Adds @electron-forge/maker-deb so `electron-forge make` on Linux emits a
.deb next to the existing AppImage.
- forge.config: MakerDeb scoped to linux; `bin` pinned to packagerConfig.name
so the staging build ("Folo Staging") also resolves; folo:// and follow://
registered as x-scheme-handler MIME types; Network;News; categories.
- postMake: .deb is renamed to the Folo-<version>-linux-<arch>.deb convention
but kept out of latest-linux.yml (the electron-updater feed is AppImage-only).
- CI: install fakeroot/dpkg on the Linux leg; upload the .deb as its own
`linux-x64-deb` artifact; add *.deb to the attestation and release globs.
- pnpm-lock.yaml regenerated with the pinned pnpm@10.17.0. The large churn is
peer-key reserialization from a newer pnpm than last wrote the lockfile;
the only functional additions are maker-deb and its electron-installer-debian
subtree.
Claude-Session: https://claude.ai/code/session_01KeQJNfE1FfJnLMH9psG1jS
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* release(desktop): release v1.11.0
* docs(desktop): restore mobile release inputs
* fix(desktop): use js-yaml ESM exports
* fix(desktop): use js-yaml ESM exports
* fix(desktop): package jsdom runtime dependencies
* fix(desktop): package jsdom runtime dependencies
* fix(desktop): use js-yaml ESM exports for Windows metadata
* build(deps): bump actions/setup-node from 6 to 7 (#5046)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(ssr): escape hydration data in inline scripts
* fix(ssr): restore shared user profiles
* fix: make Codex worktree setup portable
* fix(mobile): restore dark mode text colors
* fix(styles): avoid DaisyUI border token collision
* fix(desktop): restore category chevron rotation
* fix(subscription): recover past-due Stripe checkout
* fix(desktop): dismiss share popover after actions
* fix(mobile): handle RSSHub subscription limit errors
* fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056)
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
* chore(ci): format integration URL scheme test
* fix(mobile): use product IDs for Apple IAP verification
* docs(desktop): prepare release inputs
* docs(mobile): prepare release metadata
* release(mobile): release v0.5.7
* docs(mobile): restore desktop release inputs
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sebastion <sebastion@sebastion.dev>
* release(mobile): release v0.5.6
* docs(mobile): restore desktop release inputs
* fix(desktop): use js-yaml ESM exports
* fix(desktop): package jsdom runtime dependencies
* fix(desktop): use js-yaml ESM exports for Windows metadata
* build(deps): bump actions/setup-node from 6 to 7 (#5046)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(ssr): escape hydration data in inline scripts
* fix(ssr): restore shared user profiles
* fix: make Codex worktree setup portable
* fix(mobile): restore dark mode text colors
* fix(styles): avoid DaisyUI border token collision
* fix(desktop): restore category chevron rotation
* fix(subscription): recover past-due Stripe checkout
* fix(desktop): dismiss share popover after actions
* fix(mobile): handle RSSHub subscription limit errors
* fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056)
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
* chore(ci): format integration URL scheme test
* fix(mobile): use product IDs for Apple IAP verification
* docs(desktop): prepare release inputs
* docs(mobile): prepare release metadata
* release(desktop): release v1.12.0
* docs(desktop): restore mobile release inputs
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sebastion <sebastion@sebastion.dev>
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
DIYgod