Security batch: path containment across Electron FS sinks, log XSS hardening, handoff URL allowlists, Docker name guards, Electron 39, and workflow least-privilege.
Shipped 12 Aug 2026 · Full changelog · Download for Mac

Added

• Shared safePath helpers — all project/userData/home file IO asserts containment
• Loopback-only guards for local HTTPS proxy upstreams and customLocalUrl / openExternal
• Rig-managed Docker container/volume name checks before docker rm

Fixed

• Log viewer / WebLogger: HTML-escape ANSI output; env rows built with DOM APIs
• Electron upgraded 37 → 39.8.10 (EOL + advisories)
• fast-uri / jose overrides to patched versions
• GitHub Actions release workflows: least-privilege permissions + persist-credentials: false
• Local dashboard Express binds to 127.0.0.1; websocket forced to loopback
• ensure-electron finds hoisted monorepo node_modules/electron

Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.