Skip to content

CHANGELOG.md

Latest commit

 

History

History
130 lines (110 loc) · 6.64 KB

CHANGELOG.md

File metadata and controls

130 lines (110 loc) · 6.64 KB
Raw

Changelog

All notable changes to Coontext are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

While the major version is 0.x, every minor bump is allowed to break backward compatibility — read the release notes carefully.

Unreleased

Added

  • Localization (i18n) — English (default) and Spanish, with system-locale detection on first launch and a manual override in Settings → Language. Architecture is a typed Strings struct with compile-time correctness so missing translations are compiler errors, not runtime panics. Adding a new language is two const tables and one match arm.
  • CodeQL SAST workflow for static application security testing on every push and pull request. Covers the rust and actions languages; the Rust extractor is gated behind continue-on-error since it's still in beta upstream.
  • OSV-Scanner vulnerability scanning in CI alongside the existing cargo-audit and cargo-deny. Results are uploaded as SARIF and surface in the repository's Security → Code scanning tab.
  • Dependabot configuration for automated dependency updates (cargo + GitHub Actions), with the iced, tokio, and serde families grouped so their updates arrive as single reviewable PRs.
  • Issue templates (bug report, feature request) and pull request template for clearer contributions. Blank issues are disabled; security reports route to the private advisory flow via the contact_links section.
  • SECURITY.md with the vulnerability disclosure policy.
  • CODE_OF_CONDUCT.md adopting Contributor Covenant 2.1 by reference, with reports routed to adriandomc@gmail.com.
  • ROADMAP.md with the milestone plan from v0.1.0 toward v1.0.0.
  • README.md status section — honest alpha disclaimer, platform coverage matrix, pointers to CHANGELOG, ROADMAP, CONTRIBUTING, SECURITY, and CODE_OF_CONDUCT. Added status badges at the top for CI, CodeQL, latest release, license, and Rust edition.
  • Five new unit tests for the editor widget's height-fill behavior.

Changed

  • Dependency bumps — caught up on the first batch of Dependabot suggestions:
    • tokio 1.40 → 1.51.1 (upstream bugfixes in semaphore and UDP socket error handling)
    • thiserror 1.0 → 2.0 (derive macro API unchanged for our usage; note that iced 0.13.1 still pulls in thiserror 1.0.69 transitively, so the lockfile now contains both majors)
    • directories 5.0 → 6.0 (no API changes for ProjectDirs::from)
    • dark-light 1.1 → 2.0 (detect() now returns Result<Mode, _>; Mode::Default was replaced with Mode::Unspecified. Adapted src/app/theme.rs to match, preserving the "default to dark" behavior)
    • rfd 0.14 → 0.17 (no API changes for AsyncFileDialog; migrated transitively from objc to objc2-*)
    • GitHub Actions: actions/checkout@v4 → v6, actions/cache@v4 → v5, actions/upload-artifact@v4 → v7, actions/download-artifact@v4 → v8, github/codeql-action@v3 → v4 (mostly Node.js 24 runtime upgrades ahead of the Node 20 deprecation in June 2026)

Known outdated dependencies (held for v0.2.0)

Three Dependabot bumps were deferred because they touch runtime-critical code (file watching, tray menu, keyboard shortcuts) that needs to be validated on real Linux and Windows hardware — which is exactly the scope of the v0.2.0 cross-platform milestone. See ROADMAP.md.

  • notify 6.1 → 8.2 — two major bumps with known API churn in the file-system watcher. Used by src/services/watcher.rs.
  • tray-icon 0.17 → 0.22 — five minor bumps on a pre-1.0 crate; tray behavior on macOS/Linux/Windows is a top v0.2.0 test target.
  • global-hotkey 0.6 → 0.7 — pre-1.0 minor bump; same platform sensitivity as tray-icon.

Fixed

  • Editor right-click and click-below-text — the markdown editor widget no longer shrinks to its content height. It now grows to fill the parent's available height, so left-clicks below the last line correctly place the cursor and right-clicks anywhere in the editor pane open the context menu. Previously the empty area below the text belonged to the parent scrollable and clicks fell through.
  • macOS tray icon rendering — the tray icon is now marked as a template image (NSImage::setTemplate(true)) and the source PNG was recolored from pure white to pure black with alpha, matching Apple's template image spec. AppKit now auto-tints the icon to match the menu bar appearance (dark silhouette on light bars, light silhouette on dark bars), so the snail no longer renders as a bright white blob against light wallpapers.

Security

  • Hardened normalize_filename — rejects path traversal (., .., leading .), control characters, Unicode bidi-override characters (U+202A..U+202E, U+2066..U+2069), trailing dots, and Windows reserved names (CON, PRN, AUX, NUL, COM1-9, LPT1-9, case-insensitive).
  • Safe markdown image-ref rewriter — rename_file no longer uses naive String::replace. It now walks the markdown via pulldown_cmark's offset iterator and only rewrites references outside fenced code blocks and inline code spans, so a code snippet that mentions an old filename is preserved verbatim.
  • Secure per-process temp directories — screenshot temp files now go through tempfile::Builder::new().prefix("coontext-").tempdir(), which uses mkdtemp(3) (mode 0700 on Unix) instead of the world-readable std::env::temp_dir().
  • Corrupt config recovery — if config.json or recent.json fails to parse, it's renamed to .bak and defaults are used instead of silently overwriting the user's settings.
  • Telemetry crates banned at the supply-chain level via cargo-deny (sentry, sentry-core, rollbar, bugsnag).

Refactored

  • Extracted nine widget modules (modal, toast, context_menu, sidebar, toolbar, status_bar, file_tree, split_pane) from inline definitions in app/mod.rs and views/editor.rs. views/editor.rs shrank from 609 to 99 lines and app/mod.rs from 1221 to ~925 lines.
  • Implemented views/capture_overlay.rs (was a stub) with full drag-state machine, normalized selection rect, image-bound clamping, and 9 unit tests.

0.1.0 — 2026-03-XX

Initial development release. Core feature set described in README.md. Tested on macOS 26.4 only.