#4392)
• ⬆️ kotlinx-datetime bump (#4393)
• ⬆️ MCP Kotlin SDK Server bump (#4431)
• ⬆️ semver 3.0.0 → 3.1.0 (#4379)
• ⬆️ compose.hot-reload bump (#4378)
• ⬆️ ksoup 0.2.5 → 0.2.6 (#4380)
• ⬆️ icu4j 78.2 → 78.3 (#4308)
• ⬆️ metadata-extractor 2.19.0 → 2.20.0 (#4323)

---

Full Changelog: 2.0.0.2192...2.1.3.2297

2.0.0.2192

Release Notes - v2.0.0

🧩 Note on the Chrome Extension

The Chrome extension is now live on the Chrome Web Store: https://chromewebstore.google.com/detail/crosspaste/aajpcfbdbnaidaaljamjpmmjcfebhmlh

A few things to keep in mind about scope:

• The extension is a lightweight companion, not a replacement for the native desktop app. It is not feature-complete and is not intended to cover every workflow the desktop client supports.
• Supported: using the extension as a lightweight in-browser clipboard manager, and pairing it with the native desktop app to sync clipboard content across devices.
• Not supported: extension-to-extension cross-device pairing. Two browsers running only the extension cannot sync directly with each other — at least one peer in the mesh must be a native CrossPaste desktop (or mobile) instance.

If you need the full cross-device experience, install the native desktop app on at least one of your devices and pair the extension to it.

Highlights 🌟

• 🧩 Chrome Extension — A Brand New Platform
  CrossPaste now runs as a first-class Chrome Extension, bringing clipboard sync directly to the browser. Includes WebSocket-based file pulling, Native Messaging to pause the extension when the desktop app is running, and full SyncState parity with desktop (#4152 #4157 #4158 #4164 #4168 #4176).

• 🔐 SAS-Based v2 Pairing Protocol
  Pairing now uses a Short Authentication String (SAS) to prevent MITM attacks, with a showPairingCode endpoint and a remote access toggle for safer device onboarding (#4088 #4096 #4098).

• 🔄 WebSocket Sync Protocol
  A new bidirectional, real-time WebSocket sync channel replaces polling for many flows, enabling instant cross-device updates, batch pulls, and live liveness probes (#4112 #4120 #4223).

• 🖥️ Redesigned Devices Screen
  The devices screen has been rebuilt with offline grouping, a current-device dialog, and a refined add-device flow — a cleaner, faster way to manage your mesh (#4207).

• 🏷️ Namespaced App Source Icons
  App source icons are now namespaced by appInstanceId, eliminating cross-device collisions and enabling correct icon rendering across heterogeneous meshes (#4191 #4193 #4197).

Bug Fixes 🐛

• Fix notification close button intercepted by native title bar buttons on Windows (#4039)
• Fix image side preview crop fill and blurry decode size (#4041)
• Fix color hex format in MarketingPasteData from ARGB to RGBA (#4043)
• Fix missing libtesseract.so in Linux builds since 1.2.6 (#4049)
• Fix ToStartView showing on open and not appearing when scrolled (#4052)
• Fix HTML/RTF search content returning raw markup (#4062)
• Fix Sparkle crash on macOS by disabling redundant scheduled check (#4086)
• Fix SegmentedControlSettingsRow layout in twoLine mode (#4136)
• Deprioritize virtual network interfaces in auto-selection (#4138)
• Fix incorrect MCP SSE endpoint URL in configuration command (#4146)
• Skip sync for remote clipboard data to prevent duplication (#4148)
• Fix ConnectCodeUtils to use KMP-compatible concatToString (#4154)
• Restore ESC key binding for hide_window and display it in shortcuts UI (#4183)
• Fail fast when crosspaste-version.properties is missing the version key (#4277)

New Features ✨

• ✨ Add loading indicator for pasteboard lazy loading and fix throttle stall (#4054)
• ✨ Add Portuguese (pt) language support (#4076)
• ✨ Add mobile app promotion guide in desktop devices view (#4083)
• ✨ Add user-configurable JVM system-property override file (#4267)

UI Improvements 💄

• 💄 Replace custom CountBadgeAuto with Material 3 Badge and add image count badge (#4143)
• 💄 Simplify DesktopPromoteGuide to single download button (#4156)
• 🎨 Align add-device button style with current-device button (#4273)

