CIMon v0.1.6

CIMon v0.1.6

A critical bugfix release. v0.1.5 has been removed from the releases list because its
packaged macOS and Linux builds broke the app after updating: the tray panel showed "No
projects monitored" even with a valid configuration, and the Settings, Choose projects, and
Quit buttons stopped responding. If you're on v0.1.5, install v0.1.6 directly from the assets
below (v0.1.5 can no longer serve as an update source since it was pulled).

Fixed

• Packaged macOS/Linux builds rejected every webview command. require_webview derived
  its authorization origin from the webview's URL, but the origin of Tauri's own tauri://
  custom protocol (used to serve the packaged app in production on macOS and Linux) serialized
  to the opaque string "null" instead of a real scheme://host pair. Every webview-gated
  command (get_config, get_project_statuses, show_settings_window, quit_app,
  hide_panel, open_project_url, ...) then failed as unauthorized, and the frontend quietly
  turned those failures into an empty project list and dead buttons. This only affected
  packaged builds using the custom protocol, not tauri dev, which is why it passed pre-release
  testing.

Security

• Resolved RUSTSEC-2026-0194 and
  RUSTSEC-2026-0195 (quick-xml DoS via
  quadratic-time duplicate-attribute checks and unbounded namespace-declaration allocation).
  tauri-winrt-notification bumped to 0.7.3, which drops its own vulnerable quick-xml
  dependency. The one remaining quick-xml instance (pulled transitively via plist, used
  only to read the app's own build-generated Info.plist on macOS, never attacker-controlled
  input) has no upstream fix yet and is tracked in src-tauri/.cargo/audit.toml.

Downloads

• macOS (universal, Apple Silicon and Intel): CIMon_0.1.6_universal.dmg
• Windows (per-user, no admin): CIMon_0.1.6_x64-setup.exe
• Linux: CIMon_0.1.6_amd64.deb, CIMon-0.1.6-1.x86_64.rpm, CIMon_0.1.6_amd64.AppImage