patrickjaja/claude-desktop-extra v2.110.0-2

Claude Desktop 2.110.0 (patch release 2)

on GitHub

Claude Desktop 2.110.0 (patch release 2)

This release provides Claude Desktop version 2.110.0 pre-patched for Linux.

Installation Options

Arch Linux (pacman Repository - recommended)

curl -fsSL https://patrickjaja.github.io/claude-desktop-extra/install-pacman.sh | sudo bash
sudo pacman -Syu claude-desktop-extra

Arch Linux (manual package)

# x86_64
sudo pacman -U https://github.com/patrickjaja/claude-desktop-extra/releases/download/v2.110.0-2/claude-desktop-extra-2.110.0-2-x86_64.pkg.tar.zst
# ARM64
sudo pacman -U https://github.com/patrickjaja/claude-desktop-extra/releases/download/v2.110.0-2/claude-desktop-extra-2.110.0-2-aarch64.pkg.tar.zst

Debian/Ubuntu (APT Repository — recommended)

curl -fsSL https://patrickjaja.github.io/claude-desktop-extra/install.sh | sudo bash
sudo apt install claude-desktop-extra

Debian/Ubuntu (manual .deb)

# x86_64
sudo apt install ./claude-desktop-extra_2.110.0-2_amd64.deb
# ARM64
sudo apt install ./claude-desktop-extra_2.110.0-2_arm64.deb

Fedora/RHEL (RPM Repository — recommended)

curl -fsSL https://patrickjaja.github.io/claude-desktop-extra/install-rpm.sh | sudo bash
sudo dnf install claude-desktop-extra

Fedora/RHEL (manual .rpm)

# x86_64
sudo dnf install ./claude-desktop-extra-2.110.0-2.x86_64.rpm
# ARM64
sudo dnf install ./claude-desktop-extra-2.110.0-2.aarch64.rpm

NixOS / Nix

nix run github:patrickjaja/claude-desktop-extra

AppImage (Any Distro)

# x86_64
chmod +x Claude_Desktop-2.110.0-x86_64.AppImage
./Claude_Desktop-2.110.0-x86_64.AppImage
# ARM64
chmod +x Claude_Desktop-2.110.0-aarch64.AppImage
./Claude_Desktop-2.110.0-aarch64.AppImage

Update existing AppImage (delta download — only changed blocks):

appimageupdatetool Claude_Desktop-*-x86_64.AppImage
# Or from within the AppImage:
./Claude_Desktop-*-x86_64.AppImage --appimage-update

Checksums

Changes since last release

From CHANGELOG.md, 2026-09-16:

Extra settings: the IPC sender guard now checks the origin, not just the scheme

__cdbEx_okSender in js/extra_settings_main.js accepted the main frame of any http(s)://
webContents. Every other main-process module (panel tabs, files quick-open, window controls, diff
views) compares the parsed origin against an exact allowlist, and the Extra handlers are the ones that
matter most: cdb-deploy:set / cdb-deploy:save-raw write the 3P gateway URL, its API key and the
bootstrap URL, and cdb-app:relaunch restarts the app. Reaching them needed a page from another origin
to end up in the main frame of a webContents that carries the cdbExtra preload, so the practical
exposure was small, but the guard was weaker than its siblings for no reason.

• The guard now uses the same ALLOWED_ORIGINS list and parsed-origin comparison as the sibling
  modules. https://evil.example, https://claude.ai.evil.example, http://claude.ai,
  https://claude.ai:8443 and https://user@claude.ai@evil.example are all rejected; the four real
  origins still pass. An unparseable URL or a sender without isDestroyed() fails closed.
• scripts/tests/core/test-deployment-main.mjs now proves it: nine foreign https origins are refused
  by cdb-deploy:set and cdb-app:relaunch and nothing lands on disk. Before the change the same
  harness showed a foreign sender successfully writing inferenceGatewayBaseUrl.
• The dom-ready page injection is unchanged: it still runs on every non-localhost http(s) document,
  because it is not a security boundary (the page script only mounts the panel on claude.ai and
  every IPC call re-validates the sender).

The four origins are the right contract, not a guess: upstream's own eIPC sender validator enforces
exactly the same production set. Third-party inference is unaffected - in 3P mode the main window
loads app://localhost, which our http(s)-only injection gate has always skipped, so the Extra panel
never mounted there in the first place.

Contributed by Mike Gordievsky (@mike-the-enginer) in
#249 - thanks!

Links

• Full Changelog