Skip to content

v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@xzyonline xzyonline released this 17 Aug 13:16
· 4 commits to main since this release
v0.3.0
758febd

Release notes

Security

  • Zip-bomb defense: decompressed byte totals are re-checked against the actual output; documents exceeding 256 MB are rejected (FILE_TOO_LARGE).
  • Secret redaction extended to six previously missed forms: PGP/OpenSSH private-key PEM blocks, _authToken/authToken, stripe_key/openai_key, DATABASE_URL, export KEY=value lines, and passwordHash (camelCase).

Encoding

  • GB18030/GBK decoding for Chinese text files, including 4-byte sequences (¥ etc.); random high-byte streams are rejected by a byte-level heuristic.
  • ZIP entry names decode as UTF-8 when GPB bit 11 is set, else GB18030 with CP437 fallback.

Performance

  • pdfjs-dist loaded on demand (legacy/pdf.min.mjs, 512 KB); non-PDF operations no longer pay PDF module startup cost.
  • Parse results cached (LRU, 16 entries / 8 MB) with in-flight deduplication; cache keys are safe because storage is content-addressed.

Windows

  • install.ps1 one-click installer (parameterized, idempotent; detects Node.js ≥ 20 and pnpm/npm).
  • TAR_NOT_FOUND error with install guidance when bsdtar is absent; ZIP archives fall back to in-process parsing.
  • Filename sanitization rejects Windows reserved characters and device names (CON, PRN, COM1-9, …).
  • .gitattributes enforces CRLF checkout for .bat/.cmd/.ps1.
  • Walkthrough: docs/WINDOWS-INSTALL.zh.md.

Quality

  • Tests: 173 → 194 (vitest), tsc --noEmit clean.
  • Formats: PDF, DOCX, XLSX, PPTX, legacy .doc/.xls, RTF, ODF, EPUB, ZIP/7z/RAR listing, HTML/XML/SVG, and plain text.

Assets

  • install.ps1 — Windows installer.
  • SHA256SUMS.txt — checksums.
  • Source archives are GitHub-generated (below the asset list).

References

Security policy: SECURITY.md. Third-party notices: THIRD_PARTY_NOTICES.md.

Assets 6
Loading