b2da17ab62
fix(lazy-connect): harden connection lifecycle against race conditions and edge cases
...
- Prevent concurrent connect() by removing isConnecting reset from
forceDisconnect(); the guard in connect() now reliably blocks
re-entry since no external caller can defeat it.
- Reset isConnecting at end of connect() so subsequent calls can
proceed without waiting for the async '40' handler.
- Clear connectIntent and cancel reconnect timer on server ERROR
when no currentRoom exists, preventing infinite reconnect loops
after failed join attempts (e.g. wrong password via invite link).
- Move connectIntent assignment after !roomId guard in
WEB_JOIN_REQUEST to avoid clobbering existing intent on invalid
input.
- Broadcast JOIN_STATUS failure to popup and bridge tabs when
WEB_JOIN_REQUEST receives an invalid room ID, so the website
join page receives feedback instead of hanging forever.
- Clear joinBtnTimeout on CONNECTION_STATUS connected/disconnected
to avoid stale timeout error messages in the popup.
2026-06-16 05:39:17 +02:00
b518685e2c
merge: bring main (v2.3.2) changes into lazy-connect
2026-06-16 04:59:13 +02:00
9ee22d985f
docs: remove transient _locales fix from changelog (never released)
2026-06-16 04:28:30 +02:00
2070e701de
docs: add v2.3.2 changelog entry (translations, locale fixes, timing leak)
2026-06-16 04:26:07 +02:00
dd8eefe3f9
fix(security): actually prevent timing leak — eagerly evaluate timingSafeEqual
...
The previous fix had a subtle bug: JavaScript && short-circuits,
so crypto.timingSafeEqual() was skipped when buffer lengths differed
(sameLength was false). The dummy buffer was allocated but never
compared, leaving the original length-based timing leak intact.
Now timingSafeEqual is eagerly assigned to a const before the &&
guard, guaranteeing it runs in constant time on every auth attempt
regardless of whether the length guess was correct.
2026-06-16 04:23:20 +02:00
cc97e0d371
fix(security): prevent admin token length leak via timing side-channel
...
isAdminMetricsAuthorized() returned early when buffer lengths differed,
allowing an attacker to discover the token length by measuring response
time. Now always calls crypto.timingSafeEqual (using a zeroed dummy
buffer on length mismatch) so every auth attempt takes constant time
regardless of whether the length guess was correct.
Reported-by: Kaia-Alenia
2026-06-16 04:21:15 +02:00
7571f1986d
fix: restore _locales key names, remove orphan pt/ dir, fix locale typos
...
- _locales/es, pt_BR: renamed appDescription → appDesc (Chrome matches by key name)
- _locales/es, pt_BR: removed extra key contextMenu_syncVideo not in baseline
- _locales/pt_PT: merged Kaia's improved translation, deleted orphan pt/ duplicate
- locales/ko: fixed BTN_REFRESH (Refreschi → 새로고침) and STATUS_CONNECTING corrupted char
- locales/ja: fixed Korean character (의 → の) in LABEL_PUBLIC_ROOMS_TOOLTIP
- locales/nl: fixed typo cmmuniceren → communiceren
2026-06-16 04:19:53 +02:00
bb1a88c085
Merge pull request #8 from Kaia-Alenia/feat/complete-spanish-translation
...
i18n: complete and refined Spanish translation for extension and website
2026-06-16 03:43:54 +02:00
07863bdad6
docs: credit Alenia Studios for PT and PT-BR translations
2026-06-15 13:10:55 -06:00
5e6306432f
i18n: complete and refined Portuguese (PT and BR) translations
2026-06-15 13:10:35 -06:00
fa5dfc1cf1
docs: credit Alenia Studios for ES and IT translations
2026-06-15 11:19:52 -06:00
b88b8bbe47
i18n: complete and refined Italian translation
2026-06-15 11:18:46 -06:00
8aab8ce2f5
docs: shorten Spanish translation context
2026-06-15 11:11:23 -06:00
95b4608236
docs: update Spanish translation status to 100% manually verified
2026-06-15 11:07:35 -06:00
6d42ee7d4c
i18n: complete and refined Spanish translation for extension and website
2026-06-15 11:03:57 -06:00
3f8cf33dc9
fix: WEB_JOIN_REQUEST sendResponse leak + popup validation state cleanup
...
- WEB_JOIN_REQUEST: add missing sendResponse when already in target room
- popup join: reset isProcessingConnection + clear timeout on validation failures
2026-06-15 14:40:15 +02:00
f12bb0a532
fix(extension): reset reconnectAttempts on leave to prevent stale reconnecting status
...
After LEAVE_ROOM or idle-leave, reconnectAttempts was not reset.
GET_STATUS would return 'reconnecting' instead of 'disconnected',
showing wrong status in popup and leaving Retry button visible.
2026-06-15 14:22:17 +02:00
1685b6a327
fix(popup): join timeout checks connection status instead of blind 15s timer
...
Lazy-connect introduces a new state where the user clicks 'Raum erstellen'
and the WebSocket takes 1-2s to establish (previously always pre-connected).
The old 15s blind timeout would re-enable the button while background was
still connecting, causing silent no-op clicks. Now polls GET_STATUS and
extends the window if still connecting.
2026-06-15 14:19:18 +02:00
ec8f56a85d
feat(extension): lazy-connect — only maintain WebSocket when actively in room
...
