v1.5.2

Fixed

• Production was serving a year-old app.js: the cache rules gave the non-fingerprinted app.js and style.css a one-year max-age, so the edge kept shipping a stale build while the origin already had the current one, and none of the 1.4.0 or 1.5.0 fixes reached visitors. Both files now revalidate on every request, and index.html references them with a ?v=<version> query that the release script keeps in step with package.json

Changed

• The service worker serves the app shell network-first and falls back to the cache only when offline (it was cache-first, which pinned whatever build happened to be cached). Version-pinned CDN libraries stay cache-first, and cross-origin requests are no longer intercepted at all
• Cross-origin requests are passed straight through, so a failed Turnstile or analytics request can never be answered from the cache

Security

• Download names derived from the uploaded file now have bidi override characters, control characters and path separators stripped, and are length-capped, so a crafted filename cannot make the name shown in the save dialog misleading (the real extension was never attacker-controlled - the app always appends its own _converted.xlsx/.csv)
• New CI check (scripts/check-version-sync.sh): fails the build when the version in package.json, sw.js, and the index.html asset queries drift apart, or when an app-shell asset is referenced without a cache-busting query

v1.5.1

Fixed

• The footer copyright year never appeared: the language initialiser only re-rendered the page when a saved language differed from the current one, so a visitor using the default language kept the static placeholder. The year is now always rendered, and an unrecognised saved language falls back to English instead of blanking the interface
• LICENSE carried the closing Apache boilerplate twice: the unfilled Copyright [yyyy] [name of copyright owner] template followed by a second copy naming the owner. The appendix now appears once, reading Copyright 2025-2026 NX1X, and the rest of the file is byte-identical to the canonical Apache License 2.0 text

Changed

• The licence notice and copyright now share a single bottom bar, separated by a dot and wrapping cleanly on narrow screens, instead of sitting as two stacked lines above and below the divider
• The licence link is underlined on hover rather than permanently, with a visible keyboard focus state
• .gitignore also covers JetBrains and workspace files, Windows shell artefacts, editor backups, and key material (*.pem, *.key, *.p12, *.pfx, .dev.vars, .wrangler/)
• .cfignore now excludes environment files and key material as well, so a misconfigured root-directory deploy could not serve them

v1.5.0

Added

• New monochrome logo and icon: a grid monogram that forms an "E" from table cells, matching the app's soft-black palette (the previous mark was a blue-to-green gradient that predated the monochrome redesign)
• Proper icon set: PNG favicons (16 and 32), an Apple touch icon, and 192/512 PWA icons alongside the SVG
• Link preview support: a 1200x630 social card (og-image.png) plus OpenGraph and Twitter card metadata, so shared links and the GitHub social preview render with the brand card

Changed

• The PWA manifest now lists raster icons at the sizes installers expect, and the service worker precaches the new favicon set

Security

• Table extraction hardened against denial-of-service PDFs: the column-detection histogram is built from a difference array (O(items + size) instead of O(rows x size) work), and fragment merging skips rows with more than 400 fragments, so a crafted PDF degrades gracefully instead of freezing the tab
• Excel exports mark formula-leading cells with the Text number format, so an in-place edit in Excel cannot silently convert them into live formulas (cell text stays unmangled)
• The CDN consistency check (scripts/check-cdn-versions.sh) now also fails when a cdnjs reference in index.html is missing a valid SRI integrity attribute or crossorigin="anonymous", or when the same asset carries different digests, so a stripped or tampered hash can no longer pass CI
• Renovate no longer auto-merges GitHub Actions digest updates (same tag, new SHA); they now require dependency-dashboard approval before merging

