P-Adamiec/Free-Games-Claimer-Remaster v1.2

on GitHub

Added

• Dynamic Docker Image Tagging (FGC_TAG) – added support for specifying ${FGC_TAG:-latest} in docker-compose.yml, allowing users to effortlessly switch between stable (latest) and experimental (dev) builds via their .env file without modifying Compose configurations.
• Dependabot maintenance automation - added weekly update checks for Python packages, GitHub Actions, and Docker images with grouped dependency PRs.
• Dependency Check workflow - added CI coverage for dependency review, pip check, Python source compilation, pip-audit, and Docker image build validation.
• URL host validation helper (src/core/url_security.py) - centralized strict HTTPS hostname checks for store redirects and login detection.
• Daily time-based scheduler - added optional daily run times via SCHEDULER_FIXED_TIMES (for example 17:00,21:30) in addition to the existing interval scheduler.
• Scheduler timezone support - added SCHEDULER_TIMEZONE for daily time-based runs.

Changed

• Dependency updates - bumped apprise to >=1.11.0, tenacity to >=9.1.4, APScheduler to >=3.11.2, pyotp to >=2.10.0, and rich to >=15.0.0.
• GitHub Actions updates - upgraded actions/checkout usage to v7 in Docker and dependency workflows.
• Epic checkout flow hardening - after clicking Get, the claimer now verifies whether Epic moved to success, checkout iframe, add-to-library, place-order, or continue states before proceeding.
• Epic button targeting - improved visible/enabled button detection and click coordinate validation to avoid hitting hidden, disabled, or covered checkout controls.
• Scheduler backward compatibility - kept existing SCHEDULER_HOURS interval scheduling unchanged.

Fixed

• Amazon Prime Gaming / Luna sign-in and passkey loops – replaced the patched WebAuthn API call block with direct DOM button evaluation that selects the Sign-In button while explicitly filtering out "Sign in with a passkey" elements to prevent automation loops. Also added automatic handling for Amazon's "Switch accounts" screen to select the profile matching PG_EMAIL or click "Add account" if missing.
• GOG VNC notification URL - GOG 2FA prompts now use the configured VNC_IP and NOVNC_PORT instead of a hardcoded localhost link.
• Store login redirect checks - Steam, Epic, GOG, and GamerPower now use parsed hostnames instead of brittle substring checks when validating trusted store URLs.

Security

• CodeQL URL validation alerts - replaced unsafe URL substring host checks with strict parsed hostname validation, including controlled subdomain allowance where required.