chore: version bump

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -1,6 +1,55 @@
 # Changelog
 
 
+## v0.28.0 (2026-07-08)
+
+### Features
+
+- ipv6 support for wireguard
+- per-profile window color with id-derived default
+- emit extension sync-status events
+
+### Bug Fixes
+
+- background status/update loop and window-color command
+- sync engine correctness and manifest traversal guard
+- replace create-profile Back button with Close
+- don't start window drag on interactive controls
+- self-reap proxy worker off-runtime and redact upstream creds in logs
+- resolve VPN SOCKS5 domain CONNECT requests through the tunnel
+- persist imported session cookies so logins survive relaunch
+
+### Refactoring
+
+- handle newer wayfern versions
+- fully deprecate camoufox
+- cleanup
+- better handling of unstable connection during asset downloads
+- backend-authoritative team scope and config/input hardening
+
+### Documentation
+
+- readme
+- agents
+
+### Maintenance
+
+- chore: version bump
+- chore: rename macos artifacts in ci
+- chore: lint
+- chore: copy
+- chore: linux ci
+- chore: update dependencies
+- chore: migrate biome config and exclude build dirs
+- ci(deps): bump the github-actions group with 6 updates
+- ci(deps): bump anomalyco/opencode/github in the github-actions group (#480)
+- chore: update flake.nix for v0.27.1 [skip ci] (#464)
+
+### Other
+
+- security: restrict secret files to owner-only (0600)
+
+
 ## v0.27.1 (2026-06-24)
 
 ### Features

README.md

@@ -46,7 +46,7 @@
 
 | | Apple Silicon | Intel |
 |---|---|---|
-| **DMG** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_aarch64.dmg) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_x64.dmg) |
+| **DMG** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_aarch64.dmg) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_x64.dmg) |
 
 Or install via Homebrew:
 
@@ -56,15 +56,15 @@ brew install --cask donut
 
 ### Windows
 
-[Download Windows Installer (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_x64-setup.exe) · [Portable (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_x64-portable.zip)
+[Download Windows Installer (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_x64-setup.exe) · [Portable (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_x64-portable.zip)
 
 ### Linux
 
 | Format | x86_64 | ARM64 |
 |---|---|---|
-| **deb** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_amd64.deb) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_arm64.deb) |
-| **rpm** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut-0.27.1-1.x86_64.rpm) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut-0.27.1-1.aarch64.rpm) |
-| **AppImage** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_amd64.AppImage) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_aarch64.AppImage) |
+| **deb** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_amd64.deb) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_arm64.deb) |
+| **rpm** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut-0.28.0-1.x86_64.rpm) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut-0.28.0-1.aarch64.rpm) |
+| **AppImage** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_amd64.AppImage) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_aarch64.AppImage) |
 <!-- install-links-end -->
 
 Or install via package manager:

flake.nix

@@ -96,17 +96,17 @@
         pkgConfigPath = lib.makeSearchPath "lib/pkgconfig" (
           pkgConfigLibs ++ map lib.getDev pkgConfigLibs
         );
-        releaseVersion = "0.27.1";
+        releaseVersion = "0.28.0";
         releaseAppImage =
           if system == "x86_64-linux" then
             pkgs.fetchurl {
-              url = "https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_amd64.AppImage";
-              hash = "sha256-TrqCu+P3Gy39hmg77U/jCn6uV06bZyj143Q5TFSDc/w=";
+              url = "https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_amd64.AppImage";
+              hash = "sha256-m3C2WJ2xPT8jkC9HYS0vpBOmqkFEwHTQZ08HgwRb/Dg=";
             }
           else if system == "aarch64-linux" then
             pkgs.fetchurl {
-              url = "https://github.com/zhom/donutbrowser/releases/download/v0.27.1/Donut_0.27.1_aarch64.AppImage";
-              hash = "sha256-iubnx2VnF/3yywdhJICD8g7bQMP8yh4yCs+HLmrUYAI=";
+              url = "https://github.com/zhom/donutbrowser/releases/download/v0.28.0/Donut_0.28.0_aarch64.AppImage";
+              hash = "sha256-1D+eX51o65RFiTL1IZTYUaWUBys23AIXRtcW9n2vtCg=";
             }
           else
             null;

package.json

@@ -2,7 +2,7 @@
   "name": "donutbrowser",
   "private": true,
   "license": "AGPL-3.0",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "type": "module",
   "scripts": {
     "dev": "next dev --turbopack -p 12341",

src-tauri/Cargo.lock

@@ -1797,7 +1797,7 @@ dependencies = [
 
 [[package]]
 name = "donutbrowser"
-version = "0.28.0"
+version = "0.28.1"
 dependencies = [
  "aes 0.9.1",
  "aes-gcm 0.11.0",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "donutbrowser"
-version = "0.28.0"
+version = "0.28.1"
 description = "Simple Yet Powerful Anti-Detect Browser"
 authors = ["zhom@github"]
 edition = "2021"

src-tauri/src/wayfern_manager.rs

@@ -96,8 +96,12 @@ impl WayfernManager {
       inner: Arc::new(AsyncMutex::new(WayfernManagerInner {
         instances: HashMap::new(),
       })),
+      // CDP is always on loopback. Disable env/system proxies so a Windows
+      // WinHTTP/IE proxy (or HTTP_PROXY) cannot intercept /json/version and
+      // return 502 Bad Gateway while the browser is actually listening.
       http_client: Client::builder()
         .timeout(Duration::from_secs(2))
+        .no_proxy()
         .build()
         .expect("Failed to build reqwest client for wayfern_manager"),
     }
@@ -416,7 +420,6 @@ impl WayfernManager {
       .arg(format!("--remote-debugging-port={port}"))
       .arg("--remote-debugging-address=127.0.0.1")
       .arg(format!("--user-data-dir={}", temp_profile_dir.display()))
-      .arg("--disable-gpu")
       .arg("--no-first-run")
       .arg("--no-default-browser-check")
       .arg("--disable-background-mode")

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Donut",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "identifier": "com.donutbrowser",
   "build": {
     "beforeDevCommand": "pnpm copy-proxy-binary && pnpm dev",