UniCreate کے پرانے ورژن – تمام ورژنز

# UniCreate - Patch Notes v1.0.9

Date: 2026-05-13
Release tag: `v1.0.9`
Repository: `drrakendu78/UniCreate`

## Highlights

- **Auto-update no longer fails with `os error 740`** on non-admin sessions: UniCreate now restarts itself as administrator automatically before launching the updater. One-click update again works end to end.
- **All updater error messages translated to English** (previously some surfaced the localized Windows error text, e.g. "L'opération demandée nécessite une élévation").

## Changes

### 1) Fix — `ERROR_ELEVATION_REQUIRED` (740) on auto-update

- Windows installer-detection heuristic forces UAC elevation for any `.exe` whose name contains `updater` / `setup` / `install`. Launching `UniCreate-Updater.exe` from a non-admin process therefore fails with OS error 740, which the previous build surfaced as a cryptic toast.
- UniCreate now checks `is_running_as_admin` before triggering the updater. When the app is not elevated, it persists the pending download URL + filename in `localStorage` (`unicreate-pending-update`), calls a new `restart_as_admin` Tauri command, and resumes the install automatically once the app reboots with elevated privileges. A single UAC prompt now suffices — no need to manually relaunch the app as admin.

Impacted files:
- `src-tauri/Cargo.toml` (added `is_elevated` dependency on Windows)
- `src-tauri/src/lib.rs` (new `is_running_as_admin` and `restart_as_admin` Tauri commands)
- `src-tauri/src/github.rs` (`start_silent_update` now translates `raw_os_error() == 740` into a clear English message)
- `src/App.tsx` (`openUpdateAction` checks admin first + resumes pending update on next boot)

### 2) Updater error messages are now consistently in English

- The pre-existing English strings stay unchanged.
- The 740 case used to fall through to `std::io::Error::Display`, which Windows localizes (French users saw "L'opération demandée nécessite une élévation"). It now returns: *"Update requires administrator privileges. Please restart UniCreate as administrator and try again."*

Impacted files:
- `src-tauri/src/github.rs`

### 3) Version bump

- App version updated to `1.0.9`.

## Checksums (SHA-256)

| File | SHA-256 |
|------|---------|
| `UniCreate_1.0.9_x64-setup.exe` | `a56a1fb2a1b498e92da853f8f380bc357ed0ead56760e40c80f5af64760464fd` |
| `UniCreate_1.0.9_x64_en-US.msi` | `4f59bd03348e5024090aec16f564341f6163f5c6fa1398645d10604dbf55c3e4` |

# UniCreate - Patch Notes v1.0.7

Date: 2026-03-29
Release tag: \`v1.0.7\`
Repository: \`drrakendu78/UniCreate\`

## Highlights

- Chinese localization (Simplified & Traditional) — merged PR #3
- Fixed package IDs with \`-\` and \`_\` being incorrectly rejected
- Fixed case-sensitive package search causing false "not found" results
- Added nested installer support for ZIP packages
- Fixed auto-updater "Path traversal detected" error on Windows

## Changes

### 1) Chinese localization (PR #3)
- Added Simplified Chinese (\`zh-Hans\`) and Traditional Chinese (\`zh-Hant\`) translations across all UI strings.
- Language selector in Settings now includes both Chinese variants.

Impacted files:
- \`src/lib/i18n.ts\`
- \`src/pages/Settings.tsx\`
- \`src/stores/settings-store.ts\`

### 2) Fix — Package ID with \`-\` and \`_\` rejected (issue #1)
- The frontend regex now correctly allows hyphens and underscores in package identifiers (e.g. \`Mihomo-Party.Mihomo-Party\`).
- WinGet supports these characters natively; only the UI validation was wrong.

Impacted files:
- \`src/pages/StepMetadata.tsx\`

### 3) Fix — Case-sensitive package search (issue #2)
- Searching for an existing package now falls back to a case-insensitive directory walk when the exact-case path returns 404.
- Prevents false "package not found" errors when the user types a different casing than what is stored in \`microsoft/winget-pkgs\`.

Impacted files:
- \`src-tauri/src/github.rs\`

### 4) Nested installer support for ZIP packages (issue #4)
- When installer type is set to \`zip\`, a new section appears to fill in \`NestedInstallerType\`, \`RelativeFilePath\`, and optionally \`PortableCommandAlias\`.
- The generated manifest now correctly includes \`NestedInstallerType\` and \`NestedInstallerFiles\` as required by WinGet for archive-type packages.

