v1.5.0

v1.5.0 — 2026-07-23

Changed

• Publishing a plugin no longer requires a fork. The Send plugin tab used to hand you a GitHub "new file" link and rely on GitHub forking the store repository for you. When that did not happen, you landed on "You need to fork this repository to propose changes", the request came back 422, and the app reported a generic "An unexpected error occurred" with no way forward. The button now opens a pre-filled submission issue instead: paste nothing, fork nothing, touch no git. A bot validates your repository and opens the registry Pull Request on your behalf, crediting you as co-author of the commit.
• The validation you already saw now runs twice, in the right places. The same checks the store runs on registry Pull Requests — repository reachable, latest release carrying a *.ulanziPlugin.zip asset, manifest.json present and well-formed, store.json valid with every referenced image actually existing — run on the issue before any Pull Request is created. If something is off, the bot comments exactly what to fix; edit the issue and it revalidates immediately. Submitting a plugin that is already in the registry is recognized and closed with an explanation rather than opening a duplicate.

Added

• A "Publish a plugin" issue template, reachable from the app, from the website's Publish section, or directly from the repository's issue chooser. The app and the site still validate your repository in advance and fill the form in for you, so the flow you already knew is unchanged up to the final click.

Internal

• Registry Pull Request validation accepts /revalidate from a maintainer comment and a manual run with a Pull Request number. Pull Requests opened with the Actions token do not trigger workflows, so bot-authored submissions carry their validation report in the Pull Request body and can be re-checked on demand.
• Issue bodies are untrusted input and are never interpolated into a shell command: a parser reads the body from the environment and emits only a strict owner/repo slug, which is all the rest of the workflow consumes.
• The manual fork-and-Pull-Request path stays documented for anyone who prefers it.

v1.4.0

v1.4.0 — 2026-07-22

Added

• Ulanzi Studio creator portal as an opt-in catalog source. A new Show Ulanzi Studio creator portal toggle in Settings lists plugins published on ugc.ulanzistudio.com alongside community and official ones. It surfaces 21 plugins the official product feed cannot expose — their archives are stored under a content hash with no plugin id in the filename — 15 of which reach the store for the first time, including MIDI, VTube Studio, Streamlabs Desktop, DaVinci Resolve, Elgato Key Light, HA Hub, Microsoft 365 Actions and Windows Cockpit. Entries also carry real screenshots, long descriptions and localized titles, which the official feed returns empty.
• Source filter. Narrow the store to Community, Official or Ulanzi portal entries. Only appears once more than one catalog is active.
• Filters popover. Platform, device, category and source now live behind a single Filters control with an active-filter count, keeping the bar readable in every language.
• Smarter search. Whitespace splits the query into independent terms that must all match, so claude narlei finds a plugin named Claude published by narlei even though the words are not adjacent. Matching now spans name, description, long description, author, plugin id, repository, category and tags, and ignores accents — acao finds Ação.
• Catalog cache. The Ulanzi catalogs are cached on disk for an hour, so reopening the store is instant instead of waiting on their CDN. A Clear and refresh action in Settings discards it on demand and narrates each step through a toast.
• Loading skeletons for screenshots on the plugin detail page, replacing the blank gap while images decode.
• New community plugins: Codex (dahliasan), Window Switcher, Apple Shortcuts and Run AppleScript (narlei).

Fixed

• Screenshots opened from the detail page now scale up to fill the window. Images smaller than the viewport previously rendered at their natural size, which for most portal screenshots meant a thumbnail floating in a large dark frame.
• Clicking the empty area around a lightbox image closes it again.
• Plugin artwork degrades through cover, then screenshots, then a placeholder instead of rendering a broken-image glyph. Three of the portal's cover URLs point at CDN objects that no longer exist.
• The category filter no longer lists the same entry twice. The community registry publishes lowercase slugs (tools) while the Ulanzi feeds publish labels (Tools), which produced two identically-labelled options that each matched only their own source. Categories that existed only in lowercase — Devtools, Productivity, Creator, Smart Home — returned no results at all and now work.
• Social cards for a just-published plugin no longer serve a stale image.

Changed

• Filter bar reorganized: search anchors the left and grows to fill the available width; sort and filters are pinned right.
• Faster catalog loading. The three sources are fetched in parallel instead of waiting on the community catalog first, portal list pages are requested together, and each plugin flows from id probe to detail fetch on its own rather than waiting for every probe to finish — roughly 45% off a cold load, on top of the cache.
• Community registry entries always take precedence over Ulanzi ones on id collisions, so a plugin published in both places keeps its repository, changelog and security scan.
• A failed catalog fetch now falls back to the expired cache rather than dropping the source from the store entirely.
• Portuguese interface strings are now correctly accented across all 206 entries.

Security

• adm-zip upgraded to 0.6.0 (GHSA-xcpc-8h2w-3j85). A crafted ZIP could trigger a 4 GB allocation in the library the store uses to unpack downloaded plugin archives. Downloads remain restricted to GitHub and Ulanzi hosts, and archives are still validated before extraction.
• Resolved transitive brace-expansion and fast-uri advisories. Both are build tooling and never shipped in the app.

Internal

• Added ESLint with the two React Hooks rules, reported on every pull request without gating the build. They cover a class of bug the type checker cannot see: a hook whose dependency array omits a value it reads type-checks cleanly and simply stops recomputing.

v1.3.0

v1.3.0 — 2026-07-17

Added

• Social-share banners: plugin pages now generate an og:image banner (with rasterized plugin icons) so links shared on social media and chat apps show a rich preview instead of a plain link.
• The desktop app can now log install/catalog/submission failures to disk and offers an Open logs action in Settings, so users can share technical details when reporting issues.
• New plugins in the catalog: GitHub Repo Stats, Internet Speed Test, macOS Controls, and YouTube Channel Stats.

