v0.1.5

Changelog

Features

• 96c6ac7 feat(admin): show what the current release actually published
• 5373777 feat(backend): bound audit_events with a retention window
• a9debaf feat(backend): editable profile and self-service password change
• 247388c feat(backend): one stable download URL per platform, and count the installs
• 1797e0c feat(backend): stop storing plaintext filenames and exact IPs
• d91ae8f feat(desktop): turn on signed in-app updates
• ac31410 feat(frontend): App updates panel in Settings (desktop only)
• 8ed6a5c feat(frontend): confirm before applying plan config and removing vault members
• a98aa90 feat(frontend): confirm before changing a platform token's scope
• 6d276c8 feat(frontend): profile panel for name, avatar and password
• 5ffca70 feat(frontend): proxy /api on www.zcrypt.cloud as a stable front for native apps
• 58e26f9 feat(frontend): route downloads through /dl, add the downloads dashboards
• 4199fff feat(frontend): seal the metadata that still reached the server in plaintext

Bug fixes

• 88cb916 fix(android): safe-area insets survive an out-of-date system WebView
• 288c8b2 fix(backend): clean up what the download endpoint's own lint found
• b9e2341 fix(ci): android ships the right icon and a real version; stable installer URLs
• 525f41f fix(ci): build the Intel mac by cross-compiling, not on a runner that no longer exists
• 3bfc2c3 fix(ci): generate the real app icon for Android builds
• c18df4c fix(ci): the edge-to-edge assertion was looking in the wrong place
• 930c134 fix(ci): upload the Vercel build as one archive, not thousands of files
• f8b6324 fix(desktop): scope the updater permission to desktop, unbreaking Android builds
• 4141b87 fix(desktop): stop baking a committed backend host into shipped builds
• ed3e79e fix(desktop): stop the updater lying to .deb/.rpm installs
• c3f994f fix(download): stop misdetecting phones as desktop OSes, surface native Linux packages
• e368ad7 fix(download): stop serving a stale version when GitHub throttles us
• ff1506b fix(frontend): start OAuth on the origin the callback returns to
• 5416ed4 fix(frontend): stop the desktop keychain prompt by migrating the legacy device key
• ab1d042 fix(frontend): validate the password form as it is typed
• cddf8de fix(license): make zcrypt-core MIT, matching the rest of the project
• 039f6f4 fix(marketing): stop the landing page rendering as empty voids
• 7a9b652 fix(mobile): cover the screen edges the safe-area work missed
• 4e64b60 fix(mobile): external links do nothing in the app
• 21bfd7d fix(ops): export PATH for pg_dump 17, not just GITHUB_PATH
• 72dcd41 fix(ops): install postgresql-client-17 for Neon dump/restore
• 9b0b0a2 fix(ops): move nightly DB backup to a private repo; fail the watcher when it's blind
• b844137 fix(ops): pass the required org id to neonctl project creation
• e34951f fix(ops): stop depending on a broken Railway CLI for DB cutover
• 617be20 fix(scripts): never lock in a ratchet baseline from a run with failed gates
• c234101 fix(sealing): check the errors the new handlers ignored, cover the new branches
• 9a20437 fix(security): build on Go 1.26.6 and current x/crypto
• 528a3cf fix(security): move off the hickory-proto line that has no patch
• d1d9bb8 fix: justify the image decoder imports, cover the new profile API wrappers

Other changes

• b559813 chore(ci): dependabot for all five ecosystems
• e334ce9 chore(desktop): document www.zcrypt.cloud as the native API origin
• d6ecd72 chore(desktop): drop the shell plugin, which nothing has used since the sidecar
• 502909e chore(desktop): take the patched tauri, serde_with and rand
• 5738f9d chore(hooks): strip assistant attribution trailers in commit-msg
• 6dfc6a8 chore(neon): revert the live rotation test back to the original project
• f08772e chore(neon): rotation — cutover succeeded — active=snowy-bonus-50199348, old project parked as standby (dormant, quota refills next month)
• 8926c04 chore(release): 0.1.5
• b95d5f6 refactor(frontend): share the token-scope confirmation between settings and admin
• 2883aa2 refactor(frontend): stop exporting names nothing imports
• 26c570e refactor(mobile): make safe-area insets testable off-device
• 4864ae0 test(frontend): stop asserting on the order of two concurrent re-seals