v0.2.11

Bug-fix release: sign-out no longer ends your sessions on other devices, and bookmark thumbnails with relative image paths now load.

Fixes

• Sign-out is local to the current browser. The Sign out button and the desktop app's sign-in hand-off both called Supabase's signOut() with its default global scope, which revokes every session the user has. Every desktop sign-in therefore signed the user out on all their other devices. Both now end only the current browser's session.
• Relative thumbnail URLs are resolved. When a page's og:image is a relative path (such as /marketing/og-image.png), it was saved as-is and then loaded from tldrq.com, which returned 404. The scraper now resolves it against the bookmarked page, and existing bookmarks are resolved when displayed, so no data migration is needed.

Behavior changes

• og:image values that are not http(s) URLs, such as data: URIs, are no longer stored or displayed.

Full Changelog: 0.2.10...0.2.11

v0.2.10

Security and maintenance release. No user-facing feature changes. This release clears 100 Dependabot security alerts, including three critical remote code execution advisories in Next.js.

Security

• Next.js 16.4.0 fixes three critical remote code execution advisories (Image Optimization API with AVIF files, next/og ImageResponse, Windows-hosted servers), along with SSRF in Image Optimization and SSG/ISR cache poisoning
• sharp 0.34.5 → 0.35.5, picking up libvips, librsvg, and libheif fixes
• undici 7.29.0 → 7.30.0, including a TLS certificate validation bypass fix
• Lockfile updates for source-map-js, brace-expansion, js-yaml, and nanoid
• Electron 44 fixes sandbox and context-isolation bypasses; the electron-builder update brings fixed tar, xmldom, and extract-zip
• In total: 100 alerts resolved (4 critical, 57 high, 33 medium, 6 low) — 38 in the web app, 62 in electron/

Dependencies

• Next.js / eslint-config-next 16.2.12 → 16.4.0, React / React DOM 19.2.8 → 19.3.0
• @supabase/ssr 0.12.3 → 0.12.7, @supabase/supabase-js 2.110.8 → 2.117.3
• @types/node 26.1.1 → 26.6.4, @types/react / @types/react-dom → 19.3.0
• Desktop wrapper: Electron 35.7.5 → 44.7.0, electron-builder 26.8.1 → 26.15.3

Tooling

• Added Dependabot version updates: weekly checks for npm at the root and in electron/, plus GitHub Actions, each with a 7-day cooldown
• Dependabot ignores TypeScript and ESLint major updates until the toolchain supports them
• Added CHANGELOG.md and RELEASE_NOTES.md

Known limitations

• TypeScript 7 and ESLint 10 remain blocked upstream. TypeScript 7 drops the JavaScript compiler API that the Next.js build type-check and typescript-eslint load, and eslint-config-next bundles an eslint-plugin-react that crashes on ESLint 10.
• One medium alert remains open: sprintf-js in electron/, which has no fixed release yet. It is only used by electron-builder's download tooling and is not part of the app.

Full Changelog: 0.2.9...0.2.10

v0.2.9

Maintenance release. No user-facing feature changes — this is a dependency refresh plus the repo's first CI setup.

Dependencies

• Next.js 16.1.6 → 16.2.12, React / React DOM 19.2.5 → 19.2.8
• @supabase/ssr 0.10.2 → 0.12.3 — 47 commits upstream, concentrated in cookie handling
• @supabase/supabase-js 2.103.0 → 2.110.8
• TypeScript 5.9.3 → 6.0.3
• @types/node 25 → 26, matching the Node 26 runtime
• Tailwind CSS 4.2.1 → 4.3.3, ESLint 9.39.3 → 9.39.5
• Removed @types/cheerio, a stub package — cheerio 1.x ships its own type definitions

Tooling

• Added a GitHub Actions CI workflow running lint and build on pull requests and pushes to master
• Made Lint and build a required status check on master, with admin bypass retained
• Cleared all outstanding lint problems; npm run lint now exits clean

Fixes

• fade-collapse.ts: the two deliberate forced reflows are now written as void element.offsetHeight, preserving the layout flush while making the intent legible to the linter

Known limitations

TypeScript 7 and ESLint 10 are both blocked upstream. typescript-eslint does not yet support TS 7 (typescript-eslint#10940), and eslint-config-next bundles plugins capped at ESLint 9.

Full Changelog: 0.2.8...0.2.9

v0.2.8

Changes

• Rename package to tldrq, bump to 0.2.8, add README badges (#4)
• Update import and export button tooltips
• Swap import and export icons and update export tooltip
• Convert share dialog to centered modal with title
• Add close button to share popup dialog
• Render bulk import as modal dialog to prevent icon bar layout shift
• Replace collapsible details with static content in bulk import
• Show browser tab gathering instructions by default in bulk import
• Fade out bookmark list during refresh
• Move import to icon button next to download in toolbar
• Match login header structure to authenticated header layout
• Add gap between title and version in login header
• Add version to login page header
• Add header to login page and fix Electron drag on navigation
• Add desktop app build instructions to README
• Add Electron dev icon and lockfile
• Clear stale browser session before desktop OAuth flow
• Use local HTTP server for Electron OAuth token handoff
• Fix desktop OAuth: redirect via HTTPS instead of custom protocol
• Wrap desktop auth pages in Suspense for useSearchParams
• Fix Electron OAuth by starting flow in system browser for PKCE
• Add Electron desktop app with OAuth deep-link auth flow
• Add combined schema.sql and update docs
• Suppress legitimate set-state-in-effect lint errors

Full Changelog: 0.2.7...0.2.8

v0.2.7

Changes

• Add shared views with custom titles, search, and tooltip updates
• Add cache-busting query param to favicon link
• Add Apple Touch Icon and refine favicon colors
• Add custom favicon and gold header text in dark mode

Full Changelog: 0.2.6...0.2.7

v0.2.6

Changes

• Bump version to 0.2.6
• Refine bookmark creation message to mention drag-and-drop support

Full Changelog: 0.2.5...0.2.6

v0.2.5

Changes

• Bump version to 0.2.5
• Add drag-and-drop URL support for bookmark creation
• Update branding from "Reading List" to "tldrq.com" across app and documentation
• Add tooltip to save button
• Add tooltip to import button
• Change delete animation to slide-right then collapse
• Swap order of Set priority and Move to collection in overflow menu

Full Changelog: 0.2.4...0.2.5

v0.2.4

Changes

• Replace disintegrate animation with fade+collapse on bookmark delete, bump to 0.2.4 (#3)

Full Changelog: 0.2.3...0.2.4

v0.2.3

Changes

• Add tooltips to toolbar buttons, align menu/delete icons, bump to 0.2.3
• Move delete button from overflow menu to trash icon on card
• Show OS-specific browser tab export instructions in bulk import
• Add browser tab URL export instructions to bulk import
• Auto-focus URL input field on page load
• Run delete animation and API call concurrently

Full Changelog: 0.2.2...0.2.3

v0.2.2

Changes

• Add disintegration animation on bookmark delete, bump to 0.2.2

Full Changelog: 0.2.1...0.2.2