release(mobile): Release v0.5.8 - #5067
Merged
Merged
Conversation
* release(mobile): release v0.5.6 * docs(mobile): restore desktop release inputs * fix(desktop): use js-yaml ESM exports * fix(desktop): package jsdom runtime dependencies * fix(desktop): use js-yaml ESM exports for Windows metadata * build(deps): bump actions/setup-node from 6 to 7 (#5046) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(ssr): escape hydration data in inline scripts * fix(ssr): restore shared user profiles * fix: make Codex worktree setup portable * fix(mobile): restore dark mode text colors * fix(styles): avoid DaisyUI border token collision * fix(desktop): restore category chevron rotation * fix(subscription): recover past-due Stripe checkout * fix(desktop): dismiss share popover after actions * fix(mobile): handle RSSHub subscription limit errors * fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056) The 'integration.openURLScheme' IPC method invokes 'shell.openExternal' with a renderer-supplied string after only checking that it contains '://'. Electron's documentation explicitly warns that passing untrusted URLs to 'shell.openExternal' is unsafe: schemes such as 'file://', 'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:', 'data:' and 'vbscript:' have well-known abuse chains (local file disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style RCE, etc.). Because the renderer process can also reach this IPC via any XSS sink in untrusted RSS feed content, the previous validation was not sufficient. Replace the substring check with strict URL parsing plus an allowlist of protocols that match the integration use-cases documented in the UI (Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic http/https/mailto. All other protocols are rejected with a clear error. Adds vitest cases for representative dangerous schemes (verifying that 'shell.openExternal' is never invoked) and for every scheme shipped as a built-in example, so future regressions on either side are caught. * chore(ci): format integration URL scheme test * fix(mobile): use product IDs for Apple IAP verification * docs(desktop): prepare release inputs * docs(mobile): prepare release metadata * release(desktop): release v1.12.0 * docs(desktop): restore mobile release inputs --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sebastion <sebastion@sebastion.dev>
chore(sync): merge main into dev
chore(sync): merge mobile-main into dev
chore(sync): merge mobile-main into dev
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.5.8