v0.2.3 — code review fixes & dependency maintenance

Maintenance release on top of v0.2.2. Bundles a small batch of frontend fixes (security, a11y, robustness) plus the regular dev-dep refresh. No new features, no breaking changes.

Frontend fixes (user-visible behavior)

• Set noopener,noreferrer on the download window.open so the new tab can no longer reach back through window.opener or leak referer. (#31)
• Time out /api/info requests at 30 s via AbortController, aligned with backend SOCKET_TIMEOUT, so a stalled API can no longer hang the UI. (#31)
• Translate AbortError to a user-facing timeout message; broadened the check from instanceof DOMException to instanceof Error for portability across runners and polyfills. (#31)
• Accessibility: form controls now have proper label[for] associations, the URL input announces validity via aria-invalid / aria-describedby, and both error regions use role="status" (polite live region) instead of the role / aria-live anti-pattern. (#31)

Tests

• Backend: cover subprocess pipe orchestration with a fake-binary integration test so future refactors of the streaming layer have a regression net. (#31)

Documentation

• Clarify the stateless thin-client architecture in internal docs — server-side is structurally required, not "serverless". (#31)
• Ignore a local-only sentinel file. (#31)

Image changes (frontend bundle rebuilt + build infra)

• node build base 22.22.2-alpine → 26.1.0-alpine (#29)
• vite 8.0.10 → 8.0.12 (#26)
• vitest 4.1.5 → 4.1.6 (#28)
• tailwindcss 4.2.4 → 4.3.0 (#27)
• @tailwindcss/vite 4.2.4 → 4.3.0 (#25)

Bundle output is byte-equivalent in size to v0.2.2; behavior unchanged.

Pull the image

docker pull ghcr.io/fdff87554/youtube-downloader:0.2.3
# or, for the floating minor tag:
docker pull ghcr.io/fdff87554/youtube-downloader:0.2

Run command and configuration are unchanged from v0.2.0 — see that release for the full setup notes.