Android 0.9.8

Security

Fixes GHSA-x4f5-4wq4-c6c8: a live pairing code granted the whole vault. Please update every device you sync, since an updated device cannot pair with one still on an older version.

Thanks to Aman Verasia for reporting it.

Features

• copy the verification code from the list row's copy menu
• link the Matrix room from the header and footer
• add well-known delegation files for federation

Bug Fixes

• close GHSA-x4f5-4wq4-c6c8, a live pairing code grants the whole vault
• repair the escaped braces in the well-known client file
• revive the picker's iframe renderer under use_dynamic_url
• close the unlock pop-out and drop the stale locked row
• patch brace-expansion and postcss advisories
• build metadata paths from REPO, not dir

Documentation

• release notes for 1.4.3
• add CONTRIBUTING.md with the contribution requirements
• add Matrix chat badge
• rewrite the 1.4.2 store copy and re-translate

Other

• test(autofill): cover the picker's iframe renderer end to end
• chore: remove Codeberg links from the website and About screen

Full Changelog: 0.9.7-android...0.9.8-android