All pull requests

Pull requests

• fix(electron): attach defensive security headers and harden static protocol traversal checks

  #2859·qorvr opened Oct 14, 2026·8 of 12 tasks·

  ·
  6

• fix(electron): intercept and guard subframe navigations across browser windows

  #2857·qorvr opened Oct 14, 2026·8 of 12 tasks·

  ·
  8

• fix(engine): join stderr reader thread and close pipes across sidecar lifecycle

  #2856·qorvr opened Oct 14, 2026·7 of 11 tasks·

  ·
  17

• fix(engine): replace silent bare exceptions with structured logging in model lifecycle

  #2854·qorvr opened Oct 14, 2026·7 of 11 tasks·

  ·
  8

• fix(media): prevent argument injection in ffprobe invocations via double-dash delimiter

  #2853·qorvr opened Oct 14, 2026·7 of 12 tasks·

  ·
  4

• fix(bridge): harden desktop cleanup directory signature validation

  #2852·qorvr opened Oct 14, 2026·10 of 15 tasks·

  ·
  3

• fix(streaming): enforce maximum audio buffer quota on websocket transcription

  #2851·qorvr opened Oct 14, 2026·9 of 14 tasks·

  ·
  19

• fix(auth): prevent loopback capability bypass behind local reverse proxies

  #2850·qorvr opened Oct 14, 2026·9 of 14 tasks·

  ·
  7

• fix(bridge): replace expect panics with error results in dictation output

  #2849·qorvr opened Oct 14, 2026·10 of 15 tasks·

  ·
  3

• fix(sonitranslate): prevent stdout pipe deadlock with background drainer and clean up on exit

  #2848·qorvr opened Oct 14, 2026·10 of 15 tasks·

  ·
  19

• fix(workflows): prevent prototype pollution by validating step ids and using null-prototype dictionaries

  #2847·qorvr opened Oct 14, 2026·6 of 13 tasks·

  ·
  5

• fix(electron): restrict protocol schemes and sender frame in ipc handlers

  #2846·qorvr opened Oct 14, 2026·5 of 13 tasks·

  ·
  6

• fix(integrations): report a failed vendor website open

  #2844·rudycelekli opened Oct 14, 2026Contributor·

  ·
  6

• fix(dub): sweep stale preview uploads from the preview directory

  #2843·rudycelekli opened Oct 14, 2026Contributor·

  ·
  5

• docs: sync README_CN and README_JA with README

  #2842·rudycelekli opened Oct 14, 2026Contributor·

  ·
  3

• docs: fix two broken relative links

  #2841·rudycelekli opened Oct 14, 2026Contributor·

  ·
  3

• fix(clone): skip a passage Whisper filled with a repetition loop (#2836)

  #2838·bercedev opened Oct 14, 2026·4 of 13 tasks·

  ·
  1

  6

• fix(subtitles): strip ruby pronunciation annotations from spoken text

  #2834·ege-arhan opened Oct 14, 2026Contributor·

  ·
  1

  9

• fix(longform): offer every engine language in Stories and Audiobook

  #2832·vinay121314 opened Oct 14, 2026·6 of 13 tasks·

  ·
  1

  4

• fix(sidecar): resolve torch-pinned installs on Linux ARM64

  #2830·Jason69628723 opened Oct 14, 2026·

  ·
  6

• fix(electron): use native macOS tray templates

  #2828·Fredy002 opened Oct 14, 2026·7 of 13 tasks·

  ·
  1

  5

• docs: correct macOS Gatekeeper "damaged" guidance for official downloads

  #2827·akushonkamen opened Oct 14, 2026·5 of 13 tasks·

  ·
  1

  7

• fix(ssml): spell out by grapheme cluster in the Python path (#2825)

  #2826·RerankerGuo opened Oct 14, 2026·7 tasks done·

  ·
  1

  6

• fix(tts): build the OuteTTS speaker from a local Whisper instead of downloading in the worker

  #2824·kevin9327 opened Oct 14, 2026Contributor·

  ·
  1

  7

• fix(tts): leave the zero part out of a dollar amount

  #2822·kevin9327 opened Oct 13, 2026Contributor·2 tasks done·

  ·
  3