Features

• feat(settings): label a plugin's vault secret by its key's description by @meanaverage in #11765

Fixes

• fix(terminal): unbounded O(n²) output buffer for tabs that were never focused by @meanaverage in #11722
• fix(terminal): every closed tab leaks its terminal (WebGL cursor blink timer never disposed) by @meanaverage in #11720
• fix(terminal): closed sessions leak via PTY IPC listeners (destroy() re-entrancy) by @meanaverage in #11719
• fix(terminal): send current terminal size in the deferred initial resize by @anseltaft in #11760
• fix(terminal): don't steal focus from modal dialog inputs by @siparker in #11745
• fix(core): don't fire a hotkey twice for one keystroke by @bptrsn in #11769
• fix(app): keep the window draggable by its tab bar while a dialog is open by @meanaverage in #11766
• fix(ssh): pass PuTTY (.ppk) private keys to WinSCP without converting them by @manjotsc in #11767

New Contributors

• @meanaverage made their first contribution in #11719
• @siparker made their first contribution in #11745
• @manjotsc made their first contribution in #11767
• @bptrsn made their first contribution in #11769

Full Changelog: v1.0.237...v1.0.238

Features

• feat: Add Windows 11 Acrylic window support by @bluekani in #11481
• Add custom labels for individual split panes by @liewstar in #11613

Fixes

• ssh: fix session sometimes not ending when remote shell exits by @anseltaft in #11692
• Fix chained public key and keyboard-interactive authentication by @cofedish in #11492
• fix(ssh): allow blank passwords in profile and keychain auth by @uadhran in #11358
• fix(ssh): prevent port forwarding messages from polluting terminal output by @osm1892 in #11664
• fix: honour vault passphrase remember duration and clarify unlock modal by @uadhran in #11342
• fix(local): restore mouse scrolling in Windows TUIs by @liewstar in #11614
• fixed #11705 - gate fcitx fix on keydown by @Eugeny in 93a360b5

New Contributors

• @anseltaft made their first contribution in #11692
• @cofedish made their first contribution in #11492
• @liewstar made their first contribution in #11613

Full Changelog: v1.0.236...v1.0.237

Security fixes

• GHSA-8wmh-xr5f-qvj7: reject unsolicited agent-forwarding channels when agent forwarding is disabled — a malicious or compromised SSH server could otherwise reach the local SSH agent unsolicited in b091dc51

Changes

• Allow per-profile custom SSH $TERM by @H-TTTTT in #11480
• Add insert-new-line hotkey by @justtal in #11346
• Add searchable vault feature for saved connections by @xhatt in #11121
• Add long-press repeat for Enter key and retain search queries by @bluekani in #11389
• Add Hotkey to toggle Option/Meta key on Mac based Systems by @theredcmdcraft in #11385
• Added basic MRU tab switching #9961 by @aparfenov2 in #11311

