0.1.57 (2026-08-31)
Bug Fixes
- gui: show a real window when the frontend fails to load instead of transparent text (68e2def)
- gui: unmount on SIGTERM and report when a second launch defers to a running instance (9daf923)
- security: create config.yaml and the IPC socket owner-only (9a72197)
- security: inline server icons as data URIs so the CSP needs no remote img-src (c6d2166)
- security: pin server-supplied icons and thumbnails to the configured origin (ca5091a)
- security: reject WebDAV hrefs containing parent-directory segments (78c65b7)
- security: restrict open_link to web schemes and drop non-web search URLs (25c2190)
- security: set a Content-Security-Policy for the webview (84c93c1)
- security: validate server-advertised notify_push endpoints before sending credentials (39e5dbe)
Performance Improvements
- cache: cut idle RSS from 610MB to 150MB by flattening dir cache entries (57b2d77)