Vodou v1.54.13 — Indian languages

Adds Indian languages to Vodou:

• Interface: Hindi for the ☰ menu, password vault, and About/update dialog.
• Spell check: Hindi and Tamil, using offline dictionaries bundled with the app. Nothing is downloaded.
• Page translation: Hindi, Bengali, Tamil, Telugu, Marathi, and Gujarati.

Bengali, Tamil, Telugu, Marathi, and Gujarati can be picked as the interface language already, but they show English until their translations are added.

Windows build fix: Windows builds before this one were missing the interface translations and spell-check dictionaries, so they always showed English and had no spell check. This affected everything 1.54.12 added for those features. 1.54.13 bundles both.

Windows: download the ZIP, extract it, and run Vodou/Vodou.exe. SHA256SUMS.txt contains the download checksum.

Validation: Windows and Linux CI now run all 29 test files. The packaged Windows app started with a Hindi profile and showed a Hindi window title.

Vodou v1.54.11 — Replika chat flicker workaround

Replika chat inputs and messages now receive Vodou's glass-blur workaround automatically on my.replika.ai. Panels remain translucent without the blur. Other sites are unaffected. The Graphics submenu has been removed.

Windows: download the ZIP, extract it, and run Vodou/Vodou.exe. SHA256SUMS.txt contains the download checksum.

Validation: Windows and Linux CI; local WebEngine checks cover inputs, pseudo-elements, dynamically added messages, preserved draft text, and host isolation. Visual confirmation in a signed-in Replika chat remains pending.

The packaged Windows app passed an isolated startup and control-connection smoke test. The Docker image passed version, web-viewer, and browser responsiveness checks.

Vodou v1.54.10 — Check Bookmarks progress bar

Check Bookmarks is easier to follow

• A progress bar fills as your bookmarks are checked ("9 / 20 checked (45%)").
• When the scan finishes, the bar and status line clearly say Scan complete, with how many bookmarks were checked and how many failed. The window also flashes in the taskbar if you've switched away.
• While a scan is running, Stop scan is the only button you can use; the others are greyed out. Once the scan finishes or you stop it, they come back and Stop scan greys out.
• Small fix: "1 failed link" instead of "1 failed links".

Also since v1.54.8 (Docker-only v1.54.9): the msteier/vodou image no longer installs GTK 3 or CUPS, which Vodou never used. That dropped Docker Scout to 5 High / 7 Medium / 66 Low, with nothing fixable.

Windows: download the ZIP, extract it, and run Vodou/Vodou.exe. Python 3.14.7 and the Qt 6.11.2 runtime are bundled. SHA256SUMS.txt verifies the download.

Validation:

• All 23 standalone test scripts passed with the bundled Python 3.14.7, including a new test for the dialog's idle, mid-scan, finished and stopped states.
• The packaged executable passed an isolated startup and control-connection smoke test.

The Docker image msteier/vodou:1.54.10 (also latest) is built from the same code.

Vodou v1.54.8 — AI bookmark review removed

A small cleanup release.

Removed

• Review with local AI (Manage bookmarks). It was slow, needed Ollama, and its verdicts were only suggestions. Check Bookmarks stays: it finds broken links with plain HTTP checks and needs no AI model. The rest of Local AI (chat, search summaries, and "Check this site") is unchanged.

Also in this release (from v1.54.7, a Docker-only release): the msteier/vodou image no longer ships pip, and uses the minimal evilwm window manager instead of fluxbox. That leaves no fixable vulnerability of any severity in Docker Scout's scan.

Windows: download the ZIP, extract it, and run Vodou/Vodou.exe. Python 3.14.7 and the Qt 6.11.2 runtime are bundled. SHA256SUMS.txt verifies the download.

Validation:

• All 23 standalone test scripts passed with the bundled Python 3.14.7.
• The packaged executable passed an isolated startup and control-connection smoke test (clean profile; ping and list_tabs answered, wrong token rejected).

The Docker image msteier/vodou:1.54.8 (also latest) is built from the same code.

Vodou v1.54.6 — bookmark-check crash fix

A reliability release. If you use Check Bookmarks on Windows, update: v1.54.1 through v1.54.5 could close the whole browser in the middle of a scan.

