0.14.2
Latest0.14.3
Latest-
+
- Review community plugins before install. Imported plugin packages now open a review sheet with + provenance, signature status, publisher category, permissions, privacy categories, package digest and script digest + before anything is saved. +
- Bind plugin trust to signed package contents. Flowlight can verify detached P-256 package signatures + against trusted publisher keys, rejects tampered signed packages, keeps unsigned local packages clearly labelled, and + prevents unsigned packages from claiming official provenance. +
- Declare and enforce sanitized plugin permissions. Plugin manifests now describe which metadata families + they use, and installed JavaScript receives only those sanitized context sections while remaining advisory and fail-open. + The template, validator, localization catalogs and plugin docs now match the new review contract. +
0.14.2
- Run installed advisory JavaScript plugins. Installed plugin packages can now include a
synchronous
evaluate(context)script. Flowlight runs it out of process with an empty environment, @@ -1170,7 +1185,7 @@What's new
© 2026 The Flowlight contributors. Flowlight is free software, released under the GNU General Public License v3.0. - Version 0.14.2 · Not affiliated with Apple or any AI provider named on this site. + Version 0.14.3 · Not affiliated with Apple or any AI provider named on this site.