plainhub/plain-app v3.3.22

Release 3.3.22

on GitHub

What's Changed

Service & Permissions

• First-run permission wizard for starting the service: step-by-step guidance for notification and storage permissions, with clearer wording and no silent auto-start when required permissions are missing

Feeds

• New first-run discovery mode: browse the built-in feed catalog right on the Feeds page and subscribe with a per-feed button — no page switching, then tap "Start reading" when ready. Deleting your last feed returns to discovery mode
• Fixed the top bar getting stuck (unable to expand) after swiping to another article in the pager
• "Load full content" button now only appears for feeds that serve summaries

Web Client

• Fixed chunked upload file ID collisions that could corrupt uploaded files; the app now also verifies total chunk size before merging

Security

• File responses now include Content-Security-Policy: sandbox and X-Content-Type-Options: nosniff, blocking stored XSS via SVG/HTML files in /fs and guest shares
• Removed trust in client-supplied Forwarded headers: the /shutdown loopback guard, login rate limiting, and the DLNA allowlist now key on the real socket IP and cannot be spoofed

Security

VirusTotal Scan

SLSA Provenance (Level 3)

The .intoto.jsonl file is a signed SLSA provenance document covering all release artifacts (APKs + AAB).
Verify with slsa-verifier:

slsa-verifier verify-artifact PlainApp-3.3.22-64bit-Recommended.apk \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/plainhub/plain-app