Note
FreeBSD aarch64 is dropped from this release. We had to cut releases, and we cannot build this target within the 5-hour CI limit for any of the Craft apps, so we are dropping it for now. This is a known blocker, flagged for a future fix in storytold/craft-common-actions#39. FreeBSD x86_64 and every other platform are included.
What's Changed
- fix(windows): retry busy download renames and log Windows Installer runs by @benandez in #687
- security: enforce HTTPS on curl downloads (SonarCloud S6506) by @dylanmtaylor in #746
- ci: pin GitHub Actions to full commit SHA (SonarCloud S7637) by @dylanmtaylor in #745
- README: the app icon above the title by @bflatastic in #759
- fix(windows): read a portable app's version without starting PowerShell by @dotCooCoo in #743
- security: confine release/feed download URLs and bind installed artifact version by @dylanmtaylor in #747
- Use jiff instead of hand-rolled UTC conversion by @dylanmtaylor in #726
- security: reject shell metacharacters in opened web links (WSL cmd.exe injection) by @dylanmtaylor in #751
- fix(windows): self-update runs no PowerShell and installs only files signed like the launcher by @dotCooCoo in #742
- security: bound decoded feed size, screenshot dimensions, and locale tag matching by @dylanmtaylor in #748
- security: harden local install and packaging against filesystem attacks by @dylanmtaylor in #749
- security: authenticate single-instance replace and bound the local mirror server by @dylanmtaylor in #750
New Contributors
- @benandez made their first contribution in #687
- @dotCooCoo made their first contribution in #743
Full Changelog: v0.6.1...v0.7.0