v7.7.0

Features & Enhancements

Next Occurrence Date on Recurring Tasks:

• Daily, weekly, monthly, and custom recurring tasks now dynamically display their next occurrence date directly on the card.
• Rendered as an accent pill (e.g., Next: Sep 21) in compact mode, or inline with the recurrence badge in expanded mode.

Discord Rich Presence Toggle:

• Added a desktop toggle under Settings > Technical to enable or disable Discord Rich Presence on the fly without needing to restart the app.

Frequency-Based Tag Sorting:

• Tags in the TaskBoard filter bar, Study Timer subject dropdown, and Settings modal are now sorted by how frequently they are used in tasks rather than purely alphabetically.
• The Study Timer now remembers and automatically defaults to your last selected study subject.
• Replaced legacy popup prompt dialogs with a modern inline text input in Settings > Themes & Tags: supports Enter to save, Escape to cancel, and dedicated Save/Cancel buttons.

Security Hardening

CSRF Protection on Authenticated Auth Routes:

• Replaced the blanket /api/auth/ CSRF bypass with an explicit whitelist of only public unauthenticated endpoints (/login, /register, /forgot-password).
• Authenticated endpoints (PUT /api/auth/me and POST /api/auth/logout) now enforce the X-Requested-With: XMLHttpRequest header.
• CORS "null" Origin Attack Protection:
  Blocked literal "null" origins in CORS to prevent sandboxed iframe attacks from making authenticated cross-origin requests.

Anti-Caching Headers for API Routes:

• Enforced Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, Pragma: no-cache, and Expires: 0 on all /api/* endpoints to protect sensitive user data from CDN/browser caching.

Serverless Token Revocation Race Condition Fix:

• Cache misses in sessionStore.js now query the Supabase token_blacklist table directly with a 30-second TTL cache, preventing revoked tokens from being accepted on cold-started or multi-instance serverless Lambdas.

Production Error Masking:

• 5xx errors in production now return a sanitized 'Internal Server Error' message, preventing raw database/system details from leaking to clients.

Schema Payload Bounding:

• Enforced boundedJson() size limits (20 KB–100 KB) on timer_state, appearance_settings, tag_colors, and study_timer_state in validate.js.

Bug Fixes & Stability

Fixed prompt() is not supported Crash on Windows Desktop:

• Resolved runtime crashes in Microsoft WebView2 / Tauri when renaming tags or configuring recurrences by moving to inline inputs and try...catch guards.

Suppressed AbortError Console Noise:

• Filtered out expected AbortError / signal is aborted without reason cancellations in apiClient.js (caused by debounced presence heartbeats), eliminating console warning noise.

Native Confirm Dialogs:

• Upgraded tag deletion and desktop reset confirmations in SettingsModal.jsx to use
  nativeConfirm.

v7.6.2

Full Changelog: v7.6.1...v7.6.2

Fixes:

• Fixed Tags added with (+) Button not Showing up on Study Timer Panel
• Fixed Deleted Timer Not Deleting Properly
• Fixed Pixel Inconsistency for Android History Vault

v7.6.1

v7.6.1

This patch release brings Study Timer usability enhancements, resolves an initial authentication race condition, and updates project security policies and documentation.

Improvements & New Features

• Custom Subject Creation: Added a new + button directly beside the main subject selector in the Study Timer card, allowing users to create and switch to custom study subjects on the fly. Custom subjects persist across reloads.
• Study Timer Layout Fixes: Resolved an issue where datetime inputs (specifically the End time input) overflowed outside the timer card boundary in both the Add Session form and Session Editor modal.

Bug Fixes & Stability

• Fixed Initial Habits Load Race Condition: Resolved an issue where /api/habits and /api/activity/stats returned 401 errors on startup. apiFetch now automatically ensures auth tokens stored in IndexedDB are restored to memory before firing initial requests.
• Context Refresh Sync: Added refresh event dispatching upon session confirmation and login to guarantee habit lists and lifetime stats update without requiring a manual page refresh.
  Security & Documentation
• Updated Security Policy (SECURITY.md): Documented Snowball's multi-platform security architecture, Row Level Security (RLS) policies, CSRF protections, token isolation model, and formal vulnerability reporting channels (GitHub Private Advisories and dedicated security email).
• README Updates: Updated tech stack references and license declarations across repository documentation.

v7.6.0

Full Changelog: v7.5.0...v7.6.0
Snowball v7.6.0

New Features & Improvements

• Multi-Tasking Study Timers: You can now run up to 3 timers simultaneously. Track your study sessions across multiple subjects at the exact same time without losing momentum.
• Editable Timer Sessions: Missed tracking a session? Forgot to stop the timer? You can now manually Add, Edit, or Delete individual study sessions directly from the Deep Work Timer card.
• Markdown Notes Support: The expanded notes editor has been upgraded. It now fully supports Markdown formatting natively (via tiptap-markdown), allowing for richer and more robust note-taking.

Bug Fixes

• Midnight Date Fix: Fixed a bug where tasks scheduled exactly for midnight (00:00) were incorrectly having their logical dates shifted.
• Cleaned up UI code: Removed duplicate imports and cleaned up component rendering in TaskForm.jsx.

Security Hardening & Audit

Completely overhauled the security posture of Snowball:

• Vulnerability Sweep: Patched over 30 GitHub Dependabot security alerts across the frontend and backend (including DoS and CRLF injections in deeply nested dependencies).
• Auth Token Protection: Moved JWT (snowball_token) and user PII out of raw localStorage and into secure IndexedDB and HttpOnly cookies.
• CSRF Protection: Enforced X-Requested-With: XMLHttpRequest headers for all state-changing API routes.
• Row Level Security (RLS): Safely restricted backend database queries by implementing strict Supabase RLS policies tied to user JWTs.
• Code Execution Protection: Removed the use of eval() in the Calculator widget, replacing it with a safe mathematical recursive descent parser (safeEvaluate).
• XSS Protection: Added comprehensive DOMPurify sanitization to prevent Cross-Site Scripting when rendering raw HTML in Notes.

v7.5.0

Full Changelog: v7.4.1...v7.5.0

• Updated Node.js
• Fixed Tags not getting added in Settings

v7.4.1

Full Changelog: v7.4.0...v7.4.1

• Fixed Productivity Score

v7.4.0

Full Changelog: v7.3.6...v7.4.0

-Backend Performance Improved
-Frontend Components Improved
-Fixed CSS Theme Layout Leak after Zooming out

v7.3.6

Full Changelog: v7.3.5...v7.3.6

• Fixed Sync For Study Timer
• Fixed Lazy Loading of Friends List and Statistics on Android

v7.3.5

Full Changelog: v7.3.4...v7.3.5
Features :-

• Added Detection which chooses theme as system theme by default
• Added Habits Headmap

Fixes :-
Android Performance

v7.3.4

Full Changelog: v7.3.3...v7.3.4

Fixed Study-Timer for Cross Device Broken Again
Added Control + S to Quick Save notes and Control + Tab to Wheel Between them