v1.0.235

Security fixes

• GHSA-59p9-8gwf-v9v7: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory

Changes

• feat(core): add pinned tabs by @tyr1k in #11146
• Sort baud rate selector by numeric order by @bluekani in #11297
• feat: Add mouse wheel support for hotkeys by @bluekani in #11324
• [Feature] Group nesting "folders" & Profile tree view by @D3VL-Jack in #10788
• Make keyboard-interactive auth URLs clickable by @puneetdixit200 in #11327
• Bundle MSVC runtime DLLs in Windows portable packages by @bluekani in #11372
• Adding Cool Retro Term Amber theme by @saudiqbal in #11337
• [FEATURE] refresh Windows environment variables from registry for new sessions by @MicroGery in #11321
• fix(terminal): expose debug hotkeys in settings for remap/disable by @uadhran in #11420
• feat: add Connect, Disconnect, and Reconnect buttons to serial tab toolbar by @uadhran in #11288

Fixes

• fix: restore terminal redraw after tab reactivation by @uadhran in #11275
• fix: Plugins search by @bluekani in #11330
• fix(terminal): restore transparent background when vibrancy is enabled by @Specboss in #11326
• fix: Restore hotkey edit and remove actions by @bluekani in #11374
• fix: Exclude unnecessary Windows build artifacts by @bluekani in #11371
• fix: Pin Windows build runner to windows-2022 by @bluekani in #11370
• fix(terminal): reset stale DEC modes on connectable reconnect by @balajieswaramoorthi in #11368
• fix(ssh): prevent keepalive flooding by mapping null/0 keepaliveInterval to undefined by @linzack in #11340
• fix: ZMODEM transfer by @ruanimal in #11319
• fix(ssh): honor profile port settings on connect by @uadhran in #11366
• fix(terminal): robust context loss recovery and direct DOM fallback during GPU resets by @Gerry9000 in #11354
• fix(settings): guard hotkey config lookup for missing plugin paths by @uadhran in #11422
• fix(terminal): restart visual bell shake on repeated BEL by @uadhran in #11388
• fix: handle vault unlock modal cancellation gracefully by @uadhran in #11356
• feat: Add dropdown arrow to form-select elements by @bluekani in #11399
• fix(ssh): prevent SFTP path navigation freeze by @A-Words in #11393
• fix: replace exec() with execFile() to prevent shell injection in shellIntegration.service by @uadhran in #11290
• fix: replace exec() with execFile() to prevent shell injection in app.ts by @uadhran in #11289

New Contributors

• @cayenne17 made their first contribution in #11284
• @bluekani made their first contribution in #11297
• @D3VL-Jack made their first contribution in #10788
• @puneetdixit200 made their first contribution in #11327
• @Specboss made their first contribution in #11326
• @balajieswaramoorthi made their first contribution in #11368
• @linzack made their first contribution in #11340
• @saudiqbal made their first contribution in #11337
• @Gerry9000 made their first contribution in #11354
• @MicroGery made their first contribution in #11321
• @tyr1k made their first contribution in #11146
• @A-Words made their first contribution in #11393

Full Changelog: v1.0.234...v1.0.235

v1.0.234

Security fixes

GHSA-m937-jm93-pfp6

• Dragging and dropping a file with a specially crafted name onto the terminal could cause the terminal to execute an arbitrary command contained in the file name.

Features

• auto-sudo-password multi language and sudo-rs support (#11019) #11019 (Ponder)
• add 'Export to file' option to terminal context menu (#11109) #11109 (Utkarsh Adhran)

Fixes

• improve transfer menu readability (#11272) #11272 (mouse)
• b82ac4c: Make macOS build fail if code signing fails (#11255) (Copilot) #11255
• b0c2f5f: handle keytar password load errors (Eugene)
• 012a62d: Fix CLI crashes on Wayland due to unhandled X11 error in Glasstron (#11264) (Chris McGrath) #11264
• 03e9aa0: fixed #11283 - missing terminal titles (Eugene)

v1.0.233

Changes

• ssh: add hotkey to open SFTP panel (#11106) #11106 (Utkarsh Adhran)
• add refresh button for SFTP (#11047) #11047 (Ponder)
• bf91668: Bundle Visual C++ Redistributable in Windows NSIS installer (#11060) (JosephMcEvoy) #11060

