Skip to content

Snap2Link v1.5.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 06:47
· 8 commits to main since this release
v1.5.0
6f40ee2

Snap2Link v1.5.0

Security hardening release from a full audit of the app and its release pipeline. No known exploit existed (no script-injection point was found), but the app gave its windows far more power than they needed, so a single future bug or compromised dependency could have exposed local files. Updating is recommended.

Security

  • Uploads are limited to Snap2Link's own captures. Screenshots are now written to a private folder in the app cache, and the upload command refuses any other file, so nothing else on disk can be published to Drive.
  • The app windows can no longer read arbitrary files. The local asset protocol is restricted to that captures folder, and a strict Content Security Policy is enforced in every window.
  • Least-privilege permissions per window. The settings window, the capture overlay and the annotator each get only the commands they use. Clipboard reading, system-wide shortcut registration from the UI, process control and the shell plugin were removed.
  • Google sign-in uses state and PKCE. The local callback server now validates the response, times out after 5 minutes and shows a clear message if sign-in is cancelled.
  • Token and settings files are written atomically and readable only by your user on macOS and Linux.
  • Release pipeline: actions pinned to commit SHAs, minimal workflow permissions, validated release tags, checksum-verified build tools, and dependency updates now wait for the test suite before merging.

Fixed

  • Changing the capture shortcut to an invalid or already-used combination no longer leaves you without a working shortcut.
  • Old screenshots that were cleaned up on Drive are only counted when the deletion actually succeeded.

Installation

Windows

  • Download Snap2Link_1.5.0_x64-setup.exe and run it. SmartScreen may flag the binary as "unrecognised app" (not yet EV-code-signed); click More info → Run anyway.

macOS

  • Download Snap2Link_1.5.0_universal.dmg — a single Universal binary that runs natively on both Apple Silicon and Intel Macs.
  • The app is not yet notarised, so the first launch needs a manual override: right-click the app in Finder → Open → Open in the dialog. Subsequent launches behave normally.
  • The first screenshot capture triggers a Screen Recording permission prompt in System Preferences → Security & Privacy → Screen Recording. Grant it and re-launch.

Linux

  • .AppImage: chmod +x snap2link_1.5.0_amd64.AppImage && ./snap2link_1.5.0_amd64.AppImage — works on most distros, no install needed.
  • .deb (Debian/Ubuntu): sudo apt install ./snap2link_1.5.0_amd64.deb
  • .rpm (Fedora/RHEL): sudo dnf install ./snap2link-1.5.0-1.x86_64.rpm
  • The system tray needs libayatana-appindicator3-1 (preinstalled on most desktop environments).

After install, complete the OAuth wizard to connect your Google Drive.

Files in this release

Each platform ships an installer plus a signed updater archive (.sig) consumed by the in-app Check for Updates feature. You can ignore the .sig and .tar.gz files unless you're testing the updater manually.

Assets 11
Loading