Skip to content

docs: finalize 3.1.0 release notes #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
osmcgrgenc merged 2 commits into from
Sep 28, 2026
Merged

docs: finalize 3.1.0 release notes #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e6e0208
docs: finalize 3.1.0 release notes
osmcgrgenc Sep 28, 2026
69a3979
docs: drop the stale in-progress release note
osmcgrgenc Sep 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,22 @@
All notable changes to MacOptimizer Pro are documented in this file. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/).

## [3.1.0] - Unreleased
## [3.1.0] - 2026-09-29

The safety release. v2.1.0–v3.0.0 contain known safety defects; use v3.1.0 or later.

### Release

- First Developer ID-signed, hardened-runtime and notarized release, shipped as a universal
(Apple silicon and Intel) DMG. One version source (`VERSION`); the release script signs,
notarizes, staples and verifies. (#21)
- New app icon. (#24)
- The dashboard quit button, like every other process-termination path, now asks for
confirmation and sends SIGTERM. The Autonomous Guard's terminate button now shows its
confirmation dialog on its own screen. (#23)
- The App Manager screens are localized; the CLI prints English labels only; the offline
assistant shows a localized system summary. (#20)

### Security

- Removed a command injection in the update screen: a remote Sparkle appcast could make the app
Expand Down Expand Up @@ -58,11 +70,6 @@ The safety release. v2.1.0–v3.0.0 contain known safety defects; use v3.1.0 or
(#2, #6, #7)
- Gitleaks runs as a CLI in CI. (#2)

### Release (in progress)

- Developer ID signing, notarization and one version source for the app, the CLI and the tag are
being prepared. They are not merged yet.

## [2.2.0] – [3.0.0] - 2026-08-28

Released the same day as 2.1.0 without changelog entries; see the
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# MacOptimizer Pro

> **Safety notice:** Releases [v2.1.0–v3.0.0](https://github.com/Codifya/MacOptimizer/releases) contain known safety defects. Do not use them; use v3.1.0 or later. v3.1.0 is being prepared now and will be the first Developer ID-signed and notarized release.
> **Safety notice:** Releases [v2.1.0–v3.0.0](https://github.com/Codifya/MacOptimizer/releases) contain known safety defects. Do not use them; use [v3.1.0](https://github.com/Codifya/MacOptimizer/releases/tag/v3.1.0) or later, the first Developer ID-signed and notarized release.

<div align="center">

Expand Down Expand Up @@ -125,7 +125,7 @@ MacOptimizer help

### Download a release

Signed and notarized DMGs start with **v3.1.0**, which is being prepared now. Earlier releases
Signed and notarized DMGs start with **v3.1.0**. Earlier releases
(v2.1.0–v3.0.0) were not notarized and contain known safety defects. Do not use them.

### Build from source
Expand Down
13 changes: 7 additions & 6 deletions ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ injection in the update screen, deletion paths without preview or confirmation,
as successful when commands failed, and documentation that claimed more than the code did. Do not
use those releases.

## v3.1.0 — Safety release (in progress)
## v3.1.0 — Safety release (released 2026-09-29)

Done (merged to `main`):

Expand All @@ -28,16 +28,17 @@ Done (merged to `main`):
- [x] English and Turkish localization, following the system language.
- [x] Documentation aligned with the code.

Remaining:

- [ ] One version source for the app, the CLI and the release tag.
- [ ] Developer ID signing, hardened runtime, notarization and stapling of the DMG.
- [x] One version source for the app, the CLI and the release tag.
- [x] Developer ID signing, hardened runtime, notarization and stapling of the DMG.
- [x] App icon.

## Later (not scheduled)

- Split `AppState` into smaller feature models and inject services.
- Merge `Helpers/SafetyGuard` into the `Core/Security` policies.
- App icon, and applying the menu bar extra setting.
- Applying the menu bar extra setting.
- CLI `status`: English-only power source and uptime formatting.
- Autonomous Guard: keep an alert open when the user cancels the terminate dialog.
- Verify Homebrew update detection against current `brew` JSON output.
- Instruments measurements for the figures still marked `REQUIRES_INSTRUMENTS_VALIDATION` in
[docs/PERFORMANCE_BASELINE.md](docs/PERFORMANCE_BASELINE.md).
4 changes: 2 additions & 2 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ problem.

| Version | Status |
| --- | --- |
| 3.1.0 and later | Supported. v3.1.0 is being prepared and will be the first Developer ID-signed and notarized release. |
| 3.1.0 and later | Supported. v3.1.0 is the first Developer ID-signed and notarized release. |
| 2.1.0 – 3.0.0 | **Not safe. Do not use.** These releases contain known safety defects: a command injection in the update screen, and deletion paths that skipped the preview and confirmation. They were ad-hoc signed and not notarized. |

## Deletion pipeline
Expand Down Expand Up @@ -86,7 +86,7 @@ to the Keychain.
| Command injection | No shell; allow-listed executables; argument filtering; validated Homebrew tokens | — |
| Killing critical processes | PID and name/path protection lists; confirmation for force quit and AI suggestions | Name lists are maintained by hand |
| Data sent to the cloud | NVIDIA NIM is off by default and needs a disclosure; app names need a separate opt-in | See [PRIVACY.md](PRIVACY.md) for exactly what is sent |
| Tampered downloads | From v3.1.0: Developer ID signature and notarization (in preparation), plus GitHub build-provenance attestation | Releases up to v3.0.0 were not notarized |
| Tampered downloads | From v3.1.0: Developer ID signature and notarization, plus GitHub build-provenance attestation | Releases up to v3.0.0 were not notarized |

The app is not sandboxed and has no privileged helper. It runs with your user's permissions only.
There is no audit log of file operations; the History screen lists completed operations from
Expand Down
Loading