Impacted files:
- \`src/lib/types.ts\`
- \`src/lib/i18n.ts\`
- \`src/pages/StepInstaller.tsx\`
- \`src-tauri/src/yaml_generator.rs\`

### 5) Fix — Auto-updater "Path traversal detected" on Windows
- \`std::fs::canonicalize\` on Windows adds a \`\\?\\` prefix to existing directories but the file doesn't exist yet, causing \`starts_with\` to fail.
- Fixed by building the destination path from the already-canonical directory instead of canonicalizing the non-existent file.

Impacted files:
- \`updater/src-tauri/src/lib.rs\`

### 6) Version bump
- App version updated to \`1.0.7\`.

## Checksums (SHA-256)

| File | SHA-256 |
|------|---------|
| \`UniCreate_1.0.7_x64-setup.exe\` | \`9ba244774b6637598e44778b4e5f8c40d917a572548939e3e1715fd40f255a1d\` |
| \`UniCreate_1.0.7_x64_en-US.msi\` | \`23f761c7a60b4e922f5f7be831495e37b3b02126f0993d30b9e8727091d40591\` |

# UniCreate - Patch Notes v1.0.6

Date: 2026-03-01
Release tag: `v1.0.6`
Repository: `drrakendu78/UniCreate`

## Highlights

- Sticky navigation buttons — Back/Continue buttons now stay visible at the bottom of the screen while scrolling through long pages.

## Changes

### 1) Sticky navigation bar (QoL)
- Navigation buttons (Back / Continue / Submit) are now **sticky at the bottom** of the viewport on all step pages.
- When content is longer than the screen, buttons remain always accessible without scrolling down.
- Frosted glass effect (`backdrop-blur-sm`) for a clean, modern look.
- Full-width bar extends edge-to-edge (`-mx-6 px-6`) within the content container.

Impacted files:
- `src/pages/StepInstaller.tsx`
- `src/pages/StepMetadata.tsx`
- `src/pages/StepReview.tsx`
- `src/pages/StepSubmit.tsx`

### 2) Version bump
- App version updated to `1.0.6`.

Impacted files:
- `package.json`
- `src-tauri/Cargo.toml`
- `src-tauri/Cargo.lock`
- `src-tauri/tauri.conf.json`

## Build artifacts and SHA256 checksums

Checksums below match binaries produced by `npm run tauri build`.

| File | Size (bytes) | SHA256 |
|---|---:|---|
| `UniCreate_1.0.6_x64-setup.exe` | 16,550,837 | `3f2a47f374eab53ecbedcddf9e4f9f1d0c0f20b00bc3255b77f268d48dc390b9` |
| `UniCreate_1.0.6_x64_en-US.msi` | 19,931,136 | `9eda94a33deb8379a9c916cc060aa2cf54e710fcade75448f7d0a054e06f075b` |
| `UniCreate_1.0.6_x64_portable.exe` | 25,069,056 | `203f40501b446e2ce386cb48954ad9fb27db7c9e5c986b2922224264a3bbd81f` |

## Highlights

- **Full i18n** — English & French across all pages
- **Enterprise security** — Never-save session mode, configurable timeout, audit log, HTTP proxy, GPO policy config
- **Settings redesign** — 7 sections: Account, Security, Network, General, Updates, History, About

## What's New

### i18n (EN/FR)
- Dictionary-based translation system with `useT()` hook
- All pages fully translated: Home, StepInstaller, StepMetadata, StepReview, StepSubmit, Settings, ProfileButton, App
- Language selector in Settings

### Enterprise Security
- **Never save session** — Force ephemeral-only mode, token never stored in keyring
- **Configurable timeout** — 5, 10, 15, or 30 min ephemeral sessions
- **Auto-lock** — Session cleared when app regains visibility after expiry (Win+L, sleep)
- **Token scope display** — `public_repo` badge in Settings confirms minimal permissions
- **Audit log** — Every submission logged to `%LOCALAPPDATA%\UniCreate\audit.log`
- **HTTP Proxy** — Configure proxy URL in Settings > Network
- **GPO policy config** — Place `unicreate.policy.json` next to exe to enforce enterprise defaults

