Improvements
- Added CSRF protection for session-authenticated API requests.
- Passkey authentication now uses explicit trusted origins.
- Updated authentication dependencies and bundled Shoutrrr to 0.23.0.
Fixes
- Task progress and completion updates now stay synchronized across views without exhausting browser connection limits.
- Tasks that finish during a connection interruption are correctly reconciled when live updates reconnect.
Note
Reverse proxies must preserve the browser’s Origin and Sec-Fetch-Site headers. If you access Zerobyte through additional addresses, add their complete origins to TRUSTED_ORIGINS. BASE_URL is trusted automatically. API key authentication remains exempt from CSRF checks.
Warning
Desktop apps remain in alpha and are not yet officially supported. Please report any issues you encounter.
The Windows installer is currently unsigned. On Linux, make the AppImage executable before launching it: chmod +x zerobyte*.AppImage.