Fixed

• Renovate's custom cdnjs manager now matches the single-quoted library URLs in app.js and sw.js; previously only index.html was tracked, so automated library updates would have left the PDF.js worker and the service-worker cache list on the old version
• The _worker.js asset allowlist now matches the icons that actually ship (it previously listed /icons/icon-192x192.png and /icons/icon-512x512.png, paths that did not exist)

v1.4.0

Added

• Full right-to-left extraction support: page direction is auto-detected, RTL tables are emitted with column 1 as the rightmost (first logical) column, and mixed Hebrew/English cells are joined in reading order
• Excel exports of RTL documents open with a right-to-left sheet view, and the data preview lays out right-to-left for RTL documents
• "Include Headers" now adds an Excel autofilter to the header row, making the exported sheet filterable
• Fully bilingual status messages: progress, errors, file info, page count, and column labels now follow the selected language
• Footer now shows the GitHub logo linking to the source repository and an Apache License 2.0 notice (bilingual)
• Release workflow (.github/workflows/release.yml): pushing a v* tag (or a manual dispatch) creates the GitHub Release with the matching CHANGELOG section as notes

Changed

• Table extraction rewritten around page-wide column detection (coverage histogram): rows with empty cells keep their remaining cells in the correct columns instead of shifting left, and title or total lines can no longer break column detection
• Row grouping now merges nearby baselines instead of fixed-grid rounding, so slightly wobbly lines are no longer split into separate rows
• Column boundaries use the real rendered item widths from PDF.js (clamped against producer-inflated widths) instead of a character-count estimate
• Overlaid fragments such as decimal points are folded back into their host number ("1 20" plus an overlaid "." now extracts as "1.20")
• Structured data extraction keeps key names: "Name: John" extracts as two cells ("Name", "John") instead of dropping the key
• Cleanup options (Skip Empty Rows, Merge Fragments, Auto-detect Columns) are now non-destructive: unchecking an option restores the original extracted data
• Turnstile verification is required once per session instead of once per file
• "Hebrew/Arabic RTL Support" is now enabled by default (it only activates on documents detected as RTL)
• scripts/release.sh reworked for the PR-based flow: it now only validates and pushes the version tag (the version bump and CHANGELOG entry come from the PR, the GitHub Release comes from the release workflow)

Fixed

• Excel exports no longer prefix cells that start with "=", "+", "-", or "@" with an apostrophe; SheetJS writes string-typed cells that spreadsheet applications never evaluate as formulas, so the CSV-only injection guard now leaves .xlsx cell text unmangled
• CSV export now quotes cells containing carriage returns
• Uploaded filenames only have the final ".pdf" extension stripped (case-insensitive), so names containing ".pdf" elsewhere are no longer mangled
• Removed the misleading "multiple" attribute from the file input (only one file is processed)
• Dropped files with an empty MIME type (some Linux file managers) are accepted when they have a .pdf extension
• The previous PDF document is now destroyed before loading a new one, releasing its memory
• The service worker precaches style.css, app.js, manifest.json, and the icons, so the app works offline instead of loading unstyled
• Replaced spread-based Math.max calls with reduce loops to avoid stack overflows on very large documents

EasyConvert v1.3.0

First public release of EasyConvert - a client-side PDF table to Excel/CSV converter that runs entirely in the browser. No upload, no server, no data collection.

Live at https://convert.nx1xlab.dev

Highlights

• Table-focused extraction from PDFs with multiple detection methods
• Excel (.xlsx) and CSV export
• 100% client-side processing - files never leave the browser
• Bilingual English/Hebrew with full right-to-left support
• Installable PWA with offline caching

Security

• CDN libraries (PDF.js, SheetJS) pinned with Subresource Integrity
• Content Security Policy with no unsafe-inline, frame-ancestors none, HSTS preload, COOP/CORP, and a tight Permissions-Policy
• Spreadsheet formula-injection guard on CSV and XLSX export
• Served from the public/ directory only - repository files are never exposed

Supply chain and automation

• Committed lockfile; GitHub Actions pinned to full commit SHAs (enforced in CI)
• Renovate with a 14-day release cooldown; auto-merges patch, minor, and security updates; majors reviewed manually
• CI: CodeQL, Gitleaks, dependency review, and CDN version-consistency checks

Licensed under the Apache License 2.0.