Release v1.0.2 · shadowflee3/fluxer-client

What's new in v1.0.2

Eliminated nodeIntegration in the server-config window — replaced with a dedicated config-preload.js using contextBridge (no Node.js access in the renderer)
Server URL is now fetched from the main process via IPC instead of being string-interpolated into <script> blocks (prevents XSS via crafted URLs)
Notification icons restricted to inline data:image/png or data:image/jpeg only (prevents SSRF via remote icon URLs)
Protocol-downgrade attacks blocked in popup navigation guards
Input validation hardened across all IPC handlers: type checks, length caps, allowed-value allowlists

Zoom level is now correctly restored after navigation (Electron 28+ resets zoom on each page load)
Download stream size cap (512 MB) now enforced before any data reaches disk
config-preload.js added to packaged files (was missing from the build)
Tray "still running" hint uses an atomic file write to eliminate a TOCTOU race
Badge count updates are debounced to avoid flooding the OS taskbar