jchultarsky/mirador v0.5.0

0.5.0 - 2026-07-26

on GitHub

Release Notes

Fifteen items from an adversarial review of the whole project, worked in order
of how much each could cost someone.

Upgrading: two changes can stop a config that used to start. A misspelled
key under [theme] is now an error rather than being silently ignored, and an
absurd [weather].refresh_minutes or [stocks].refresh_secs is rejected rather
than wrapping. Both report the key and how to fix it. If your config was written
before 0.1.0, mirador --migrate-config will update it.

Fixed

• Esc no longer quits the dashboard. It was in the global quit arm, so the
  reflex that closes a dialog closed the program — and any unsaved note went
  with it.
• A long note can be scrolled to its end. The body scrolled against its
  unwrapped line count, so wrapping hid the tail.
• Ctrl+S and Enter save from either field of a form, not just the one
  the cursor happened to be in.
• Removing a symbol from the watchlist reports a failed save instead of
  dropping the error.
• The weather and stocks pollers stop when their panel goes away. Neither
  loop had an exit, and the panel picker rebuilds every panel on every toggle,
  so a few passes over it left several threads polling the same endpoints —
  multiplying a request rate that CLAUDE.md claimed was enforced in code.
  Measured: 3 threads at rest, 3 after ten toggles.
• mirador no longer panics at startup on Windows on a machine up for less
  than a day. Instant there counts from boot, so back-dating one by 24 hours
  returned None and the unwrap fired before the terminal existed.
• A preference can be un-set again. Switching temperature units to metric
  and back left the state file insisting on metric, permanently. The comparison
  that decides what to record now happens once, against the config as it was
  read, rather than in each panel against the value it was built with.
• ? scrolls. With the tasks panel focused on an 80x24 terminal the overlay
  had 29 rows of content and 22 rows to draw it in, so nine of that panel's
  seventeen key bindings — including /, e, p, s and c — were invisible,
  with nothing on screen to say so. Arrow keys, PgUp/PgDn, Home and End
  scroll it, and the footer shows where you are. On a terminal with room to spare
  nothing changes: any key still closes it.
• A long task title no longer draws over the panel border. Titles were
  truncated by counting characters against a budget measured in terminal cells,
  so every CJK character or emoji overflowed by one cell.
• A misspelled key under [theme] is now reported rather than accepted and
  ignored. This also un-blocked the --migrate-config hint for the pre-0.1.0
  rx and tx theme keys, which could never fire because those keys parsed
  cleanly.
• The weather panel recovers from a failure to look up your location. It used
  to end its fetch thread, then go on offering "r to retry" with nothing left to
  act on the key — most often after a laptop resumed before its Wi-Fi did.
• A failed price fetch keeps the last price and labels it with its age. One
  timed-out request used to blank the price, the change, the percentage and the
  sparkline together for a whole refresh interval; a fetch thread that stopped
  quietly showed confident numbers indefinitely. A retained price is now shown
  muted, with how old it is.
• Panel rectangles are indexed consistently, so a layout entry that builds no
  panel cannot shift every later panel onto its neighbour's rectangle — which is
  what mouse clicks are matched against.
• A wide terminal no longer parks the whole row on one panel. Past the point
  where a row's panels have all reached their useful maximum, the surplus was
  handed to whichever panel happened to be uncapped last. At 400 columns that
  gave the clock 302 of them — about 145 of which were blank, since its numerals
  stop growing at 158 — while the weather panel beside it sat at 51. The excess
  is now shared across the row.
• The network panel's SESSION totals are the session. They were the
  machine's since-boot counters, so on a laptop up three weeks the panel read
  128 GB within a minute of launch.
• Holding r on the watchlist can no longer outrun the one-minute floor.
  The limit was applied to the polling interval, and r bypassed the wait
  entirely — 8 requests in 2 seconds against a source that blocks by IP address.
• An absurd refresh_minutes or refresh_secs is rejected instead of wrapping
  into a tight loop against a free API.
• Panel width changes made with Ctrl+arrow are saved shortly after you stop,
  rather than only on a clean exit — closing the terminal window used to lose
  them.

Changed

• mirador redraws when something changes, rather than when a timer fires.
  Measured on the default layout at 400x100: 243 redraws a minute before, 62
  after — and before, the number was the same whether show_seconds was on or
  off, so turning seconds off changed what was on screen and not what the
  program ran. Battery life on a dashboard you leave open all day is the point.
• Every file mirador writes — including your config — now goes through one
  atomic write that flushes to the disk before replacing the original. The
  config was previously overwritten in place.
• The README leads with what mirador is for rather than with a feature
  comparison, and says plainly what using Yahoo's undocumented chart endpoint
  does and does not mean for you.

Security

• Release artifacts carry GitHub build provenance attestations, and the shipped
  binaries embed their dependency list so cargo audit bin can check them.
• main requires all eight CI jobs, including Windows and a cargo-deny supply
  chain check. CI actions are pinned by commit rather than by tag.
• Documented honestly what the one-line installers verify — the shell one checks
  the archive's sha256, the PowerShell one checks nothing, and neither checks
  the updater. See SECURITY.md.
• Private vulnerability reporting is enabled, which the security policy had been
  pointing people at while it was switched off.

Install mirador 0.5.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/jchultarsky/mirador/releases/download/v0.5.0/mirador-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/jchultarsky/mirador/releases/download/v0.5.0/mirador-installer.ps1 | iex"

Download mirador 0.5.0

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo jchultarsky/mirador

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>