- Add connectIntent flag to gate all reconnect attempts
- Only auto-connect on startup if roomId exists in storage
- Close socket + stop reconnect after leaveRoom or idleLeave
- Preserve existing behavior 1:1 when actively in a room
- Guard force-sync state and peer list clearing during transient disconnects
- Guard WEB_JOIN_REQUEST against empty sanitized roomId
2026-06-15 14:08:29 +02:00
38dc923a7c
Merge main (v2.3.1) into feature/lazy-connect
2026-06-15 13:30:57 +02:00
4ca1ef22d2
Revise CHANGELOG for v2.3.1 updates
...
Updated changelog for version 2.3.1 with fixes and changes.
2026-06-15 13:17:10 +02:00
27e57862c0
docs: shorten v2.3.1 changelog entry
2026-06-15 13:15:01 +02:00
c391068706
chore(release): update versions to v2.3.1 [skip ci]
2026-06-15 11:14:23 +00:00
d76e9195c4
fix(server): race condition on concurrent peer joins, crash-safe teardown, smart unhandled rejection handling
...
- Add per-peerId serialization lock (peerJoinLocks) to prevent concurrent dedupe races
- Wrap removePeerFromRoom calls in disconnect/leave/reaper with try/catch
- Replace immediate process.exit on unhandledRejection with rate-limited smart exit
- Optimize buildHealthPayload from 3-pass array ops to single for-of loop
- Reset rateLimitDenied counters in stopServerForTests
Release v2.3.1
2026-06-15 13:14:00 +02:00
6652a06840
docs: correct rationale for english and german translations
2026-06-15 02:56:37 +02:00
b1a89cff41
docs: restructure TRANSLATION.md to prioritize extension and remove outdated details
2026-06-15 02:55:00 +02:00
e4a77a3ef4
docs: improve contribution and translation guidelines
2026-06-15 02:47:17 +02:00
5adcce2074
Release v2.3.0 with new onboarding tour and sync tab
...
Updated CHANGELOG for v2.3.0 release with new features.
2026-06-14 05:31:27 +02:00
a1398ed0e4
chore(release): update versions to v2.3.0 [skip ci]
2026-06-14 03:17:46 +00:00
ed80856803
fix: restore missing Create Room onboarding step and target h1 for welcome step
2026-06-14 05:10:57 +02:00
102031e0d2
style: swap restart onboarding and regenerate peer ID buttons in settings layout
2026-06-14 05:03:27 +02:00
503c7d6dc4
chore: update extension uninstall URL and fix missing onboarding restart translations
2026-06-14 05:02:31 +02:00
77793c8c6e
feat(extension): setup cross-browser uninstall url architecture
2026-06-13 21:01:31 +02:00
4fbf309e5a
fix(extension): resolve critical race conditions and infinite seek loop
...
- Fix infinite seek loop by transitioning to exact expectedSeekTime tracking
- Fix zombie connections by calling forceDisconnect on ping timeouts
- Fix popup Join/Leave race conditions using isProcessingConnection lock
- Fix cross-room join bugs by properly disconnecting old rooms and bypassing same-room joins
- Update onboarding UI to switch to Sync tab automatically
- Prepare CHANGELOG.md for v2.3.0 release
2026-06-13 10:50:46 +02:00
aa61a24351
Add ROADMAP.md with feature tracking and link in README
2026-06-13 06:35:56 +02:00
2ee5c83ee6
docs: add v2.2.5 unreleased changelog entries
2026-06-13 04:54:57 +02:00
ca1cfdb382
Merge pull request #7 from Shik3i/dependabot/npm_and_yarn/npm_and_yarn-53cbaf2a5b
...
chore(deps-dev): bump esbuild from 0.28.0 to 0.28.1 in the npm_and_yarn group across 1 directory
2026-06-13 04:53:43 +02:00
ef7b1f2e5f
fix: suppress video heartbeat PEER_STATUS when alone in room
2026-06-13 04:52:14 +02:00
10fdaa23fc
fix: propagate audio settings from local storage and add compressor feedback
2026-06-13 04:48:25 +02:00
6ba5e1b10b
Increase failedAuthAttempts eviction limit from 50k to 200k
2026-06-13 04:38:22 +02:00
6e234fb8fd
chore(deps-dev): bump esbuild
...
Bumps the npm_and_yarn group with 1 update in the / directory: [esbuild](https://github.com/evanw/esbuild ).
Updates `esbuild` from 0.28.0 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases )
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md )
- [Commits](https://github.com/evanw/esbuild/compare/v0.28.0...v0.28.1 )
---
updated-dependencies:
- dependency-name: esbuild
dependency-version: 0.28.1
dependency-type: direct:development
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-06-13 02:07:21 +00:00
9f553b4f8f
chore(release): update versions to v2.2.4 [skip ci]
2026-06-09 23:42:27 +00:00
131afadc1d
v2.2.4: Fix notification setting bypass and misleading reconnect message
...
- EVENTS.ERROR handler now respects browserNotifications setting
- Graceful shutdown message no longer implies manual reconnect
2026-06-10 01:33:45 +02:00
c62da66b06
chore(release): update versions to v2.2.3 [skip ci]
2026-06-09 22:56:52 +00:00
34f0c2b265
chore(release): v2.2.3 — artifact attestations, bugfixes, rate limit metrics
2026-06-10 00:56:29 +02:00
af59b4c64c
ci(release): add website build + artifact upload on tag
2026-06-09 22:03:38 +02:00
af8184420c
chore: stop tracking website/www/ (auto-generated)
2026-06-09 22:02:39 +02:00
45e1e3defe
chore: add website/www/ to gitignore
2026-06-09 22:01:48 +02:00
e67b0c564d
fix(website): copy apple-touch-icon files to www root for iOS/Safari
2026-06-09 22:00:31 +02:00
f54a38b656
chore(release): update versions to v2.2.2 [skip ci]
2026-06-09 19:16:15 +00:00
KoalaDev