Multiplatform · Refactor · Code Style 🔨

• 🔨 Extract core module and deduplicate shared/app code (#4060)
• 🎨 Add Compose stability configuration for core module types (#4064)
• 🔨 Remove getSearchContent/getSummary from PasteItem, introduce PasteItemReader and PasteDataHelper (#4067)
• ➖ Remove unused material-kolor dependency (#4081)
• 🔨 Convert withTimeout/withTimeoutOrNull Long overloads to Duration (#4094)
• 🔨 Abstract TrustDeviceView in DeviceScope for platform-specific pairing (#4098)
• ➖ Remove duplicate exception classes from app module (#4100)
• 🔨 Refactor SyncResolver to unified single-pass connection flow (#4104)
• 🔨 Refactor searchPasteData pasteType to pasteTypeList for multi-type filtering (#4122)
• 🔨 Refactor getCrossPasteWebUrl to use remote locale config from meta.json (#4124)
• 🔨 Reduce default shortcut key bindings to show_main and show_search only (#4127)
• 🔨 Migrate promote.json to web API and update data model (#4150)
• 🔨 Refactor addSyncTask to accept targetAppInstanceIds as Set<String> (#4181)
• 🔨 Add identity parameter to loadRepresentation for mobile platform support (#4185)
• 🔨 Refactor targetAppInstanceIds to nullable Set<String>? for explicit no-sync semantics (#4188)
• 🔨 Unify coroutine scopes via namedScope helper (#4216)

Performance ⚡

• ⚡ Improve device reconnection with fast-then-slow telnet probe strategy (#4108)
• ⚡ Skip icon pull when local icon file already exists (#4195)

Dependencies ⬆️

• ⬆️ Kotlin 2.3.10 → 2.3.20 (#4069)
• ⬆️ Compose Multiplatform 1.10.1 → 1.10.3 (#4055 #4068)
• ⬆️ Compose Hot-Reload 1.1.0-alpha05 → 1.1.0-rc01 (#4208)
• ⬆️ Ktor 3.4.0 → 3.4.2 (#4073 #4128)
• ⬆️ Koin 4.1.1 → 4.2.1 (#4115 #4159)
• ⬆️ SQLDelight 2.2.1 → 2.3.2 (#4114)
• ⬆️ Cryptography 0.5.0 → 0.6.0 (#4132)
• ⬆️ MCP Kotlin SDK Server 0.8.4 → 0.11.0 (#4024 #4113 #4162)
• ⬆️ Jewel 0.33.0 → 0.34.0 (#4056 #4129)
• ⬆️ Lifecycle 2.9.6 → 2.10.0 (#4070)
• ⬆️ Conveyor 1.13 → 2.0 (#4071)
• ⬆️ Ktlint 14.0.1 → 14.2.0 (#4072)
• ⬆️ Okio 3.16.4 → 3.17.0 (#4133)
• ⬆️ Logback Classic 1.5.31 → 1.5.32 (#4134)
• ⬆️ Kotlin Logging 7.0.14 → 8.0.01 (#4160)
• ⬆️ ComposeNativeTray 1.1.0 → 1.3.0 (#4209)
• ⬆️ Coil 3.3.0 → 3.4.0 (#4210)

Build & Tooling 👷

• 👷 Split CI into app-build and web-build with path filters (#4239)
• 🔖 Bump version to 2.0.0 (#4243)
• 👷 Tighten CI path filters and unify Node version in build-release (#4279)

Contributors ✨

• @Fldicoahkiin use imageFlavor instead of javaFileListFlavor for single-image clipboard writes (#4302)

---

Full Changelog: 1.2.9.2059...2.0.0.2192

1.2.9.2059

Release Notes - v1.2.9

Highlights 🌟

• 🏷️ Tag-Based Organization System
  Replaced the simple favorite boolean with a flexible tag-based system, enabling users to organize and filter clipboard items with custom tags. Includes AppControl hooks for tag creation and pinning (#3989 #3991).

• 🔄 Right-Click "Sync To" for Targeted Device Syncing
  A new right-click context menu lets you sync any clipboard item directly to a specific device, giving you fine-grained control over what gets shared and where (#4019 #4020).

• 🚫 Source Exclusion — Filter Clipboard by Application
  You can now exclude specific applications from clipboard monitoring, preventing unwanted content from being captured. Useful for password managers, banking apps, and other sensitive tools (#3920 #3921).

• 🖥️ Desktop UI Polish & Platform Refinements
  Rounded window corners on Windows and Linux, adaptive QR code sizing for multi-device pairing, a redesigned About page matching the mobile layout, and async font loading to eliminate UI stutter (#4006 #4011 #3996 #4004).