Fixed

• Check Bookmarks crash. Freeing a finished link check mid-scan let Qt reuse its memory for a newer check before PyQt was done with the old one. On Windows that could abort the whole browser; on Linux it aborted the scan. Finished checks are now kept until the scan ends and freed together. On Windows, isolated 12-bookmark scans went from about 2 crashes in 30 to 0 in 120.

Improved

• The Qt & WebEngine updater window and its Copy diagnostics report now show the Chromium security-patch version next to the base version, matching About Vodou. This build is Chromium 140 with security fixes through Chrome 151.
• The README has been corrected and expanded: the bookmarks bar keeps your drag order, the region lookup uses ipwho.is, the auto-lock choices, the vault dashboard, the two-factor switch, "Check this site", Docker, and the MCP server.

Windows: download the ZIP, extract it, and run Vodou/Vodou.exe. Python 3.14.7 and the Qt 6.11.2 runtime are bundled. SHA256SUMS.txt verifies the download.

Validation:

• All 24 standalone test scripts passed with the bundled Python 3.14.7; the bookmark-check suite passed 15 of 15 runs.
• The packaged executable passed an isolated startup and control-connection smoke test (clean profile; ping and list_tabs answered, wrong token rejected).

The Docker image msteier/vodou:1.54.6 (also latest) is built from the same code.

Vodou v1.54.5 — bookmark link checker, security fixes, engine patch level

Warning

Windows users: download v1.54.6 instead. In this release, Check Bookmarks can intermittently close the whole browser mid-scan (and abort the scan on Linux). v1.54.6 fixes it and includes everything below.

This release brings the Windows download up to date with everything since v1.53.3.

New

• Check Bookmarks… (bookmarks menu or Manage bookmarks): a fast link checker that needs no AI model. It lists only broken bookmarks, with the reason for each (HTTP error, DNS failure, timeout, SSL error, redirect loop). Rate-limited servers are backed off and retried instead of being reported as broken. Nothing is deleted without your confirmation.
• Review with local AI…: your local Ollama model compares each bookmarked page against its saved title to flag replaced pages, parked domains, and soft error pages.
• Search web in Local AI chat: optional and off by default. It sends only your latest question through SearXNG for current results with source links, and the model still runs locally.
• About Vodou now shows the Chromium security-patch level next to the Chromium base version. This build is Chromium 140 with security fixes through Chrome 151; compare that second number with Chrome's version.

Security and reliability fixes (from a full-repo review)

• A deceptive-site warning could stay disabled for the rest of a tab.
• The Safe Browsing cache never hit for known-safe sites, and could drop a feed's malware hosts if only one feed failed to refresh.
• Password capture and update on shared-suffix domains (e.g. *.github.io) now ask for confirmation, like fill already did.
• Vault auto-lock is no longer held off by unrelated open dialogs.
• A hung security-key ceremony can no longer freeze the window.
• The vault file gets owner-only permissions on Windows.
• A malformed bookmarks file no longer crashes startup.
• Closed a symlink race in secure delete.
• Credential capture no longer risks picking up an unrelated field as the username.

Windows: download the ZIP, extract it, and run Vodou/Vodou.exe. Python 3.14.7 and the Qt 6.11.2 runtime are bundled. SHA256SUMS.txt verifies the download.

Validation: all 24 standalone test scripts passed with the bundled Python 3.14.7. The packaged executable passed an isolated startup and control-connection smoke test (clean profile; ping and list_tabs answered, wrong token rejected).

The Docker image msteier/vodou:1.54.5 is built from the same code.

Vodou v1.53.3 — privacy and stability fixes

This release fixes seven privacy, credential-handling, and stability issues while retaining Ollama access over the local network.

• Prevent autofill from disclosing credentials after navigation or page replacement.
• Skip direct certificate connections when a proxy is configured.
• Keep one browser process per profile and forward subsequent launches safely.
• Route engine updates through the staged updater.
• Reject malformed remote-control requests without crashing.
• Preserve passwords, whitespace, apostrophes, and multiline CSV fields.
• Clear history in detached windows and the closed-tab list.
• Make the Docker Ollama bind address configurable, with LAN access enabled by default.

Windows: download the ZIP, extract it, and run Vodou/Vodou.exe. Python 3.14.7 and the Qt runtime are bundled. SHA256SUMS.txt verifies the download.

