From b5fb185b865bc5e3a583ae58729f1c24cce96466 Mon Sep 17 00:00:00 2001 From: Duc-Tam Nguyen Date: Mon, 15 Jun 2026 12:45:48 +0700 Subject: [PATCH] Cut the v0.1.2 release notes Move the Unreleased entries into a 0.1.2 section in the changelog and summarise the release on the docs release-notes page: the Chrome sandbox now stays on by default, asset downloads retry on a transient failure, crawl errors report a clear reason and provenance, and the container image runs again. --- CHANGELOG.md | 5 ++++- docs/content/reference/release-notes.md | 9 +++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6a15f4c..9a58930 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to kage are recorded here. The format follows ## [Unreleased] +## [0.1.2] - 2026-06-15 + ### Security - Chrome now keeps its sandbox on by default. It was previously launched with `--no-sandbox` unconditionally, which removed Chrome's main line of defense when rendering pages from the open web (reported in #10). The sandbox is now dropped only where it genuinely cannot run: inside a container, or when running as root, and the choice is logged so it is never silent. @@ -82,6 +84,7 @@ can browse offline, with every script stripped out. a multi-arch container image on GHCR (Chromium bundled), checksums, SBOMs, and a cosign signature, all cut from one version tag by GoReleaser. -[Unreleased]: https://github.com/tamnd/kage/compare/v0.1.1...HEAD +[Unreleased]: https://github.com/tamnd/kage/compare/v0.1.2...HEAD +[0.1.2]: https://github.com/tamnd/kage/compare/v0.1.1...v0.1.2 [0.1.1]: https://github.com/tamnd/kage/compare/v0.1.0...v0.1.1 [0.1.0]: https://github.com/tamnd/kage/releases/tag/v0.1.0 diff --git a/docs/content/reference/release-notes.md b/docs/content/reference/release-notes.md index 73e30d2..4caa136 100644 --- a/docs/content/reference/release-notes.md +++ b/docs/content/reference/release-notes.md @@ -6,6 +6,15 @@ weight: 40 The authoritative, commit-level history lives in [`CHANGELOG.md`](https://github.com/tamnd/kage/blob/main/CHANGELOG.md) and on the [releases page](https://github.com/tamnd/kage/releases). This page summarises each version. +## v0.1.2 + +A security fix for how kage launches Chrome, clearer crawl errors, and a container image that actually runs. + +- **Chrome keeps its sandbox on by default.** Earlier versions launched Chrome with `--no-sandbox` on every run, which switched off the browser's main security boundary even on an ordinary desktop where the sandbox works fine ([#10](https://github.com/tamnd/kage/issues/10)). The sandbox now stays on, and is dropped only where it genuinely cannot start: inside a container (detected from `IN_DOCKER` or `/.dockerenv`) or when running as root. Whenever it is dropped, kage says so on stderr, so the choice is never silent. +- **Transient asset failures retry.** A download that hits a 403/429, a 5xx, or a network blip is retried with a short backoff, which recovers files that bot-protection rejects on the first request of a burst. Permanent failures like a 404 are not retried. +- **Clearer crawl errors.** Each failure now logs a classified reason (`HTTP 403 Forbidden`, `timed out`, ...), the URL, and the page that referenced it, and the end-of-run summary lists what went wrong instead of printing only a count. +- **The container image runs.** Chrome aborted in the image with `chrome_crashpad_handler: --database is required`, so the crash reporter is now disabled inside a container, and the `kage` user has a writable home (the mounted `/out` volume) so output, resume state, and Chrome's profile no longer fail with a permission error ([#7](https://github.com/tamnd/kage/issues/7)). + ## v0.1.1 Packing, so a clone can travel as one file instead of a folder.