Skip to content

OpenLex 0.2.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Oct 21:18
· 138 commits to main since this release
v0.2.3
6b95182
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • The legacy desktop server (desktop/server) listened on all network interfaces; it now listens on 127.0.0.1 only. A test checks that every server in the engine, the desktop shell and the legacy server binds to loopback.

Added

  • AI record: a tamper-evident log of what the AI did (which model, which sources, what was sent online, which actions were approved), hash-chained so later edits are detectable, readable and exportable from the Word pane, the terminal app and the CLI.
  • Releases are built, signed and attested on GitHub: a reproducible CLI tarball, an SBOM (CycloneDX), Sigstore signatures (*.bundle) and GitHub build provenance for every file. The install scripts are release files too (releases/latest/download/install.sh and install.ps1). How to check a download: docs/VERIFY.md.
  • The install scripts also check the signature (with cosign) or the GitHub attestation (with gh) when those tools are installed, and say which checks were made.
  • CI on Linux, macOS and Windows with Node 20 and 22, and a packaging smoke test.
  • SECURITY.md, CONTRIBUTING.md and this changelog.

Changed

  • Prompts, start-up messages, report footers, exports and user agents say OpenLex instead of LexVault. Data folders, settings and identifiers that existing installs depend on keep their names.
  • npm test runs node --test test/*.test.js (Node 22 no longer accepts a folder).

Fixed

  • Windows: on-device OCR kept umlauts and the section sign (PowerShell now reads and writes UTF-8).
  • Changes to openlex.json made twice within the same second are no longer missed.
  • Two saves of a file within the same millisecond no longer overwrite each other's earlier-version copy.
  • Windows: the plugin updater extracts with the system tar.exe, not a GNU tar from Git for Windows on PATH.
  • Desktop app: the engine log file handle is no longer leaked on every engine start.

Verify this download: every file is signed (Sigstore, *.bundle) and has a build provenance attestation from this repository's release workflow. See docs/VERIFY.md.

Assets 14
Loading