### Policy Config Example
```json
{
"neverSaveSession": true,
"ephemeralTimeoutMinutes": 5,
"proxyUrl": "http://proxy.corp:8080",
"autoCheckUpdates": false
}
```

## SHA256 Checksums

| File | SHA256 |
|---|---|
| `UniCreate_1.0.5_x64-setup.exe` | `37744a223faef98939778d8aec1dd053436bd757bf9a98cdcd108d7607f47433` |
| `UniCreate_1.0.5_x64_en-US.msi` | `1bfa956e2c52971e464c28193a4b2554a4cef6b417691b4dbc52abc1a0adef4a` |
| `UniCreate_1.0.5_x64_portable.exe` | `d4df565dda4e72daa3f9a8378a5be0c12b26abf91d15184445e9ff2ee5f88b59` |

# UniCreate - Patch Notes v1.0.4

Date: 2026-02-22
Release tag: `v1.0.4`
Repository: `drrakendu78/UniCreate`

## Highlights

- Fixed Connect button modal flashing and immediately closing.
- Major security hardening across the entire Rust backend (SSRF, path traversal, input validation, CSP, timeouts).
- Auth token now passed to all GitHub API calls (5000 req/h vs 60 unauthenticated).
- Clear rate limit error messages instead of silent "not found".
- Per-user submission history isolation (each GitHub account sees only its own data).
- Metadata auto-fill now works for drag & drop local files (GitHub URLs).
- Profile repos (`username/username`) excluded from New Package repo list.
- Extracted React hooks for better code organization.
- Removed dead code and unused imports.

## Bug fixes

### 1) Connect button modal flash fix
- The auth modal was appearing and immediately closing due to a `useEffect` triggering on initial render.
- Added `flowStarted` guard state to only close the modal after the device flow has actually started.
- Cancel/X buttons properly reset the `flowStarted` state.

Impacted file:
- `src/components/ProfileButton.tsx`

## Security hardening

### 2) SSRF protection
- All HTTP downloads now enforce HTTPS-only.
- Added `is_private_host()` blocklist covering:
- IPv4: `localhost`, `127.0.0.1`, `0.0.0.0`, `10.x`, `172.16-31.x`, `192.168.x`, `169.254.x`, `.local`, `.internal`
- IPv6: `::1`, `::0`, `fe80::`, `fc00::/fd00::`, IPv4-mapped (`::ffff:127.*`, `::ffff:10.*`, etc.)
- Post-redirect URL is re-validated (scheme + host) to prevent redirect-based SSRF.
- Download file size capped at 2 GB to prevent resource exhaustion.

Impacted file:
- `src-tauri/src/hash.rs`

### 3) Path traversal protection
- `hash_local_file`: file path is `canonicalize()`d before use.
- Extension whitelist enforced (`.exe`, `.msi`, `.msix`, `.msixbundle`, `.appx`, `.zip`).
- `download_and_hash`: file name from `Content-Disposition` is stripped to basename via `Path::file_name()` and special characters are replaced.
- `save_yaml_files` in `lib.rs`: validates file names (no `/`, `\`, `..`), enforces `.yaml` extension, and checks canonicalized path stays within output directory.

Impacted files:
- `src-tauri/src/hash.rs`
- `src-tauri/src/lib.rs`

### 4) Input validation
- Added `validate_package_id()`: 1-128 chars, alphanumeric + `.` `-` `_`, no `..`, at least 2 segments.
- Added `validate_version()`: 1-64 chars, no `/` `\` `..`, alphanumeric + `.` `-` `_` `+`.
- Added `validate_github_name()`: 1-100 chars, alphanumeric + `-` `_` `.`.
- Applied to all Tauri commands: `submit_manifest`, `fetch_existing_manifest`, `check_package_exists`, `fetch_repo_metadata`, `fetch_repo_releases`, `save_yaml_files`.

Impacted files:
- `src-tauri/src/github.rs`
- `src-tauri/src/lib.rs`

### 5) HTTP client hardening
- All `reqwest::Client::new()` replaced with `http_client()` factory.
- Global timeouts: 30s request, 10s connect.
- Download client: 300s timeout, max 5 redirects.