Fixed

• Banner font rendering on CI now uses static Inter faces with measured text widths, fixing incorrect font weights and glyph overflow on the server-generated images.
• og:image URLs are now cache-busted with a content hash, so social platforms pick up updated banners instead of serving a stale cached image.
• Plugin install no longer fails on harmless macOS zip metadata (__MACOSX, .DS_Store) bundled in some release archives.

Changed

• Plugin install validation errors are now more descriptive (invalid plugin id, untrusted download URL, unexpected zip structure) to make failures easier to diagnose.
• Shared plugin links now serve through index.php (server-side OG tags) instead of the static HTML page.
• Electron bumped to 43.1.1 (latest stable patch).

Internal

• Security scan workflow always installs the latest Trivy instead of a pinned version.

v1.2.1

v1.2.1 — 2026-07-15

Changed

• The security banner in the plugin detail sheet is now a compact Scan cell in the stats bar (next to version, downloads, stars and devices). Clicking it expands the full security panel; when the scan found issues, the panel is always visible and the cell shows the issue count. The wording stays factual about the scan result ("Clean") rather than asserting the plugin is safe.
• The public security report page now credits each plugin's maintainer with a link to their GitHub profile.
• Security scan reports with findings now @-mention the affected plugin maintainers (deduped), so they get notified directly.

Internal

• GitHub Actions in all workflows bumped to their latest versions.

v1.2.0

v1.2.0 — 2026-07-15

Added

• Security scanning surfaced in the store. Every community plugin repo is scanned daily with Trivy (dependency CVEs + leaked secrets, HIGH/CRITICAL). Each catalog entry now carries a security field with the scan status, finding counts, scanner name/version, and the exact commit scanned.
• Security panel in the app. The plugin detail view shows the scan result — clean, findings (with critical/high/secret counts), scan error, or not yet scanned — with the scan date, tool, and a link to the full report. Plugin cards show a warning chip when known vulnerabilities were found. Localized in EN/PT/ZH.
• Public security report page. A security.html report is published on GitHub Pages next to catalog.json, with per-plugin anchors deep-linked from the app.
• New community plugin listed in the registry: narlei/ulanzideck-disk-status.

Changed

• The security scan and catalog publishing now run as a single pipeline (publish-catalog): scan → build catalog with security data → deploy Pages. The standalone security-scan workflow was removed; the rolling security issue is still opened/closed automatically.
• plugin-starter's generated Makefile now quits the target app gracefully on restart (via AppleScript) before falling back to a force-kill, instead of always force-killing it.
• validate-registry-pr now runs on every pull request and skips its check step when no registry files changed, instead of being gated by a path filter.
• Bumped ulanzi-plugin-starter to 1.2.3.

Internal

• Upgraded actions/upload-pages-artifact and actions/deploy-pages to v5 in the catalog publishing workflow.

v1.1.1

v1.1.1 — 2026-07-14

Added

• Ulanzi Studio official catalog (opt-in) — a new setting, "Show Ulanzi Studio catalog", lists the official plugins from the Ulanzi Studio Marketplace right alongside community plugins. Official plugins are marked with an Official badge and install like any other plugin. Off by default.

Changed

• The plugin detail's "…" menu now only shows actions that apply: Share is hidden for plugins without a public repo, and the whole menu disappears when there's nothing to show (e.g. official plugins that aren't installed).

Website

• Open in app is now the primary action on a plugin's detail. It detects whether the desktop app is installed — if it isn't, the download instructions open automatically instead of a broken link.
• Share, View source, and Report a problem moved into a compact "…" menu on the plugin detail, keeping the header focused. The menu closes on outside click or Escape.
• Added "More actions" copy in English, Portuguese, and Chinese.

v1.1.0

v1.1.0 — 2026-07-14

Added

• Ulanzi Studio official catalog (opt-in) — a new setting, "Show Ulanzi Studio catalog", lists the official plugins from the Ulanzi Studio Marketplace right alongside community plugins. Official plugins are marked with an Official badge and install like any other plugin. Off by default.

Changed

• The plugin detail's "…" menu now only shows actions that apply: Share is hidden for plugins without a public repo, and the whole menu disappears when there's nothing to show (e.g. official plugins that aren't installed).

Website

• Open in app is now the primary action on a plugin's detail. It detects whether the desktop app is installed — if it isn't, the download instructions open automatically instead of a broken link.
• Share, View source, and Report a problem moved into a compact "…" menu on the plugin detail, keeping the header focused. The menu closes on outside click or Escape.
• Added "More actions" copy in English, Portuguese, and Chinese.

v1.0.9

v1.0.9 — 2026-07-14

Added

• Share a plugin — the plugin detail now has a Share button that copies a direct link to the plugin to your clipboard (with a "Link copied" confirmation), so you can send it to anyone.
• Open shared plugins in the app — links shared from the website (ulanzicommunitystore://plugin?repo=…) now open straight to that plugin's detail inside the desktop app, including when the app is launched cold from the link.
• More from this author — the plugin detail lists other plugins by the same author, so you can discover their work in one click. Hidden when the author has no other plugins.

Website

• Each plugin detail now has Share and Open in app buttons.
• Plugin details get shareable, deep-linkable URLs (?plugin=owner/name) with proper history support, so a link reopens the same plugin on load and Back/Forward works as expected.
• Added Share / Open-in-app copy in English, Portuguese, and Chinese.

v1.0.8

v1.0.7