Bug Fixes 🐛

• Fix SQLITE_BUSY errors by serializing SyncRuntimeInfoDao writes (#3994)
• Fix IllegalStateException in compressExportFile due to flush on closed stream (#3976)
• Fix SearchWindow position flash on macOS after long background (#3984 #3985)
• Fix devices list overlapping FAB and transparent sticky headers (#3983)
• Fix theme flash from light to dark on startup (#3960)
• Fix flaky testThreeDeviceMesh by adding stabilization delay (#3978)
• Fix flaky tampered ciphertext test in EncryptUtilsTest (#3947)
• Fix duplicate JAR version conflicts in MSIX packages (#4026 #4027)
• Recreate LazyListState on window open to reliably reset scroll position (#3962)
• Refresh storage statistics immediately after cleanup and show progress dialog (#3980)

New Features ✨

• ✨ Add source exclusion service to filter clipboard by application (#3920 #3921)
• ✨ Add GET /pull/paste endpoint for iOS pull (#3922)
• ✨ Add right-click "Sync To" context menu for syncing paste to specific device (#4019 #4020)
• ✨ Add adaptive QR code sizing for multi-device compatibility (#4010 #4011)
• ✨ Add rounded corners for main window on Windows and Linux (#4006)
• ✨ Add Windows native lazy file clipboard write via JNA delayed rendering (#3931)
• ✨ Add macOS native lazy file pasteboard write via NSPasteboardItemDataProvider (#3930)
• ✨ Auto-close token view when all pending verifiers complete verification (#3972)

UI Improvements 💄

• 💄 Redesign desktop About page to match mobile layout (#3996)
• 💄 Redesign Counter component to match prototype stepper design (#3998)
• 💄 Redesign FilledDropdown component to match prototype design (#4000)
• 💄 Extract ScreenLayout into ScreenProvider interface with configurable padding (#3967)
• 💄 Improve QR code layout for narrow screens (#4012 #4013)

Multiplatform · Refactor · Code Style 🔨

• 🔨 Move SQLDelight to shared module, extract DAO interfaces (#3950)
• 🔨 Extract FilePullService from PullFileTaskExecutor (#3933)
• 🔨 Refactor PasteDao: extract PasteReleaseService and PasteTagDao (#3926)
• 🔨 Extract SyncResolverApi interface and SyncDeviceManager class (#3943)
• 🔨 Split ColorUtils into ColorParser, ColorConversion, and ColorAccessibility (#3941)
• 🔨 Refactor User32.kt: extract utility functions into focused utility objects (#3935)
• 🔨 Refactor DesktopModule.kt: extract DI sub-modules into separate files (#3937)
• 🔨 Extract ImageLoaders into individual DI-registered ImageLoader instances (#3958)
• 🔨 Extract SearchPasteData and QueryPasteTag interfaces from DAO layer (#3956)
• 🔨 Extract platform-specific number keyboard options for iOS compatibility (#4002)
• 🔨 Extract PlatformTokenTextField expect/actual for iOS backspace compatibility (#4018)
• 🔨 Merge addSyncTask and addTargetedSyncTask into single method (#4021 #4022)
• 🔨 Initialize shared-ui and web Gradle modules (#3954)
• 🎨 Add missing @Volatile explicit imports (#3918)

Performance ⚡

• ⚡ Truncate HTML DOM for side preview rendering to prevent UI lag (#3939)
• ⚡ Use content hash as LaunchedEffect key to avoid equals on large HTML strings (#3948)
• ⚡ Async font loading and virtualized font dropdown to eliminate UI stutter (#4004)

Dependencies ⬆️

• ⬆️ Gradle Wrapper 9.3.1 → 9.4.0 (#4023)
• ⬆️ ComposNativeTray 1.0.4 → 1.1.0 (#3924)
• ⬆️ MCP Kotlin SDK Server 0.8.3 → 0.8.4 (#3969)
• ⬆️ ImageIO 3.13.0 → 3.13.1 (#3968)
• ⬆️ SnakeYAML 2.5 → 2.6 (#4008)
• ⬆️ FileKit Dialogs 0.12.0 → 0.13.0 (#4009)

Build & Tooling 👷

• 👷 Add JVM lazy clipboard verification tests (#3928)
• 👷 Fix Kotlin Default Hierarchy Template warnings for web module (#3987)
• ✅ Convert favorite boolean to tag-based system (#3989)

---

Full Changelog: 1.2.8.1999...1.2.9.2059

1.2.8.1999

Highlights 🌟

• 🎨 Material 3 & Tailwind UI Evolution
  A comprehensive visual overhaul migrating the application to the CrossPasteColor M3 theme and a Tailwind CSS-inspired color palette. The entire icon system has been refactored using Material Symbols, providing a unified and modern aesthetic (#3718 #3734 #3740).

• 🤖 MCP Server for AI Integration
  Introduced support for the Model Context Protocol (MCP), allowing AI agents to securely access your clipboard data. This update includes a dedicated settings interface for managing agent permissions and connectivity (#3839 #3841).