Impacted file:
- `src-tauri/src/github.rs`

### 6) CSP restriction
- Content Security Policy changed from `https://*` wildcard to strict whitelist:
- `connect-src`: `api.github.com`, `github.com`, `avatars.githubusercontent.com`
- `img-src`: `self`, `asset:`, `avatars.githubusercontent.com`

Impacted file:
- `src-tauri/tauri.conf.json`

### 7) Release URL validation
- Download URLs from GitHub release assets are now validated to ensure they point to trusted GitHub domains (`github.com`, `objects.githubusercontent.com`) before being exposed to the frontend.
- Self-update download URLs go through the same validation.

Impacted file:
- `src-tauri/src/github.rs`

### 8) Branch name collision prevention
- `submit_manifest` now appends a Unix timestamp to the branch name to prevent collisions when resubmitting the same package+version.

Impacted file:
- `src-tauri/src/github.rs`

### 9) Error message sanitization
- Removed raw GitHub API response bodies from user-facing error messages to preven

# UniCreate - Patch Notes v1.0.3

Date: 2026-02-21
Release tag: `v1.0.3`
Repository: `drrakendu78/UniCreate`

## Highlights

- Silent update no longer flashes a CMD window.
- Update mode now auto-fills version, release notes, and release notes URL from the new release.
- Recent packages quick-select chips in Update mode.
- Multi-segment package IDs fully supported (e.g., `Microsoft.VisualStudio.2022.Community`).
- All `InstallerSwitches` fields now written to YAML output.
- App version in TitleBar auto-synced from `package.json`.
- Docs: PR labels collapsed into hover tooltip.

## Technical changes

### 1) Silent update fix
- Added `CREATE_NO_WINDOW` (0x08000000) flag via `.creation_flags()` on the PowerShell process.
- Combined with `-WindowStyle Hidden`, the update is now fully invisible.

Impacted file:
- `src-tauri/src/github.rs`

### 2) YAML field parser fix
- `parse_yaml_field` now matches `"Field: "` exactly instead of prefix-matching.
- Prevents `Publisher` from matching `PublisherUrl`.

Impacted file:
- `src-tauri/src/github.rs`

### 3) InstallerSwitches complete output
- All switch fields (`Interactive`, `InstallLocation`, `Log`, `Upgrade`, `Repair`) are now written to YAML when provided.
- Removed `#[allow(dead_code)]` on `InstallerSwitches` struct.

Impacted file:
- `src-tauri/src/yaml_generator.rs`

### 4) Multi-segment package ID support
- Replaced `splitn(2, '.')` with `split('.')` + `join("/")` for building winget-pkgs paths.
- Correctly handles IDs like `Microsoft.VisualStudio.2022.Community` → `manifests/m/Microsoft/VisualStudio/2022/Community/`.
- Applied to `fetch_existing_manifest`, `check_package_exists`, and `submit_manifest`.

Impacted file:
- `src-tauri/src/github.rs`

### 5) Dynamic version in TitleBar
- Added `__APP_VERSION__` define in Vite config, reading from `package.json`.
- TitleBar now displays version dynamically instead of hardcoded string.

Impacted files:
- `vite.config.ts`
- `src/vite-env.d.ts`
- `src/App.tsx`

### 6) Update mode: auto-fill from new release
- In update mode, `StepInstaller` now applies `version`, `releaseNotes`, and `releaseNotesUrl` from the new GitHub release metadata.
- Removed stale `releaseNotesUrl` from `applyExistingManifest` to prevent old tag carry-over.

Impacted files:
- `src/pages/StepInstaller.tsx`
- `src/stores/manifest-store.ts`

### 7) Recent packages quick-select in Update mode
- Added clickable chips showing previously submitted package IDs in the Update search view.
- Clicking a chip auto-fills the input and triggers the search immediately.
- Chips are deduplicated from submission history.

Impacted file:
- `src/pages/Home.tsx`

### 8) Docs: PR labels as tooltip
- PR label badges on the site are now collapsed into a compact "N labels" chip.
- Hovering reveals all labels in a dropdown tooltip.

