⭐ Highlights
- Windows binaries are now signed and validated before release
- Desktop binaries are now built by CI and published as GitHub Release assets
- Release artifacts are also available from the Docker release repository (
syncin/desktop-releases) - Linux builds now include AppImage and DEB packages for x64 and ARM64
- Desktop security has been hardened around server views, navigation, IPC, external URLs, and TLS validation
- Server authentication handling is more robust, with clearer warnings for expired or missing tokens
Features
- auth: show server warning status for expired or missing tokens (1bdba9f)
- core: improve unicode path matching in NormalizedMap (dc6a162)
Security
- Fixed unsigned Windows updater artifacts by signing Windows binaries and NSIS uninstallers, then validating release payloads before publishing. GHSA-cqxc-gww4-w27f @eddieran
- Restored TLS certificate validation for server views and desktop HTTP requests, with an explicit per-server opt-in for insecure certificates. GHSA-hgqh-536m-7hhq @de3erve
- Prevented path traversal in sync diff paths so remote file paths cannot write outside the intended local sync directory. GHSA-384w-36p5-8922 @de3erve
Bug Fixes
- build: upgrade electron-builder for ARM64 NSIS installer (a6599b0)
- ci: use current app-builder blockmap API (9411344)
- core: prevent local path traversal from remote file paths (9c2f6a8)
- main: add preload scripts for wrapper and webview with scoped IPC channels (7ce2311)
- main: block renderer-created windows in server view (d195049)
- main: move server auth to desktop request manager (874f141)
- main: restrict external URL and file opening (8d68b15)
- main: scope server navigation by origin and path (b3893fd)
- renderer: adjust min-zwidth of top bar (4dc7eb7)
- security: restore TLS validation and add per-server opt-in (db16d07)
- security: verify server WebContents on remote IPC (02e489a)
Contributors
eddieran and de3erve