noleaker v0.6.2

Fixes

• fix: geolocation and Service Worker registration wait for the config at startup (B6) (302756f)
• fix: trust only browser-made CSP violation events (B10 follow-up) (ac888b7)
• fix: start the first worker natively on origins whose CSP blocks blob workers (B10) (3ab61a3)
• fix: put back Persian fonts hidden before the page loaded them (B16) (7e6876e)
• fix: reload tabs the startup guard blocked (B3) (e1a9271)
• fix: workers on Trusted Types pages start natively instead of dying (B11) (213d253)
• fix: leave more captcha providers untouched (B12) (b5a010b)
• fix: rebase new Request() inside wrapped workers (B19) (f2c472c)
• fix: strict ends workers that hold anything but the current config (B5 follow-up) (76b991b)
• fix: options keep unsaved text across state changes (B15) (34983ff)
• fix: strict mode terminates workers only when their identity changed (B5) (9fbc250)
• fix: no false uncertain exit on dual-stack servers (B17) (3325b26)
• fix: store no startup identity with Stealth on (9a0253b)
• fix: a manual country spoofs only after a check saw the exit (B18) (01ad3f3)
• fix: always remove extension frames from error stacks (B9) (f457270)
• fix: start pages with the origin's last identity, not UTC/en-US (B6 partly, B7) (5f5aa69)
• fix: Temporal toLocaleString in the spoofed zone and locale (B8 follow-up) (3117474)
• fix: keep asking ipwho.is every check (B4 follow-up) (2c7137a)
• fix: patch Temporal.Now to the spoofed zone (B8) (d962624)
• fix: retry a failed exit check before the kill switch (B2); keep the timezone when ipwho.is fails (B4) (50621e4)
• fix: accept privacy settings another extension holds with the right value (B1) (00436fb)
• fix: match only the zone words engines parse (B14 follow-up) (67ac8d9)
• fix: routing-list actions after a sidebar link (B13); US zone abbreviations in Date parsing (B14) (6fd48d4)
• fix: preserve TrustedScriptURL policies for protected workers (4a46483)
• fix: preserve blob worker sources under Cloudflare CSP (c2ea784)

Other changes

• docs: record the frame whitelist header mismatch as a known limit (B20) (5fe294a)
• chore: name the reasons for the last bundle-baseline raises (8b6c882)
• docs: bug list from the audit of 2026-11-12 (883a78f)

Full changelog: v0.6.1...v0.6.2

noleaker v0.6.1

Other changes

• Add German interface translation (f4fec6b)
• Add Portuguese and Traditional Chinese interface translations (b9b05f9)

Full changelog: v0.6.0...v0.6.1

noleaker v0.6.0

Fixes

• Firefox: when the proxy is down, traffic no longer falls back to Firefox's own proxy setting. It stays blocked. (#2)

Changes

• Exit check: when Cloudflare and ipwho.is report different exits, the exit is marked uncertain instead of trusting either one. A lookup that would go out directly is skipped.
• Captcha frames: in Strict mode, captcha frames get the same neutral startup state as pages. Compatibility mode leaves them untouched, so captchas keep working there.
• Build tools updated to clear npm audit's critical and high advisories. This does not change the extension's own code.

Full changelog: v0.5.2...v0.6.0

noleaker v0.5.2

Fixes

• fix(content): captcha frames skip the startup state so Turnstile stops looping (f788eac)

Full changelog: v0.5.1...v0.5.2

noleaker v0.5.1

Fixes

• fix(exit): trust ipwho.is when a VPN routes Cloudflare outside the tunnel (a2abccf)

Other changes

• docs: link the leak test on the website (1e104e3)
• chore: point at the v2macapp GitHub organization (d3ab575)

Full changelog: v0.5.0...v0.5.1

noleaker v0.5.0

Features

• feat: system VPN/TUN connection mode (66cef6f)

Fixes

• fix(popup): honest VPN-mode status when the exit check fails (f8ccd55)
• fix: in system VPN mode, always follow a changed exit (4dd29ab)

Full changelog: v0.4.0...v0.5.0

noleaker v0.4.0

Features

• feat(i18n): Persian (RTL), Chinese, Russian, French and Spanish UI with a language picker (d036496)
• feat(popup): explain the audit and give the right fix for each failed check (ed8dcf8)
• feat(options): move Privacy mode into Protection and match the other cards (4c63a77)

Fixes

• fix(content): a page could learn the private event name and forge the spoof config (2f300f3)
• fix(background): no lost state writes, one check per proxy-error burst, prune tab reloads (dc8f567)
• fix(fonts): patch font setters where newer engines define them (CSSStyleProperties) (7b4d753)

Other changes

• ci: give the Chrome e2e the chromedriver that matches Chrome for Testing (74cbb28)
• ci: install Chrome for Testing explicitly for the Chrome e2e (4d53698)
• test(e2e): read the Chrome extension ID from the profile; give the PAC snapshot test CI headroom (e56b4c2)
• ci: run the Chrome e2e (Chrome for Testing) next to the Firefox one (ffedb62)
• test(e2e): fix Chrome e2e types (ca7a6e8)
• test(e2e): Chrome end-to-end tests (WebRTC, kill switch, toggle during a health check) (0a970f0)
• test(e2e): show state, log and direct hits when the Firefox kill switch times out (d8ce7c1)
• test(stale): closing a tab clears its reloads; concurrent navigations keep both entries (ae3252a)

Full changelog: v0.3.2...v0.4.0

noleaker v0.3.2

Fixes

• fix(firefox): use DNR resource types Firefox accepts (f2f4927)

Other changes

• test(e2e): print extension state and log when verification times out (534e971)

Full changelog: v0.3.1...v0.3.2

noleaker v0.3.1

Fixes

• fix(e2e): grant system access through geckodriver, not a Firefox argument (8199c06)

Full changelog: v0.3.0...v0.3.1

noleaker v0.3.0

Fixes

• fix(e2e): start Firefox with system access so WebDriver can open moz-extension pages (6a9fc14)
• fix(firefox): require Firefox for Android 142 for data_collection_permissions (59e0230)

Other changes

• chore: add release script; changelog shared by script and workflow (c910fd3)
• ci: write a grouped changelog into release notes (ff26cae)

Full changelog: v0.2.1...v0.3.0