Skip to content

v0.3.18

Latest
Latest

Choose a tag to compare

View all tags
@Sbussiso Sbussiso released this 06 Jul 18:04
· 2 commits to master since this release
v0.3.18
0d22a9c

SearchBox 0.3.18 fixes a stored-XSS vulnerability and brings the first native Linux build. All users should update.

🔒 Security — fixed stored XSS in the search UI

Filenames and extracted content from indexed files were interpolated into the results, Explore, and image-gallery pages without HTML-escaping. A file you didn't author — from a downloads folder, a torrent, or an internet ZIM/Kiwix archive — could carry a crafted name or body that executed script in the app's own origin, where your session and the authenticated API (including the vault and "open file" actions) live.

Every untrusted field (filename, content, file type, image names, and notification + AI-citation titles) is now HTML-escaped before rendering, in both text and attribute contexts; Meilisearch's match-highlights are preserved safely. The document viewer was already escaping correctly and was unaffected.

🐧 New — native Linux build (x86_64)

This release ships SearchBox-0.3.18-x86_64-linux.tar.gz with Meilisearch bundled:

tar xzf SearchBox-0.3.18-x86_64-linux.tar.gz
cd SearchBox-0.3.18-x86_64-linux
./searchbox

Then open http://127.0.0.1:8080 in your browser. Runtime state lives in $XDG_DATA_HOME/searchbox (else ~/.local/share/searchbox). The Windows pipeline is untouched — the Linux build is fully independent.

🛠 Fixed

  • Docker deployments could not reach Meilisearch. Since the v0.3.16 key rotation the app generated its own private key and ignored the container's MEILI_MASTER_KEY — so every search call against the sidecar was rejected. The app now uses MEILI_MASTER_KEY when it's set (native installs are unaffected; set a strong value in your compose file rather than the sample default).
  • docker stop / systemd stop now shut down cleanly. SIGTERM triggers the same graceful drain as Ctrl-C, so containers no longer hang until SIGKILL or orphan the Meilisearch sidecar.
  • On Linux, the Settings update checker links to the release page instead of offering the Windows-only in-app installer.

✨ Changed

  • Motion & depth polish across the whole UI — ambient aurora backgrounds, choreographed home screen, cascading results, glass headers, a "thinking" light sweep on AI summaries. Pure CSS; all decorative motion respects prefers-reduced-motion.
  • The landing page's live demo is now an exact working replica of the app, including the document viewer rendering PDFs, Word docs, Markdown, and wiki articles the way the app does.

📦 Install

Platform Package
Windows 10/11 (Intel & AMD) SearchBox-0.3.18-x86_64.msi
Windows on ARM (Snapdragon) SearchBox-0.3.18-aarch64.msi
Linux (x86_64) SearchBox-0.3.18-x86_64-linux.tar.gz
winget winget install SourceBox.SearchBox

Each asset has a .sha256 sidecar for verification.

Full Changelog: v0.3.17...v0.3.18

What's Changed

  • fix(landing): always-on image rail, Meilisearch-style matching, bigger demo, self-restarting tour by @Sbussiso in #8
  • docs: full documentation overhaul — user manual, tutorials, and developer docs by @Sbussiso in #13
  • fix(landing): demo viewer renders documents like the real app by @Sbussiso in #14

Full Changelog: v0.3.17...v0.3.18

What's Changed

  • fix(landing): always-on image rail, Meilisearch-style matching, bigger demo, self-restarting tour by @Sbussiso in #8
  • docs: full documentation overhaul — user manual, tutorials, and developer docs by @Sbussiso in #13
  • fix(landing): demo viewer renders documents like the real app by @Sbussiso in #14

Full Changelog: v0.3.17...v0.3.18

What's Changed

  • fix(landing): always-on image rail, Meilisearch-style matching, bigger demo, self-restarting tour by @Sbussiso in #8
  • docs: full documentation overhaul — user manual, tutorials, and developer docs by @Sbussiso in #13
  • fix(landing): demo viewer renders documents like the real app by @Sbussiso in #14

Full Changelog: v0.3.17...v0.3.18

Contributors

Sbussiso
Assets 8
Loading