Skip to content

Commit 48ce50d

Browse files
DIYgoddependabot[bot]sebastionoss
authored
release(mobile): Release v0.5.7 (#5061)
* release(desktop): release v1.11.0 * docs(desktop): restore mobile release inputs * fix(desktop): use js-yaml ESM exports * fix(desktop): use js-yaml ESM exports * fix(desktop): package jsdom runtime dependencies * fix(desktop): package jsdom runtime dependencies * fix(desktop): use js-yaml ESM exports for Windows metadata * build(deps): bump actions/setup-node from 6 to 7 (#5046) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(ssr): escape hydration data in inline scripts * fix(ssr): restore shared user profiles * fix: make Codex worktree setup portable * fix(mobile): restore dark mode text colors * fix(styles): avoid DaisyUI border token collision * fix(desktop): restore category chevron rotation * fix(subscription): recover past-due Stripe checkout * fix(desktop): dismiss share popover after actions * fix(mobile): handle RSSHub subscription limit errors * fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056) The 'integration.openURLScheme' IPC method invokes 'shell.openExternal' with a renderer-supplied string after only checking that it contains '://'. Electron's documentation explicitly warns that passing untrusted URLs to 'shell.openExternal' is unsafe: schemes such as 'file://', 'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:', 'data:' and 'vbscript:' have well-known abuse chains (local file disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style RCE, etc.). Because the renderer process can also reach this IPC via any XSS sink in untrusted RSS feed content, the previous validation was not sufficient. Replace the substring check with strict URL parsing plus an allowlist of protocols that match the integration use-cases documented in the UI (Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic http/https/mailto. All other protocols are rejected with a clear error. Adds vitest cases for representative dangerous schemes (verifying that 'shell.openExternal' is never invoked) and for every scheme shipped as a built-in example, so future regressions on either side are caught. * chore(ci): format integration URL scheme test * fix(mobile): use product IDs for Apple IAP verification * docs(desktop): prepare release inputs * docs(mobile): prepare release metadata * release(mobile): release v0.5.7 * docs(mobile): restore desktop release inputs --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sebastion <sebastion@sebastion.dev>
2 parents 8f74719 + 376e6e0 commit 48ce50d

67 files changed

Lines changed: 1306 additions & 169 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codex/environments/environment.toml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# THIS IS AUTOGENERATED. DO NOT EDIT MANUALLY
2+
version = 1
3+
name = "Folo"
4+
5+
[setup]
6+
script = '''
7+
pnpm i
8+
'''
9+
10+
[[actions]]
11+
name = "web dev"
12+
icon = "run"
13+
command = "pnpm dev:web"
14+
15+
[[actions]]
16+
name = "electron dev"
17+
icon = "run"
18+
command = '''
19+
cd apps/desktop
20+
pnpm dev:electron
21+
'''
22+
23+
[[actions]]
24+
name = "ios dev"
25+
icon = "run"
26+
command = '''
27+
cd apps/mobile
28+
pnpm ios
29+
'''
30+
31+
[[actions]]
32+
name = "android dev"
33+
icon = "run"
34+
command = '''
35+
cd apps/mobile
36+
pnpm android
37+
'''

‎.github/workflows/build-android.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
uses: pnpm/action-setup@v6
5858

5959
- name: 🏗 Setup Node.js
60-
uses: actions/setup-node@v6
60+
uses: actions/setup-node@v7
6161
with:
6262
node-version: 22
6363
cache: "pnpm"

‎.github/workflows/build-desktop.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ jobs:
8383
uses: pnpm/action-setup@v6
8484

8585
- name: Use Node.js
86-
uses: actions/setup-node@v6
86+
uses: actions/setup-node@v7
8787
with:
8888
node-version: 22
8989
cache: "pnpm"
@@ -407,7 +407,7 @@ jobs:
407407
uses: pnpm/action-setup@v6
408408

409409
- name: Use Node.js
410-
uses: actions/setup-node@v6
410+
uses: actions/setup-node@v7
411411
with:
412412
node-version: 22
413413
cache: "pnpm"

‎.github/workflows/build-ios-development.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ jobs:
9797
uses: pnpm/action-setup@v6
9898

9999
- name: 🏗 Setup Node.js
100-
uses: actions/setup-node@v6
100+
uses: actions/setup-node@v7
101101
with:
102102
node-version: 22
103103
cache: "pnpm"
@@ -148,7 +148,7 @@ jobs:
148148
uses: pnpm/action-setup@v6
149149

150150
- name: 🏗 Setup Node.js
151-
uses: actions/setup-node@v6
151+
uses: actions/setup-node@v7
152152
with:
153153
node-version: 22
154154
cache: "pnpm"

‎.github/workflows/build-ios.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ jobs:
117117
uses: pnpm/action-setup@v6
118118

119119
- name: 🏗 Setup Node.js
120-
uses: actions/setup-node@v6
120+
uses: actions/setup-node@v7
121121
with:
122122
node-version: 22
123123
cache: "pnpm"

‎.github/workflows/build-web.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
- uses: pnpm/action-setup@v6
3535

3636
- name: Use Node.js ${{ matrix.node-version }}
37-
uses: actions/setup-node@v6
37+
uses: actions/setup-node@v7
3838
with:
3939
node-version: ${{ matrix.node-version }}
4040
cache: "pnpm"

‎.github/workflows/deploy-cloudflare-desktop.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
- uses: pnpm/action-setup@v6
3636

3737
- name: Use Node.js LTS
38-
uses: actions/setup-node@v6
38+
uses: actions/setup-node@v7
3939
with:
4040
node-version: lts/*
4141
cache: "pnpm"

‎.github/workflows/deploy-cloudflare-landing.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
- uses: pnpm/action-setup@v6
4040

4141
- name: Use Node.js LTS
42-
uses: actions/setup-node@v6
42+
uses: actions/setup-node@v7
4343
with:
4444
node-version: lts/*
4545
cache: "pnpm"

‎.github/workflows/deploy-cloudflare-ssr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
- uses: pnpm/action-setup@v6
4343

4444
- name: Use Node.js LTS
45-
uses: actions/setup-node@v6
45+
uses: actions/setup-node@v7
4646
with:
4747
node-version: lts/*
4848
cache: "pnpm"

‎.github/workflows/lint.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
- uses: pnpm/action-setup@v6
4040

4141
- name: Use Node.js ${{ matrix.node-version }}
42-
uses: actions/setup-node@v6
42+
uses: actions/setup-node@v7
4343
with:
4444
node-version: ${{ matrix.node-version }}
4545
cache: "pnpm"

0 commit comments

Comments
 (0)