Fixes

• fix(core): save tab recovery state before disabling it on close by @uadhran in #11621
• fix(ssh): parse X11 display specs without a screen number by @uadhran in #11620
• fix: do not hide docked window while a native dialog is open by @uadhran in #11622
• fix: show persistent activity indicator on background tab when bell fires by @uadhran in #11292
• fix(terminal): reset terminal modes on connectable session destroy by @uadhran in #11423
• fix(cli): CLI subcommands crash in v1.0.235 by @bluekani in #11513
• Default value of host changed from null to empty string by @ianaflous in #11558
• fix(ssh): import hosts without explicit HostName by @VALLIS-NERIA in #11598
• Fix Sogou IME commit when pressing Shift on Windows by @hymsk in #11650
• Fix Windows-only plugin install failures via broken postinstall/prepare scripts by @Blauschirm in #11525
• fix(local): only accept directories as the session CWD by @werner-balonius in #11592
• fix(ssh): try agent auth before disk publickey for imported profiles by @uadhran in #11357
• Fix window title not syncing with renamed tabs by @H-TTTTT in #11494
• Flash taskbar/dock icon when the terminal bell rings by @Yahiro025 in #11651
• fix(electron): guard window opacity and traffic-light IPC against closed windows by @fxd0h in #11524
• fix: add output encoding in releaseNotesTab.component.ts by @anupamme in #11535
• fix(build): remove unused dependencies and deprecated webpack loaders by @bluekani in #11386
• fix(ssh): surface SFTP upload errors by @chill-DA in #11640
• fix(terminal): fix Clear terminal hotkey action in PowerShell and Clink by @bluekani in #11405
• fix: release terminal resources on close by @nbb2025 in #11586
• fix(local): resolve guest cwd against the shell's fsBase before validating by @vjandrea in #11625
• fix(serial): fix serial quickConnect not working by @bluekani in #11384
• fix(terminal): refresh profile defaults on reconnect #9834 by @AngKernel in #11486
• feat(ssh): option to reopen duplicated/restored tabs in the last working directory by @singhible in #11502
• fix: avoid unnecessary GPU initialization on startup by @chvrs12 in #11673
• fix: make local file links clickable by @xnne-bot in #11666
• fix: invalid version fallback in pluginManager.service.ts by @anupamme in #11675
• fix(terminal): allow Fcitx5 to handle punctuation by @jairw955 in #11500
• Fix WSL sessions not starting in home directory on newer Windows builds by @sykuang in #11663
• Fix PowerShell 7 (pwsh) detection for Microsoft Store/MSIX installs by @sykuang in #11654
• fix(UAC): fix "Unknown verb -- 'inject '" error in CMD(clink) by @bluekani in #11367
• fix profile proxy usage by @Eugeny in 4d01477a

New Contributors

• @VALLIS-NERIA made their first contribution in #11598
• @hymsk made their first contribution in #11650
• @Blauschirm made their first contribution in #11525
• @werner-balonius made their first contribution in #11592
• @H-TTTTT made their first contribution in #11494
• @Yahiro025 made their first contribution in #11651
• @fxd0h made their first contribution in #11524
• @anupamme made their first contribution in #11535
• @chill-DA made their first contribution in #11640
• @nbb2025 made their first contribution in #11586
• @vjandrea made their first contribution in #11625
• @justtal made their first contribution in #11346
• @AngKernel made their first contribution in #11486
• @xhatt made their first contribution in #11121
• @singhible made their first contribution in #11502
• @chvrs12 made their first contribution in #11673
• @xnne-bot made their first contribution in #11666
• @jairw955 made their first contribution in #11500
• @sykuang made their first contribution in #11663
• @theredcmdcraft made their first contribution in #11385
• @aparfenov2 made their first contribution in #11311

Full Changelog: v1.0.235...v1.0.236

Security fixes

• GHSA-59p9-8gwf-v9v7: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory

Changes

• feat(core): add pinned tabs by @tyr1k in #11146
• Sort baud rate selector by numeric order by @bluekani in #11297
• feat: Add mouse wheel support for hotkeys by @bluekani in #11324
• [Feature] Group nesting "folders" & Profile tree view by @D3VL-Jack in #10788
• Make keyboard-interactive auth URLs clickable by @puneetdixit200 in #11327
• Bundle MSVC runtime DLLs in Windows portable packages by @bluekani in #11372
• Adding Cool Retro Term Amber theme by @saudiqbal in #11337
• [FEATURE] refresh Windows environment variables from registry for new sessions by @MicroGery in #11321
• fix(terminal): expose debug hotkeys in settings for remap/disable by @uadhran in #11420
• feat: add Connect, Disconnect, and Reconnect buttons to serial tab toolbar by @uadhran in #11288

