joeyr
released this
2026-07-19 10:32:13 -05:00
| 46 commits to main since this release
Changed
- All three windows now run with the full Chromium sandbox (
sandbox: true). The preload script is bundled by Vite (vite.preload.config.mts) into a single self-contained CJS file whose only runtime require is 'electron', which is what a sandboxed preload permits — previously it was tsc-compiled with an on-disk require of the shared IPC contract, forcing sandbox: false. No behavior change; renderer + preload now run fully sandboxed as defense-in-depth on top of the existing contextIsolation/CSP boundary.
- In-window navigation is now blocked (
will-navigate hardening). The renderer never legitimately navigates, so any attempt is denied and logged; opening the update notice in the browser is unaffected. Dev-server reloads under npm run dev stay allowed.
BRIDGE_VERSION no longer needs a manual bump on release — the Vite preload bundle inlines it from package.json the same way the renderer's version badge is inlined.
Downloads