Validation: all 21 standalone test scripts passed, including 16 review regressions. The packaged executable passed an isolated startup and control-connection smoke test.

Vodou v1.53.2 — Python 3.14 Windows runtime

Vodou v1.53.2 updates the Windows runtime and source-checkout launcher.

Changes

• Build the Windows executable with Python 3.14.7.
• Add a portable Windows launcher that uses the checkout's .venv and accepts a URL/file argument. The launcher enables the optional loopback control interface for local tools; running Vodou.exe keeps it disabled by default.
• Document Python 3.14 environment setup and include Python 3.14 in Windows/Linux CI.
• Bundle the C2PA native library, trust anchors, and runtime icon in the Windows executable distribution.

Download

Download Vodou-v1.53.2-windows-x64.zip, extract the entire ZIP, and run Vodou/Vodou.exe. Keep the _internal directory beside the executable. No separate Python installation is needed. Close any running Vodou instance before opening the new build.

The source launcher requires installing Python and dependencies as described in README.md; the local .venv is not committed to GitHub.

Runtime and limitations

• Python 3.14.7; PyQt6/PyQt6-WebEngine 6.11.0; Qt/Qt WebEngine 6.11.2.
• Chromium remains 140.0.7339.225. Upgrading Python does not change Qt WebEngine's Chromium base. Qt backports newer security fixes independently.
• This is a runtime and packaging release. The eight previously identified code-review findings are not fixed in this release.

Validation

• All 20 standalone test scripts passed on Windows with Python 3.14.7.
• Dependency consistency check and isolated source-browser startup passed.
• Packaged Windows executable starts and renders a local page with an isolated profile.
• Release ZIP integrity verified; SHA-256 checksum included.
• GitHub CI passed on Windows/Linux with Python 3.11, 3.13, and 3.14; dependency audit passed.

Vodou v1.52.0

Password vault overhaul, an AI-powered site-safety check, and an optional
MCP server for local automation.

What's new

Password vault

• Strength analysis and a strong-password generator (modeled on a dedicated
  reference generator: length + letter/number/symbol toggles, live entropy
  estimate)
• Detects when the same password is reused across different saved logins
• Automatically finds and removes exact-duplicate logins (same site +
  username + password saved more than once)
• Redesigned dashboard: Website, Website Safety, Username/Email, Password
  (click to reveal), Strength, Duplicated, and Last Changed columns

Ask AI: "Check this site"
A new mode that asks the local AI to explain Vodou's own already-computed
security signals for the page you're on (deceptive-address check, malicious-
site list, certificate trust) — grounded in what Vodou actually detected,
not the model guessing. Ordinary Ask chat still attaches no page content.

Default browser
☰ → Settings → Set as default browser registers Vodou as an OS-level
candidate on Windows and Linux, so a clicked link opens that link instead
of the home page.

Fixed: a fast post-login redirect could occasionally attribute a
submitted password to the wrong site during save-password capture; capture
now keys off the page that was actually active at the moment of submission.

For developers: an optional local MCP server (mcp_server/) exposing
private search, bookmarks, and — when Vodou is launched with
VODOU_ENABLE_CONTROL=1 — loopback, token-gated live browser control to an
MCP client like Claude Code. Off by default.

Download

Vodou-v1.52.0-windows-x64.zip — unzip anywhere and run Vodou.exe. No
installer, no admin rights needed.

Requirements

Windows 10/11, 64-bit.

Vodou v1.32.0

Adds a setup wizard for Local AI — the standalone build no longer leaves you guessing why the ✨ panel doesn't work.

What's new

Set up Local AI… (☰ → Settings → Local AI): installs Ollama and pulls the default model (llama3.2) for you, in two confirmable steps. Turning on Local AI (Ollama) without Ollama installed now offers the same wizard automatically.

• Windows: downloads the official Ollama installer from ollama.com and opens it — you see and agree to Ollama's own installer, nothing runs silently.
• macOS/Linux: points you at the official download page (the automated installer step is Windows-only for now).
• Model download progress streams into the dialog as plain text.

Download

Vodou-v1.32.0-windows-x64.zip — unzip anywhere and run Vodou.exe. No installer, no admin rights needed.

Requirements

Windows 10/11, 64-bit.