Skip to content

v0.3.15 — Security follow-up (desktop pins loopback)

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Aug 12:38
· 165 commits to main since this release
v0.3.15
1ce8835

A follow-up to the v0.3.14 security fix, closing one more edge.

Fixed

v0.3.14 made the local server bind loopback by default, with HOST=0.0.0.0 as an explicit opt-in for npm run server power users. But the desktop app passes your whole environment to the bundled server — so if your shell happened to carry HOST=0.0.0.0, the desktop server would still bind to every interface. The desktop app only ever talks to 127.0.0.1, so it now pins HOST to loopback and ignores any ambient value. (Thanks again to the folks reviewing this.)

Which file do I download?

Already installed? None: the app updates itself (canvas menu → Check for updates). Fresh install, pick by system:

Your system File
macOS, Apple Silicon (M1 and later) ThoughtDAG-0.3.15-arm64.dmg
macOS, Intel ThoughtDAG-0.3.15.dmg
Windows ThoughtDAG.Setup.0.3.15.exe
Linux ThoughtDAG-0.3.15.AppImage

Not sure which Mac: Apple menu → About This Mac. The .zip, .blockmap and .yml files serve the in-app updater; ignore them. Or skip the table: the download page detects your platform.

Assets 16
Loading