Release notes

World Monitor changelog

Paginated static release notes for World Monitor, built from the committed CHANGELOG.md file.

2.3.3 2026-02-16

Fixed

Keychain persistence: Enable apple-native (macOS) and windows-native (Windows) features for the keyring crate — v3 ships with no default platform backends, so API keys were stored in-memory only and lost on restart
Settings key verification: Soft-pass network errors during API key verification so transient sidecar failures don't block saving
Resilient keychain reads: Use Promise.allSettled in loadDesktopSecrets so a single key failure doesn't discard all loaded secrets
Settings window capabilities: Add "settings" to Tauri capabilities window list for core plugin permissions
Input preservation: Capture unsaved input values before DOM re-render in settings panel

Security / Fixed

CORS hardening: Tighten Vercel preview deployment regex to block origin spoofing (worldmonitorEVIL.vercel.app)
Sidecar auth bypass: Move /api/local-env-update behind LOCAL_API_TOKEN auth check
Env key allowlist: Restrict sidecar env mutations to 18 known secret keys (matching SUPPORTED_SECRET_KEYS)
postMessage validation: Add origin and source checks on incoming messages in LiveNewsPanel
postMessage targetOrigin: Replace wildcard '' with specific embed origin
CORS enforcement: Add isDisallowedOrigin() check to 25+ API endpoints that were missing it
Custom CORS migration: Migrate gdelt-geo and eia from custom CORS to shared _cors.js module
New CORS coverage: Add CORS headers + origin check to firms-fires, stock-index, youtube/live

Source: CHANGELOG.md. Page 11 of 14.