Flowtake v1.6.0

Flowtake v1.6.0

Flowtake is a free, MIT-licensed desktop recorder and timeline editor for turning
technical workflows into clear product demos. Version 1.6.0 hardens the native and
release trust boundaries and makes the capture-to-edit workflow more dependable at
smaller desktop sizes.

Download

Platform	Recommended file	Support boundary
Windows x64	Flowtake_1.6.0_x64-setup.exe	Primary tested path. The installer is not code-signed, so Windows SmartScreen may warn.
Windows x64	Flowtake_1.6.0_x64_en-US.msi	Alternative MSI installer; also unsigned.
Windows x64	Flowtake-windows-x64-portable.zip	Portable app with the required FFmpeg sidecar.
macOS Universal	Flowtake_1.6.0_universal.dmg	Preview for Apple Silicon and Intel. Ad-hoc signed, not notarized; Gatekeeper may warn.
macOS Universal	Flowtake-macos-universal.zip	Portable preview app; same signing boundary.
Linux x64	.AppImage, .deb, .rpm, or portable .tar.gz	Preview. Capture requires X11 or XWayland; pure Wayland capture is not supported.

Download SHA256SUMS.txt from the asset list and verify the selected artifact before
running it. The release workflow generated the manifest only after all platform builds
and rechecked every hash before publication.

What changed

• Reworked the responsive studio shell so media, preview, inspector, and timeline
  controls remain reachable at the documented minimum desktop size.
• Made imported media project-durable and kept save/close recovery available when an
  asset operation fails.
• Improved timeline placement, cursor motion, preview-worker cleanup, first-run capture
  readiness, and cross-platform recording fallbacks.
• Replaced the automatic updater boundary with a metadata-only version check that opens
  the exact official GitHub Releases page for a user-controlled download.
• Canonicalized project and render paths, reduced renderer capabilities, disabled
  production DevTools, and kept OAuth/stream credentials in native session memory.
• Added an exact-commit release gate, pinned and verified FFmpeg/RustSec inputs, mandatory
  Node/Rust tests and strict clippy, a flat artifact allowlist, and SHA-256 publication.
• Patched all known dependency advisories present at release time. RustSec reports zero
  known vulnerabilities; its remaining unmaintained/unsound transitive warnings are
  visible rather than ignored.

Install notes

Windows

1. Verify the downloaded file against SHA256SUMS.txt.
2. Run the NSIS .exe installer, the MSI, or extract the portable ZIP.
3. Because this release is unsigned, use the operating system warning details to verify
   the publisher context and checksum before choosing to run it.

macOS

1. Verify the DMG or ZIP checksum.
2. Copy Flowtake.app to Applications.
3. The build is not notarized. If Gatekeeper blocks the first launch, right-click the app
   and choose Open only after verifying the checksum.
4. Grant Screen Recording permission when macOS requests it for capture.

Linux

• .deb and .rpm packages declare their system dependencies.
• AppImage and portable archive compatibility still depends on the host distribution.
• Screen capture requires an X11 or XWayland session; pure Wayland is currently out of
  scope.

Known distribution limits

• Windows installers are unsigned.
• macOS artifacts are ad-hoc signed but not notarized.
• macOS and Linux are preview support paths.
• The current CSP retains compatibility allowances for inline content and broad HTTPS /
  WebSocket connections; further reduction is tracked as hardening work.

See the full code change:
v1.5.0...v1.6.0