From 7cee00c3317f856423d2227a30772dced84c62e8 Mon Sep 17 00:00:00 2001 From: Duc-Tam Nguyen Date: Mon, 15 Jun 2026 12:50:46 +0700 Subject: [PATCH] Cut the v0.2.0 release notes Give the double-click app work its own 0.2.0 section in the changelog, above the released 0.1.2, and update the compare links. Summarise it on the docs release-notes page: kage pack --app wraps the viewer in a desktop app, the release ships a GUI-subsystem Windows base, and packing detects the base binary's target OS from its executable header. --- CHANGELOG.md | 27 ++++++++++++++++--------- docs/content/reference/release-notes.md | 2 +- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 69e5b37..c59a1b5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,16 +6,10 @@ All notable changes to kage are recorded here. The format follows ## [Unreleased] -## [0.1.2] - 2026-06-15 - -### Security - -- Chrome now keeps its sandbox on by default. It was previously launched with `--no-sandbox` unconditionally, which removed Chrome's main line of defense when rendering pages from the open web (reported in #10). The sandbox is now dropped only where it genuinely cannot run: inside a container, or when running as root, and the choice is logged so it is never silent. +## [0.2.0] - 2026-06-15 ### Added -- Container-aware Chrome flags. kage detects a container from the `IN_DOCKER` environment variable or a `/.dockerenv` marker and, only there, drops the sandbox and adds `--disable-dev-shm-usage` (the default 64 MB `/dev/shm` is too small for Chrome on large pages). Outside a container the faster shared memory is left in place. -- Asset downloads retry on a transient failure (a 403/429, a 5xx, or a network blip) with a short backoff, recovering files that bot-protection rejects on the first request of a burst. Permanent failures (404, 401, ...) are not retried. - `kage pack --app` wraps the packed viewer in a double-click desktop app with the site's favicon as the icon. The flag builds on the binary format, so it composes with `--base` (including a `webview` base) and `--icon`. On macOS it @@ -32,12 +26,26 @@ All notable changes to kage are recorded here. The format follows ### Changed -- Clearer crawl error reporting. Each failure is logged with a classified reason (`HTTP 403 Forbidden`, `timed out`, ...), the URL, and the page that referenced it, and the end-of-run summary lists what went wrong instead of printing only a count. - Cross-platform packing detects the base binary's target OS from its executable header (ELF, PE, or Mach-O) rather than its file name, so a Windows viewer always gets a `.exe` suffix and the run hint names the right platform even when the base is named without one. +## [0.1.2] - 2026-06-15 + +### Security + +- Chrome now keeps its sandbox on by default. It was previously launched with `--no-sandbox` unconditionally, which removed Chrome's main line of defense when rendering pages from the open web (reported in #10). The sandbox is now dropped only where it genuinely cannot run: inside a container, or when running as root, and the choice is logged so it is never silent. + +### Added + +- Container-aware Chrome flags. kage detects a container from the `IN_DOCKER` environment variable or a `/.dockerenv` marker and, only there, drops the sandbox and adds `--disable-dev-shm-usage` (the default 64 MB `/dev/shm` is too small for Chrome on large pages). Outside a container the faster shared memory is left in place. +- Asset downloads retry on a transient failure (a 403/429, a 5xx, or a network blip) with a short backoff, recovering files that bot-protection rejects on the first request of a burst. Permanent failures (404, 401, ...) are not retried. + +### Changed + +- Clearer crawl error reporting. Each failure is logged with a classified reason (`HTTP 403 Forbidden`, `timed out`, ...), the URL, and the page that referenced it, and the end-of-run summary lists what went wrong instead of printing only a count. + ### Fixed - The container image now runs. Chrome aborted on launch with `chrome_crashpad_handler: --database is required`, so kage disables Chrome's crash reporter inside a container, and the `kage` user now has a writable home (the mounted `/out` volume) so the default output, resume state, and Chrome's profile no longer fail with a permission error (issue #7). @@ -101,7 +109,8 @@ can browse offline, with every script stripped out. a multi-arch container image on GHCR (Chromium bundled), checksums, SBOMs, and a cosign signature, all cut from one version tag by GoReleaser. -[Unreleased]: https://github.com/tamnd/kage/compare/v0.1.2...HEAD +[Unreleased]: https://github.com/tamnd/kage/compare/v0.2.0...HEAD +[0.2.0]: https://github.com/tamnd/kage/compare/v0.1.2...v0.2.0 [0.1.2]: https://github.com/tamnd/kage/compare/v0.1.1...v0.1.2 [0.1.1]: https://github.com/tamnd/kage/compare/v0.1.0...v0.1.1 [0.1.0]: https://github.com/tamnd/kage/releases/tag/v0.1.0 diff --git a/docs/content/reference/release-notes.md b/docs/content/reference/release-notes.md index 698cec2..16d936b 100644 --- a/docs/content/reference/release-notes.md +++ b/docs/content/reference/release-notes.md @@ -6,7 +6,7 @@ weight: 40 The authoritative, commit-level history lives in [`CHANGELOG.md`](https://github.com/tamnd/kage/blob/main/CHANGELOG.md) and on the [releases page](https://github.com/tamnd/kage/releases). This page summarises each version. -## Unreleased +## v0.2.0 Double-click apps, so a packed mirror opens like a real desktop app instead of a terminal program.