Fixes

• configSync: require HTTPS for sync host to prevent MITM RCE (#11228) #11228 (Sebastion)
• disable spellchecker to prevent automatic dictionary downloads (#11107) #11107 (Utkarsh Adhran)
• hide blacklisted profiles from OS dock/taskbar menu (#11108) #11108 (Utkarsh Adhran)
• remove unsafe exec() in UAC.cpp (#11195) #11195 (orbisai0security)
• use switchMap instead of flatMap for plugin search to prevent st… (#11089) #11089 (Varun Subramanyan)
• improve agent authentication error handling and socket path validation (#11034) #11034 (ayaya)
• fix UI degradation with large SSH config files. Issue #11078 (#11094) #11094 (hsdelirium)
• 9152306: add user confirmation for zmodem transfers
• 45fa605: Hide all keyboard-interactive prompts where server indicates no echo - not just "password" ones
• e70fafd: remove control characters from dropped paths
• 9eff849: prompt before running commands via protocol handler
• bca5138: fix group selector in profile editing modal
• 6e47c2f: add user warning for the tabby:// paste commands
• 4c4b1f0: Fix themed backgrounds for side tabs and title bar (#11219) (nguyenhuukhoi) #11219
• 220f719: Add option to replace line breaks with spaces on paste (#11218) (iroaK) #11218
• 25ca30e: Implement write queue for Zmodem transfer (#11155) (gmd20) #11155
• 0e9c570: Fix frosted glass persistence (#11083) (Utkarsh Adhran) #11083
• 2e85f8d: generate 256 palette (#11043) (jake-stewart) #11043
• 78a5632: Fix OSC 11 background color reporting (#11074) (Utkarsh Adhran) #11074

v1.0.232

Security fixes

GHSA-cmpc-v2x9-j9x9

• fb9bec8: Tabby now warns when opening clickable application URIs in the terminal.

Fixes

• 56908f4: fix incorrect imports in tabby-ssh (Eugene)

v1.0.231

Changes

• ssh: pre-populate vault password in auth prompts for MFA (fixes #9911) (#11170) #11170 (syrexjohnson)
• 8506173: Add SFTP context menu download for files (#10971) (Leonardo Berbert) #10971
• Implement tabby:// URL scheme handler (#11005) #11005 (Ponder)
• Allow third-party plugins to add quick connection support. (#11004) #11004 (Ponder)

Fixes

• pluginsSettingsTab.component.pug: flex wrapper for gap in buttons (#10986) #10986 (Grovvik)
• upgraded webpack from 5.86.0 to 5.104.1 to fix ES6 class extension bug with xterm.js v6. (#11007) #11007 (Ponder)
• handle OSC sequences split across buffer chunks (#11144) #11144 (ToastyTheBot)
• terminal: prevent scroll-to-top race during fast output (#11102) #11102 (Phil Condreay)
• 4566a91: Fix hiding the app from macos dock when docking is enabled (#10960) (SergeBakharev) #10960
• 10a4f54: fixed recovered tabs crashing after upgrade - fixes #10619, fixes #10635, fixes #10672, fixes #10682, fixes #10688, fixes #10730, fixes #10843
• 18bca3e: Fix trailing semicolons in clickable URLs (#11166) (chaoliang yan) #11166
• abc16d2: fixed #10131 - bump russh to prevent auto-disconnects
• c3ede45: Disable global shortcuts on older plasma versions (#11157) (Mario Limonciello) #11157
• 5d5ac4d: bump xterm (#10974) #10974

Full Changelog: v1.0.230...v1.0.231

v1.0.230

Fixes

• 2d01b9a: fixed #10580, fixed #10558, fixed #10237, fixed #8450 - fixed X11 forwarding (Eugene)
• ssh: add EOF handling and error propagation for port forwarding (#10964) #10964 (ajkrj)
• include http proxy settings in ssh multiplexer key (#10943) #10943 (TheBlind)
• ssh: fix windows openssh agent detection logic (#10954) #10954 (Andy_Allan)
• 315083d: Packagecloud_upload_for_Debian_forky_duke (#10890) (gh-log) #10890

Features

• ssh: support agent authentication using specific public key identity (#10953) #10953 (Andy_Allan)

v1.0.229

Fixes

• 5246355: Disable SSH compression by default as a workaround for SFTP upload bugs (Eugene)
• adjust ssh config time resolution (#10803) #10803 (osm1892)
• unexpected configuration was selected in the recent profiles (#10817) #10817 (Kairlec)

Changes

• 2cf6ef0: Add support to connect in winscp throug tunnel. (#10829) (Indigo.liu) #10829
• 4f14e92: Bumped node-pty

v1.0.228

Changes

• c4db286: SSH: added mlkem768x25519-sha256 key exchange - fixes #10792, fixes #10560
• d1196a0: Reenabled SSH keepalive by default

Fixes

• e76314d: fixed #10749: Too small draggable area when tabs with vertical-left and window is set to thin (#10750) (Seungyong Hong) #10750
• d92540f: fixed #10726 - The indicator does not show success when uploading files through SFTP (#10733) (zhaolei) #10733
• 5060344: bump russh for pageant fixes
• cf5b994: Bump electron to version 38 (#10801) (et304383) #10801
• 264f1cb: fixed #10786 - login broken if dynamic SSH username is used by default (Florian Kefferpütz) #10786

v1.0.227

Commits

• 9e44ba6/79129e6: bumped russh, fixes SSH disconnects
• 0e09945: bump electron - fixes GTK symbols errors on Linux - fixes #10633, fixes #10609, fixes #10666 (Eugene)
• 61f02d1: fixed SSH connection crashes - #10619

v1.0.226

Changes

• a2d27fe: fixed node-pty conpty assertion failure - fixes #10618 (Eugeny)