Fixes

• fix: restore terminal redraw after tab reactivation by @uadhran in #11275
• fix: Plugins search by @bluekani in #11330
• fix(terminal): restore transparent background when vibrancy is enabled by @Specboss in #11326
• fix: Restore hotkey edit and remove actions by @bluekani in #11374
• fix: Exclude unnecessary Windows build artifacts by @bluekani in #11371
• fix: Pin Windows build runner to windows-2022 by @bluekani in #11370
• fix(terminal): reset stale DEC modes on connectable reconnect by @balajieswaramoorthi in #11368
• fix(ssh): prevent keepalive flooding by mapping null/0 keepaliveInterval to undefined by @linzack in #11340
• fix: ZMODEM transfer by @ruanimal in #11319
• fix(ssh): honor profile port settings on connect by @uadhran in #11366
• fix(terminal): robust context loss recovery and direct DOM fallback during GPU resets by @Gerry9000 in #11354
• fix(settings): guard hotkey config lookup for missing plugin paths by @uadhran in #11422
• fix(terminal): restart visual bell shake on repeated BEL by @uadhran in #11388
• fix: handle vault unlock modal cancellation gracefully by @uadhran in #11356
• feat: Add dropdown arrow to form-select elements by @bluekani in #11399
• fix(ssh): prevent SFTP path navigation freeze by @A-Words in #11393
• fix: replace exec() with execFile() to prevent shell injection in shellIntegration.service by @uadhran in #11290
• fix: replace exec() with execFile() to prevent shell injection in app.ts by @uadhran in #11289

New Contributors

• @cayenne17 made their first contribution in #11284
• @bluekani made their first contribution in #11297
• @D3VL-Jack made their first contribution in #10788
• @puneetdixit200 made their first contribution in #11327
• @Specboss made their first contribution in #11326
• @balajieswaramoorthi made their first contribution in #11368
• @linzack made their first contribution in #11340
• @saudiqbal made their first contribution in #11337
• @Gerry9000 made their first contribution in #11354
• @MicroGery made their first contribution in #11321
• @tyr1k made their first contribution in #11146
• @A-Words made their first contribution in #11393

Full Changelog: v1.0.234...v1.0.235

Security fixes

GHSA-m937-jm93-pfp6

• Dragging and dropping a file with a specially crafted name onto the terminal could cause the terminal to execute an arbitrary command contained in the file name.

Features

• auto-sudo-password multi language and sudo-rs support (#11019) #11019 (Ponder)
• add 'Export to file' option to terminal context menu (#11109) #11109 (Utkarsh Adhran)

Fixes

• improve transfer menu readability (#11272) #11272 (mouse)
• b82ac4c: Make macOS build fail if code signing fails (#11255) (Copilot) #11255
• b0c2f5f: handle keytar password load errors (Eugene)
• 012a62d: Fix CLI crashes on Wayland due to unhandled X11 error in Glasstron (#11264) (Chris McGrath) #11264
• 03e9aa0: fixed #11283 - missing terminal titles (Eugene)

Changes

• ssh: add hotkey to open SFTP panel (#11106) #11106 (Utkarsh Adhran)
• add refresh button for SFTP (#11047) #11047 (Ponder)
• bf91668: Bundle Visual C++ Redistributable in Windows NSIS installer (#11060) (JosephMcEvoy) #11060

