Owldrop 0.10.1

[0.10.1]

Security

• Dependency & security refresh — tailscale.com v1.102.3 → v1.104.0,
  golang.org/x/crypto v0.55 → v0.57, x/net v0.58 → v0.59, x/mod v0.40 →
  v0.41, plus x/sys, x/text, x/sync, x/term, x/time, x/oauth2 and
  transitive bumps (wireguard-go, gvisor, klauspost/compress, mdlayher/netlink,
  pires/go-proxyproto). govulncheck reports no reachable vulnerabilities on
  both the server (-tags server) and Windows desktop builds.
• npm advisories fixed — web/ had picked up a critical seroval
  advisory (via @tanstack/router-core) and a high source-map-js one (via
  postcss); site/ moves to wrangler 4.147.0, dropping the vulnerable
  undici/miniflare pair. Both npm audits are clean.

Changed

• Go 1.27.1 toolchain — required by tailscale v1.104.0. go.mod, the Nix
  package, and both Dockerfiles build with Go 1.27.1 (nixpkgs only ships
  1.26.5/1.27rc2, so the flake keeps its pinned from-source toolchain).
• Frontend dependencies refreshed — React 19.2.8 → 19.3.0, TanStack
  Router 1.170.18 → 1.170.41 and Query 5.101.4 → 5.104.1 within the pinned
  majors.
• scripts/vulncheck.sh always installs a current govulncheck — an older
  ambient analyzer refuses a module whose go directive is newer than its
  toolchain, failing the release preflight for the wrong reason.

Full changelog: https://owldrop.app/changelog

Owldrop 0.10.0

[0.10.0]

Added

• Mullvad VPN tab — manage your Mullvad VPN connection straight from the
  UI: every Mullvad exit node your tailnet offers, grouped by country with a
  filter, one-click connect, live connection status and an allow-LAN-access
  toggle. Mullvad servers are exit-node peers in the tailnet, so switching
  goes through the same LocalAPI machinery as tailscale set --exit-node —
  no shell-outs, works in tsnet mode too. Requires the Mullvad add-on enabled
  on your tailnet; the tab shows setup guidance when no Mullvad nodes are
  available.

Fixed

• Release builds reported the wrong version — the platform build
  Taskfiles hardcoded appVersion=0.8.0, so 0.9.0 and 0.9.1 shipped claiming
  to be 0.8.0: usage stats never saw a 0.9 install, and the in-app updater
  kept offering an update that was already installed. The version is now read
  from build/config.yml (the single source of truth) at build time, and the
  release preflight fails if a Taskfile hardcodes it again.
• Stats page hid newly shipped versions — the "Versions in the wild"
  table listed only the eight most-installed versions, so a fresh release
  with a single early adopter was invisible; it now lists every version with
  a last-seen date.

Full changelog: https://owldrop.app/changelog

Owldrop 0.9.1

[0.9.1]

Security

• Dependency & security refresh — tailscale.com v1.98.9 → v1.102.3,
  golang.org/x/mod v0.37 → v0.40 (fixes GO-2026-6179 / GO-2026-6180:
  x/mod/sumdb transparency-log tile verification bypass and unauthenticated
  hash handling in Lookup), golang.org/x/crypto v0.53 → v0.55,
  golang.org/x/net v0.56 → v0.58, plus x/sys, x/text, x/sync,
  x/term, x/time and transitive bumps (wireguard-go, klauspost/compress,
  rtnetlink). govulncheck reports no reachable vulnerabilities on both the
  server (-tags server) and Windows desktop builds; npm audits for web/
  and site/ are clean.

Full changelog: https://owldrop.app/changelog

Owldrop v0.9.0

[0.9.0]

Added

• Agent MCP (tailnet) — Streamable HTTP MCP on /mcp for tailnet agents:
  inbox, send, Sync, and drop links via a dedicated bearer token (off by
  default). Public Funnel URLs do not expose MCP.

Fixed

• Global shortcut no longer hijacks Ctrl+Shift+T — every browser uses
  Ctrl+Shift+T to reopen a closed tab, and Owldrop registering it globally
  stole that key system-wide (reported on Linux Mint: Vivaldi and Edge both
  opened Owldrop instead). The default is now Ctrl+Alt+O, and the
  shortcut is configurable in Settings → Shortcuts — it re-registers live,
  no restart needed.
• Release pipeline on Go 1.26.6 — govulncheck-clean builds (stdlib
  security fixes + x/net bump); server/Docker builds no longer link the
  desktop updater; the Nix package and Docker image build with the fixed
  toolchain.

