2.10.5

Added

• CSV and JSON exports mark each row's content duplicate group and filename duplicate group, with the group's file count, so a script can keep one file per group (#88). Exports honor the Duplicates filter and its content or filename mode. They return HTTP 503 with Retry-After: 30 until the duplicate index is ready, and the duplicate columns stay empty while it initializes.

Fixed

• The per-file Actions menu did not open on mobile cards or desktop table rows. Since 2.9.3 the toggle called the menu handler on the table renderer instead of the application, which raised a TypeError on every tap.

Security

• Updated Pillow to 13.0.0. It fixes 28 vulnerabilities reported against 12.3.0, including CVE-2026-112393, a heap buffer overflow when saving TIFF data to a memory buffer.
• Frontend build dependencies: undici 8.12.3, fast-uri 4.2.3, and serialize-javascript 7.1.4 via lockfile overrides. Build-time only; nothing ships to the browser.