v1.4.0

Security

• Media protocol allowlists watch roots, posters, and the app data dir
• Local API requires a token from ~/.config/CollectionXiewer/local-api.json; search results expose url instead of filesystem path
• Board filenames are basename-allowlisted; openExternal is http(s)-only

Changed

• Stability and efficiency pass from the audit: safer indexing/quit, capped thumbs, incremental tag closure, viewport-scoped gallery overlays, and related renderer/main hardening

Fixed

• Search ∩ collection pagination; soft-missing for deleted files; crop/watcher races; preview navigation races; identifier badge caching

Includes AppImage and latest-linux.yml for in-app updates.