Impacted files:
- `docs/app.js`
- `docs/styles.css`

### 9) Version bump
- App version updated to `1.0.3`.

Impacted files:
- `package.json`
- `src-tauri/Cargo.toml`
- `src-tauri/tauri.conf.json`

## Build artifacts and SHA256 checksums

Checksums below match binaries produced by `npm run tauri build`.

| File | Size (bytes) | SHA256 |
|---|---:|---|
| `UniCreate_1.0.3_x64-setup.exe` | 11262342 | `d66c0137b44f65519f8f516ad7d099716e69b854f6ebb661968fc644bb6f5ae5` |
| `UniCreate_1.0.3_x64_en-US.msi` | 13373440 | `cb0495f5c755c386677f909155322803864c12e76a2ee07abcbf66efc41f4875` |
| `UniCreate_1.0.3_x64_portable.exe` | 24466944 | `1eb238bb6845c12e7363604853434735f2576d7182cd3a08caace0060ce2d19a` |

# 🚀 UniCreate - Patch Notes v1.0.2

📅 Date: 2026-02-19
Release tag: `v1.0.2`
Repository: `drrakendu78/UniCreate`

## ✨ What's new

- Improved PR status clarity in Home with more precise live badges.
- Reduced false alerts: no more warning when PR is only waiting review/check computation.
- Version bump to `1.0.2`.

## 🔍 PR status improvements

### 1) More precise mergeability badges
- Added dedicated badges for open PR merge state:
- `Ready`
- `Pending review`
- `Behind`
- `Draft`
- `Conflicts`
- `Checks failing`
- `Syncing`

Impacted file:
- `src/pages/Home.tsx`

### 2) Action badge is now stricter
- Replaced generic `Attention` with `Needs action`.
- `Needs action` now appears only for explicit problematic states.
- `blocked` and `behind` no longer trigger an error-style badge by default.

Impacted file:
- `src-tauri/src/github.rs`

### 3) Version update
- App version updated from `1.0.1` to `1.0.2`.

Impacted files:
- `package.json`
- `src-tauri/Cargo.toml`
- `src-tauri/Cargo.lock`
- `src-tauri/tauri.conf.json`
- `src/App.tsx`

## 📦 Windows artifacts and SHA256 checksums

Checksums below match binaries produced by `npm run tauri build`.

| File | Size (bytes) | SHA256 |
|---|---:|---|
| `UniCreate_1.0.2_x64-setup.exe` | 11254227 | `033c03d8a54691fccedf72d5e9c99ccb8ce6f3fa244409dd9deb896cea31b329` |
| `UniCreate_1.0.2_x64_en-US.msi` | 13373440 | `6fb1fb3b6b56e18989ee6ac19d013023661a961b7755835ef166537435912bed` |
| `UniCreate_1.0.2_x64_portable.exe` | 24452608 | `0b2cec7363b57f2d94bc7314e49a7829d8626bc2e8b037c08e724e1a3462f73d` |

# UniCreate - Patch Notes v1.0.1

Date: 2026-02-19
Release tag: `v1.0.1`
Repository: `drrakendu78/UniCreate`

## Highlights

- Added YAML edit mode in Review step (Step 3).
- Improved YAML generation to avoid forced quotes by default (winget-pkgs style).
- Kept safe quoting only when technically required.
- Added multiline YAML block output for multiline fields (for example `ReleaseNotes`).

## Technical changes

### 1) Review YAML editor
- New `Edit YAML` toggle in Review.
- Inline textarea editor for active manifest tab.
- Edited content is used for copy/export.

Impacted file:
- `src/pages/StepReview.tsx`

### 2) YAML output formatting
- Removed global forced `"..."` formatting.
- Added scalar formatter with conditional quoting.
- Added block-scalar formatting (`|-`) for multiline text.

Impacted file:
- `src-tauri/src/yaml_generator.rs`

### 3) Version bump
- App version updated to `1.0.1`.

Impacted files:
- `package.json`
- `src-tauri/Cargo.toml`
- `src-tauri/Cargo.lock`
- `src-tauri/tauri.conf.json`
- `src/App.tsx`

## Build artifacts and SHA256 checksums

Checksums below match binaries produced by `npm run tauri build`.

| File | Size (bytes) | SHA256 |
|---|---:|---|
| `src-tauri/target/release/bundle/nsis/UniCreate_1.0.1_x64-setup.exe` | 11260435 | `915e55ce6ff3d9d5208828d77945749d9204948d02f06131ef9c8657aed045e9` |
| `src-tauri/target/release/bundle/msi/UniCreate_1.0.1_x64_en-US.msi` | 13373440 | `38e4d62808f28a6fb9f8f8f4551a66be497605455241788ee04c38330fc219e9` |
| `src-tauri/target/release/unicreate.exe` | 24451072 | `c293b1545ff2d21cf80541cf5c6b481e06997b5832ae5bfd23ee061a50fbac60` |