Release 🦥Sloth Clash v0.6.0 · Nemu-x/SlothClash

The big polish release — security, signed self-updates, and a UI overhaul.

Signed, fail-closed in-app updates. Releases are now signed with a project minisign key and verified in-app (pure-Go ed25519) before anything launches — unsigned or tampered updates are refused by default. The Windows updater downloads the installer, verifies signature → checksum, then applies; macOS/Linux open the release page.
Update UX. Download progress bar, an in-app “What’s new” changelog from the release notes, an explicit restart-to-apply flow, and an Automatic updates toggle in Settings.
CI security gating. govulncheck (Go) and pnpm audit --prod now run in CI and block on known vulnerabilities. Moved off end-of-life Go 1.23 to a supported toolchain → CI currently passes with no known vulnerabilities reported by these checks.
Dependencies hardened. Cleared all high/moderate frontend advisories (react-router / dompurify / js-cookie) and bumped runtime Go modules.

Mihomo core pinned to v1.19.26 for reproducible builds (no more resolving latest at build time).

TUN no longer breaks the first connect after an update. The core and TUN adapter are now torn down cleanly before an in-app update launches the installer, so the next launch starts from a clean network state.
Installer prerequisite feedback. The Windows installer now shows progress while installing the Visual C++ runtime instead of a frozen bar.
macOS build fix for the newer Go toolchain.

Import local configs & share links. Add a profile from a local mihomo/Clash config.yaml, or paste/load vless://, vmess://, ss://, trojan://, hysteria2://, tuic:// links — single, newline list, or base64 subscription — with live detection.
Adjustable interface scale (80–150%) in Settings — scales the whole UI, including the YAML editor.
Major visual overhaul: design-token system with unified typography and a warm “milky-coffee” light theme; Proxies redesigned as a single-open accordion; reworked Edit rules modal with the full mihomo rule-type set; decluttered Advanced with consolidated Tools; Settings gains iOS-style switch toggles, two-column layouts, and section icons; theme-matched scrollbars throughout.

What's Changed

chore(core): pin mihomo core to v1.19.26 for reproducible builds by @Nemu-x in #4
fix(security): clear high/moderate frontend dependency vulnerabilities by @Nemu-x in #5
feat(profiles): import local configs and proxy share links by @Nemu-x in #6
fix(build): commit ImportProfileFromText wails binding by @Nemu-x in #7
feat(ui): visual-polish — design tokens, unified typography, milky-coffee light theme, layout fixes by @Nemu-x in #8
feat(ui): Proxies single-open accordion redesign by @Nemu-x in #9
feat(ui): rework Edit rules modal + full rule-type set + themed scrollbars by @Nemu-x in #10
feat(ui): rework Advanced — declutter, drop redundant actions, consolidate Tools by @Nemu-x in #11
feat(ui): settings/advanced visual polish — switches, two-column layout, tighter copy by @Nemu-x in #12
fix(core): tear down core+TUN before update, settle adapter before kill by @Nemu-x in #13
feat(updates): fail-closed minisign verification + signed release assets (F1) by @Nemu-x in #14
ci: add security gating (govulncheck + pnpm audit), move off EOL Go 1.23 by @Nemu-x in #15
chore(deps): bump runtime Go modules to clear all govulncheck findings by @Nemu-x in #16
fix(installer): show progress during VC++ redist install (/passive) by @Nemu-x in #17
chore(release): bump to 0.6.0 by @Nemu-x in #18

Full Changelog: v0.5.1...v0.6.0