• 🫧 BubbleWindow & Advanced Inline Editing
  Launched the BubbleWindow, enabling seamless inline text and HTML editing directly from the Search window. The new editor includes a floating toolbar with undo/redo support and optimized layouts for rapid content adjustments (#3837 #3860 #3862 #3867).

• 🔄 Advanced File Management & Sync Control
  Significant upgrades to the sync engine, including the ability to sync large files directly to system download directories and granular controls for specific content types. A new "Cut" operation with full undo support has also been added for file and image items (#3737 #3833 #3843 #3871).

• 🛡️ Architecture Hardening & Massive Test Suite
  Major stability improvements addressing native resource leaks on Windows (COM/DC), macOS, and Linux. To ensure long-term reliability, we've added over 750 new unit and integration tests covering the core data, sync, and UI layers (#3742 #3780 #3782 #3816 #3820-3827).

Bug Fixes 🐛

• Fix native resource leaks: Windows (DC, COM, HICON), macOS (Keychain), and Linux (Pointer bugs) (#3770 #3780 #3782 #3786)
• Resolve synchronization race conditions, silent error swallowing, and redundant retry loops (#3762 #3766 #3875 #3889)
• Patch Zip Slip vulnerability and security risks in the encryption layer (#3810 #3768)
• Fix runBlocking UI freezes and thread-safety issues in RTF and UI infrastructure (#3804 #3808 #3794)
• Fix Bonjour service race condition causing registration with port 0 (#3772)
• Resolve stream leaks during import/export and orphaned database entries (#3752 #3900 #3908)
• Correct macOS shortcut rawCode mapping and fragile reflection logic (#3784)
• Fix cleanup logic where expiration was guarded by the wrong configuration flag (#3896)
• Fix "launch_at_startup" switch being bound to the incorrect config field (#3722)

New Features ✨

• ✨ Add "In Downloads" indicator for synced files and hide missing local items (#3852)
• ✨ Support drag-and-drop overlay UI for remote file synchronization (#3846)
• ✨ Add mutedText color to the theme system for better typography (#3728)
• ✨ Implement PasteTypeExt constants and composable helpers for better type handling (#3724 #3726)

UI Improvements 💄

• 💄 Redesign menu items for improved visual clarity (#3720)
• 💄 Enhanced image info components with adaptive layouts and decimal byte formatting (#3697 #3699 #3700)
• 💄 Fix BubbleWindow visual glitches (white corners/tails) on Linux platform (#3910)
• 💄 Add isLoading state support for Dialog action buttons (#3835)
• 💄 Fix InfoItem value text alignment issues during text wrapping (#3831)

Multiplatform · Refactor · Code Style 🔨

• 🔨 Clean up core data models and unify error handling logic (#3744)
• 🔨 Refactor icon system with unified IconData and Material Symbols (#3740)
• 🔨 Update CLAUDE.md with strict commit message conventions and code formatting rules (#3707 #3732)
• 🔨 Refactor SemanticColorGroup to utilize Tailwind CSS color palette (#3734)

Performance ⚡

• ⚡ Enable per-device concurrent sync event processing to reduce latency (#3881)
• ⚡ Replace binary search with cumulative size scan for faster threshold cleanup (#3898)
• ⚡ Resolve task executor semaphore starvation and queue backpressure (#3894)
• ⚡ Optimize image processing by removing redundant hash computations and bitmap copies (#3748 #3774)

Dependencies ⬆️

• ⬆️ Kotlin 2.3.0 → 2.3.10 (#3801)
• ⬆️ Compose Plugin 1.10.0 → 1.10.1 (#3856)
• ⬆️ Ktor 3.3.3 → 3.4.0 (#3701)
• ⬆️ Gradle Wrapper 8.14 → 9.3.1 (#3710)
• ⬆️ Logback Classic 1.5.25 → 1.5.31 (#3708 #3892)
• ⬆️ Atomicfu 0.29.0 → 0.31.0 (#3702)
• ⬆️ Kotlinx Serialization 1.9.0 → 1.10.0 (#3703)

Build & Tooling 👷

• 👷 Replace Thread.sleep with runTest to resolve flaky test results (#3858)

---

Full Changelog: 1.2.7.1883...1.2.8.1999

1.2.7.1883

🚀 v1.2.7 - Emergency Hotfix

This release addresses a critical issue where devices were unable to connect or sync due to an incorrectly configured HTTP header.

⚠️ Critical Fixes

• Connection Failure: Removed manually set Host reserved header which caused communication timeouts in certain network environments. (#3691)

📝 Other Improvements

• Compatibility: Fixed cursorColor method for better Android compatibility. (#3681)
• UI: Fixed FileBottomSolid size calculation logic. (#3686)
• Internal: New getNoDeletePasteDataFlow for better multiplatform data handling. (#3688)

---

Full Changelog: 1.2.6.1876...1.2.7.1883