Penny Goblin 0.2.13

Penny Goblin 0.2.13 includes security and memory safety hardening across the ledger, statement runtime, sync protocol, and compiled views, plus category casing search fixes.

• Add image magic header and bounds validation before decoding receipts and vouchers.
• Enforce strict JSON document limits on budget, settings, and statement sync payloads.
• Protect sensitive ledger and exported statements with atomic, permission-restricted file publishing.
• Enforce recursion depth limits (<= 64) and template safety checks across compiled Oriel views.
• Reuse search arenas to avoid allocation churn in high-volume payment lists.
• Resolve category casing collisions when searching or renaming categories in web and Oriel.
• Tested and verified on physical POCO Android hardware (surya_global) and desktop Linux.

This release provides locally built Linux x86_64 AppImages (Oriel and WebKit) and the Android arm64 APK. Domain, compiled-view, WebKit and sync tests were run locally.

Added later: the Windows x86_64 installer (WebView2, Vulkan) and the macOS Apple silicon disk image (WebKit, Metal), built by CI from the same 0.2.13 app sources (run 39609535259). Windows needs Windows 10/11 with the WebView2 runtime; macOS needs macOS 13 or newer.

Source: highercomve/penny-goblin, tag v0.2.13, commit 89424ba.

Penny Goblin 0.2.12

Penny Goblin 0.2.12 uses the published Oriel 0.18.0 release, pinned by package hash.

• Pin desktop WebKit CI to a full-size display and retry failed NSIS tool downloads.

• Opening a category, merchant or fixed item from Home or Insights can be
  undone: Back (and the "Back to Insights" chip on desktop) returns to the
  report it came from instead of leaving a filtered Payments list. On
  desktop, Alt+Left, the mouse back button and Escape do the same.

• The desktop icon sits on the forest-green tile Android uses, with bolder
  strokes, instead of a thin outline that faded at launcher sizes.

• Category research searches for the business behind a payment processor
  prefix (MERPAGO*HAPETITO searches "HAPETITO Chile") and tells the model
  which processor took the card, so it no longer researches Mercado Pago,
  TUU, PayU, SumUp and similar providers.

This release provides locally built Linux x86_64 AppImages (Oriel and WebKit) and the Android arm64 APK. Domain, compiled-view, WebKit and sync tests were run locally. GitHub Actions cannot start jobs because of the account billing/spending limit, so Windows/macOS 0.2.12 packages are pending.

The Android APK uses the existing local debug signing key and updates previous local com.pennygoblin.app builds. It may not update APKs signed by GitHub's temporary CI key. Linux Oriel uses Vulkan; Linux WebKit uses CUDA 13 when available, otherwise CPU.

Source: highercomve/penny-goblin, tag v0.2.12, commit 1a908d3.

Penny Goblin 0.2.7

• Windows (WebView2, Vulkan scanner) and macOS (WebKit, Metal scanner)
  desktop builds.
• Linux WebView build scans on NVIDIA GPUs through CUDA, on by default:
  2.5-3.3 s a receipt on an RTX 4070 vs 6-15 s on the CPU.
  install-local.sh builds it when the CUDA toolkit is installed.
• Linux Oriel-interface build ships the Vulkan scanner backend (any GPU;
  Settings → Receipt scanner → Use GPU).

Built from 9aabdfe. Linux needs GTK4 and WebKitGTK 6 (the WebKit build scans on NVIDIA GPUs with the CUDA 13 runtime); Windows needs the WebView2 runtime (Windows 10/11); macOS needs macOS 13 on Apple silicon; Android needs Android 10 or newer.

CUDA backend ggml-cuda-f742711f2de54cf4-75_86_89_120a-cuda13

libggml-cuda.so for CI's Linux WebView build (CUDA archs 75,86,89,120a, CUDA 13.4.2-1). Not an app release.

Penny Goblin 0.2.6

• Show the Home account filter's label on Android: a hidden progress toast
  no longer hides the fields under it (Oriel runtime fix, also GTK and Windows).

Built from 9cc5e35. Linux needs GTK4 and WebKitGTK 6; Android needs Android 10 or newer.

Penny Goblin 0.2.5

• Prefer final payable receipt totals over pre-discount subtotals.
• Preserve reliable OCR amounts when models fill missing fields.
• Add a dedicated small Linux tray mark.
• Prepare reproducible source-only builds, GitHub Actions and the Zine website.

Built from 3e4fa96. Linux needs GTK4 and WebKitGTK 6; Android needs Android 10 or newer.