Full changelog: https://owldrop.app/changelog

Owldrop 0.8.0

[0.8.0]

Added

• Activation scoreboard — telemetry now records sync_item_added,
  drop_link_used, and drop_link_failed. The stats page tracks download →
  install → first successful transfer (file, Sync, or drop-link upload) and
  14-day repeat, instead of treating daily opens as the product metric.
• Empty inbox onboarding — an empty inbox is a first-run, not a calm
  empty state: drop a test file, copy a drop link, paste on Sync, or scan a
  phone QR (HTTPS Serve or LAN).
• Household drop box — landing page and first-run copy position Owldrop
  as one always-on receive node. Tagged devices in Send explain why Taildrop
  cannot reach them and offer a drop link to this machine.
• OS share / Open With — files handed to the app (second instance, argv,
  Linux %F, macOS document types, Windows Send to / context menu) land on
  the Send tab to pick a device.
• tsnet Funnel — a tsnet node now serves public /drop/* links on
  :443 when Funnel is allowed (still no Taildrop inbox).
• Runnable builds — CI ships a universal Mac zip (amd64 + arm64) and a
  GTK3 / WebKit2GTK 4.1 Linux package that runs on Ubuntu 24.04 LTS.

Changed

• Creating a drop link copies the URL a recipient can actually open (Funnel
  public URL when Public access is on).
• Sync is on the marketing site as a phone→desktop scratchpad, not clipboard
  sync.
• Docker/NAS docs state the tagged-node gap and that host-socket is the
  path with a real inbox.

Fixed

• Privacy policy wording now matches the opt-out toggle (it previously said
  opt-in in the body).

Full changelog: https://owldrop.app/changelog

Owldrop 0.7.3

[0.7.3]

Added

• Session token now persists in the config file instead of being minted
  per process start. On Docker/NAS installs (config in the /data volume)
  an already-open UI keeps working across container rebuilds and updates —
  no more 403s (and re-auth) on every image update. Covers the lost-volume
  case too: the UI reloads once to pick up a freshly-embedded token when a
  mutation is refused.
• Hidden devices — Settings → Hidden devices lets you remove a device
  from the Send picker and the tray's quick-send menu. Hidden devices can
  still receive files; the setting persists in the config file.
• Trusted domains for reverse proxies — Settings → Trusted domains
  lets you serve the app at your own hostname through a reverse proxy
  (e.g. drop.example.com, subdomains included) while keeping the default
  DNS-rebinding protection for everything else.
• tsnet mode now reads status from the embedded node — with
  OWLDROP_TSNET=1 (no host Tailscale) the app's local API client talks
  to the in-process node instead of a missing host socket, so the
  tailnet-state indicator and self MagicDNS name reflect the node itself.
  Taildrop inbox/send still need a tailscaled daemon and remain unavailable
  in tsnet mode.

Security

• index.html is served with Cache-Control: no-store so a stale cached
  page can never keep sending a dead session token.

Full changelog: https://owldrop.app/changelog

Owldrop 0.7.2

[0.7.2]

Fixed

• Windows headless builds (GOOS=windows -tags server) failed to compile against
  Wails v3 beta.2 (undefined: windowsWebviewWindow). Bumped Wails to
  v3.0.0-beta.5, which correctly excludes Windows webview code from server
  builds.
• Serve/Funnel LocalAPI client no longer hardcodes the Linux Tailscale socket
  path; it uses the same cross-platform local.Client as the rest of the app
  (fixes Serve/Funnel on Windows and other non-Linux hosts).

Added

• scripts/vulncheck.sh: fails on high/critical npm advisories in web/ and
  site/, and on reachable Go/Wails vulns via govulncheck.
• CI workflow on PRs and main, plus a required vuln job in the release
  pipeline; scripts/bump-release.sh runs the same check locally before
  bumping.
• Marketing site now pins wrangler in site/package.json so deploys and
  audits use a lockfile instead of floating npx wrangler.
• buildWindows.sh for a quick headless Windows cross-compile.

Security

• Bumped nanoid (web transitive) and golang.org/x/text to clear high
  advisories caught by the new vuln gate.

Changed

• Release packaging installs Wails CLI v3.0.0-beta.5 to match go.mod.
• Stopped tracking Cloudflare Wrangler cache/state under site/.wrangler.

Full changelog: https://owldrop.app/changelog

Owldrop 0.7.1

[0.7.1]

Added

• Update to new release banner
• Fixed last release issue

Full changelog: https://owldrop.app/changelog

Owldrop 0.6.5

[0.6.5] - 2026-08-08

Added

• Added CI for windows build to have a signing for downloading via the microsoft store - still awaiting certificiation in Microsoft Partner Center.
• Added a new sync tab for easily copying links to and from machines (main use case is for mobile -> desktop text syncing while there is no mobile app)
• Cleaned up some old docs

Full changelog: https://owldrop.app/changelog

Owldrop 0.6.4

Full Changelog: 0.6.3...0.6.4