Fixes

• configSync: require HTTPS for sync host to prevent MITM RCE (#11228) #11228 (Sebastion)
• disable spellchecker to prevent automatic dictionary downloads (#11107) #11107 (Utkarsh Adhran)
• hide blacklisted profiles from OS dock/taskbar menu (#11108) #11108 (Utkarsh Adhran)
• remove unsafe exec() in UAC.cpp (#11195) #11195 (orbisai0security)
• use switchMap instead of flatMap for plugin search to prevent st… (#11089) #11089 (Varun Subramanyan)
• improve agent authentication error handling and socket path validation (#11034) #11034 (ayaya)
• fix UI degradation with large SSH config files. Issue #11078 (#11094) #11094 (hsdelirium)
• 9152306: add user confirmation for zmodem transfers
• 45fa605: Hide all keyboard-interactive prompts where server indicates no echo - not just "password" ones
• e70fafd: remove control characters from dropped paths
• 9eff849: prompt before running commands via protocol handler
• bca5138: fix group selector in profile editing modal
• 6e47c2f: add user warning for the tabby:// paste commands
• 4c4b1f0: Fix themed backgrounds for side tabs and title bar (#11219) (nguyenhuukhoi) #11219
• 220f719: Add option to replace line breaks with spaces on paste (#11218) (iroaK) #11218
• 25ca30e: Implement write queue for Zmodem transfer (#11155) (gmd20) #11155
• 0e9c570: Fix frosted glass persistence (#11083) (Utkarsh Adhran) #11083
• 2e85f8d: generate 256 palette (#11043) (jake-stewart) #11043
• 78a5632: Fix OSC 11 background color reporting (#11074) (Utkarsh Adhran) #11074

Security fixes

GHSA-cmpc-v2x9-j9x9

• fb9bec8: Tabby now warns when opening clickable application URIs in the terminal.

Fixes

• 56908f4: fix incorrect imports in tabby-ssh (Eugene)

Changes

• ssh: pre-populate vault password in auth prompts for MFA (fixes #9911) (#11170) #11170 (syrexjohnson)
• 8506173: Add SFTP context menu download for files (#10971) (Leonardo Berbert) #10971
• Implement tabby:// URL scheme handler (#11005) #11005 (Ponder)
• Allow third-party plugins to add quick connection support. (#11004) #11004 (Ponder)

Fixes

• pluginsSettingsTab.component.pug: flex wrapper for gap in buttons (#10986) #10986 (Grovvik)
• upgraded webpack from 5.86.0 to 5.104.1 to fix ES6 class extension bug with xterm.js v6. (#11007) #11007 (Ponder)
• handle OSC sequences split across buffer chunks (#11144) #11144 (ToastyTheBot)
• terminal: prevent scroll-to-top race during fast output (#11102) #11102 (Phil Condreay)
• 4566a91: Fix hiding the app from macos dock when docking is enabled (#10960) (SergeBakharev) #10960
• 10a4f54: fixed recovered tabs crashing after upgrade - fixes #10619, fixes #10635, fixes #10672, fixes #10682, fixes #10688, fixes #10730, fixes #10843
• 18bca3e: Fix trailing semicolons in clickable URLs (#11166) (chaoliang yan) #11166
• abc16d2: fixed #10131 - bump russh to prevent auto-disconnects
• c3ede45: Disable global shortcuts on older plasma versions (#11157) (Mario Limonciello) #11157
• 5d5ac4d: bump xterm (#10974) #10974

Full Changelog: v1.0.230...v1.0.231

Fixes

• 2d01b9a: fixed #10580, fixed #10558, fixed #10237, fixed #8450 - fixed X11 forwarding (Eugene)
• ssh: add EOF handling and error propagation for port forwarding (#10964) #10964 (ajkrj)
• include http proxy settings in ssh multiplexer key (#10943) #10943 (TheBlind)
• ssh: fix windows openssh agent detection logic (#10954) #10954 (Andy_Allan)
• 315083d: Packagecloud_upload_for_Debian_forky_duke (#10890) (gh-log) #10890

Features

• ssh: support agent authentication using specific public key identity (#10953) #10953 (Andy_Allan)

Fixes

• 5246355: Disable SSH compression by default as a workaround for SFTP upload bugs (Eugene)
• adjust ssh config time resolution (#10803) #10803 (osm1892)
• unexpected configuration was selected in the recent profiles (#10817) #10817 (Kairlec)

Changes

• 2cf6ef0: Add support to connect in winscp throug tunnel. (#10829) (Indigo.liu) #10829
• 4f14e92: Bumped node-pty