v1.6.0 - Security and reliability fixes

sturimcode released this 02 Apr 17:23

· 120 commits to main since this release

f5ab8a7

Security

Added CSRF state parameter to Strava OAuth flow
Removed raw API response text from user-facing errors (could leak secrets/tokens)
Redacted Eufy access token from debug log output
Removed hardcoded plist with personal paths from repo history

Reliability

OAuth callback server now handles multiple requests (fixes favicon race condition)
Distinguishes user denial from timeout in OAuth error messages
First-run Strava OAuth failure no longer crashes setup - shows recovery instructions
DB migration uses proper Python-managed transaction (atomic)
Uninstall no longer crashes on subdirectories

Packaging

Removed setuptools from runtime dependencies (build-only)
Fixed stale .env references in error messages
Auto-backfill when a new sync target is added

Assets 2