AnInsomniacy/motrix-next v3.5.0-beta.6

v3.5.0-beta.6 — Security & Stability Hardening

on GitHub

What's Changed

This release focuses on security hardening and stability improvements across the application, addressing issues identified through a comprehensive code review audit.

🛠 Improvements

• Autostart log privacy — Replaced raw argv logging with structured, redacted diagnostic fields (matched_exact, matched_prefixed, other_arg_count). The default log level is Debug, so raw argv would have leaked deep-link URLs and local paths into user-submitted diagnostic ZIPs.
• Engine port cleanup — Added u16 port validation at entry and replaced shell-interpolated commands (sh -c) with direct process invocations (lsof, ps, kill) on Unix, eliminating the shell injection surface.
• Release pipeline integrity — release.sh now runs a full pre-release verification gate (format check, type check, unit tests for both frontend and backend) before committing, tagging, or pushing.
• Update check timing — lastCheckUpdateTime is now written only on successful update checks, preventing failed checks from suppressing subsequent automatic checks for up to 24 hours.
• Cross-platform scripts — bump-version.sh now detects $OSTYPE to use the correct sed -i syntax on both macOS (BSD) and Linux (GNU).

🐛 Bug Fixes

• Fixed HistoryStore permanently losing database connectivity when both initial load and rebuild failed — initPromise is now reset on rebuild failure, allowing subsequent retry.

📦 Downloads