Skip to content

Release history

figranium releases

Build complex browser workflows visually and execute them via API.

All releases

49 shown

v0.12.2 Security relevant
Security fixes
  • Ollama SSRF hardening with strict settings and API target validation
Notable features
  • Cron next-run calculation optimization
  • Sandbox proxy optimization for extraction flows
  • Block editing interaction improvements
v0.12.1 Mixed
⚠ Upgrade required
  • Extraction scripts must be migrated to use data.html() instead of $$data.html().
  • Explicitly enable ALLOW_PRIVATE_NETWORKS if internal network access via Docker bridges is required.
Breaking changes
  • ALLOW_PRIVATE_NETWORKS is now disabled by default, which may block access to internal networks.
  • Extractor scripts migrated to use data.html() instead of $$data.html().
Security fixes
  • Blocked host.docker.internal in SSRF protection via url-utils.js to prevent internal network probes via Docker bridges.
Notable features
  • Global AI model settings for OpenAI, Anthropic, Gemini, etc.
  • Get Content action to extract full page content and store it as a variable
v0.12.0 Mixed

Added Ollama integration for local LLM support in CSS selector and script generation. Overhauled DOM context cleaning by stripping non-essential tags/attributes to reduce token usage. Introduced HTTP Request action blocks for API interaction. Implemented CSP headers, SSRF protection, and WeakMap caching.

v0.11.4 Security relevant
Security fixes
  • SSRF via webhook redirects and Baserow output provider
  • Sandbox escape via getPrototypeOf
  • Session security hardening with httpOnly cookies and HSTS
Notable features
  • Dashboard task search with keyboard shortcuts
  • Performance improvements including 70x table detection speedup
v0.11.2 Security relevant
Security fixes
  • Sandbox escape in extraction scripts via unproxied this
Notable features
  • Sticky notes with markdown rendering and colors
  • Editor performance (23x speedup)
  • Agent execution optimization (32% reduction)
v0.11.1 Security relevant
Security fixes
  • Cross-Site WebSocket Hijacking (CSWSH)
  • IP spoofing in auth bypass
  • Removed vulnerable openssl package
Notable features
  • FigClaw programmatic execution backend
  • Execution concurrency limiter
  • Webhook support for task completion
v0.11.0 Security relevant
Security fixes
  • Protocol validation bypass in validateUrl
  • SSRF protection for IPv6 and private networks
  • Login timing-safe comparison
Notable features
  • Questrial font replacement
  • Auto-enable inspect mode
  • Larger page headings
v0.10.1 Security relevant
Security fixes
  • SSRF protection via URL validation and credential sanitization
  • Session security hardening with regeneration and inactivity timeouts
Notable features
  • Sliding session TTL
  • Headful storage state sync on close
  • Tab focus standardization
v0.10.0 New feature
Security fixes
  • Path traversal vulnerability in agent start action
  • Timing-safe login comparison
Notable features
  • Stealth plugin and persistent browser profiles
  • Baserow output provider
  • O(1) execution lookup via Map cache
v0.9.6 New feature
Security fixes
  • Security headers implementation
  • Protected static asset access
  • JSON payload limit reduction to 2mb
Notable features
  • Task scheduling with visual and cron modes
  • Real-time scheduling monitoring
  • Conditional DOM fetching optimization
v0.9.4 Bug fix
Security fixes
  • IPv6 SSRF bypass prevention
  • Authentication bypass in development environments
Notable features
  • Proactive cookie injection for cross-domain SSO
  • In-memory API key caching (32x speedup)
  • Keep-alive SSE heartbeats
v0.9.3 New feature
Notable features
  • Drag-and-drop block reordering
  • Bulk context menu operations
  • Top 5 selector highlights
v0.9.2 New feature
Notable features
  • API keys configuration in editor
  • Dashboard redesign with dark aesthetic
  • Action palette as 2-column grid
v0.9.1 Maintenance
Notable features
  • Standalone CLI for scrape/agent/headful modes
  • GitHub Actions auto-deployment to NPM
  • Improved editor grid visibility
v0.9.0 New feature
Notable features
  • Infinite canvas with pan/zoom
  • Task settings cabinet consolidation
  • Version history and variable management tabs
v0.8.1 New feature
Notable features
  • Cursor Glide: smooth Bezier curve mouse movement with ease-in/ease-out and distance-scaled speed (15–60 steps)
  • Click Retry: automatic click verification via elementFromPoint with up to 3 retries and Playwright fallback
  • AI Selector extended to Scroll action blocks
Full changelog

Cursor Glide

A new Cursor Glide option in Behavior Config makes the mouse move at a natural, human-like pace instead of teleporting between targets. When enabled:

  • Cursor follows a smooth Bezier curve with ease-in/ease-out
  • Movement speed scales with distance (15–60 steps)
  • Position is tracked across actions — no jumps between clicks

Off by default. Enable it in Behavior Config → Cursor Glide.

Click Retry

Clicks are now automatically verified using elementFromPoint. If a click misses the target (e.g. due to layout shift), the agent will:

  • Re-resolve the element's position
  • Retry up to 3 times
  • Fall back to a forced Playwright click if all retries fail

Retry attempts are logged for visibility.

AI Selector for Scroll

The AI selector finder (magic wand icon) is now available on Scroll action blocks, matching the existing behavior for click, type, and hover actions.

Performance

  • Memoize ResultsPane state to prevent flickering and network spam

UI/UX

  • Executions Refresh UX improvement
  • Remove Reset Keys and Toggle Caps buttons from noVNC viewer
  • Add ARIA labels to icon-only buttons in API Keys Panel

Full Changelog: https://github.com/mnemosynestack/doppelganger/compare/v0.8.0...v0.8.1

v0.8.0 New feature
Notable features
  • AI selector generator via Gemini
  • Smart locational interactions
  • Multiple API keys support
v0.7.3 New feature
Security fixes
  • CGNAT IP range blocking (100.64.0.0/10)
Notable features
  • Task undo/redo support
  • Ctrl+K Action Palette shortcut
v0.7.2 New feature
Notable features
  • Rotating proxy pool configuration
  • Multi-selection and bulk deletion with Shift-Click
v0.7 New feature
Security fixes
  • Environment variable leak in extraction worker
Notable features
  • Task export selection modal
  • File downloads with ZIP bundling
  • PostgreSQL database support
v0.6.7 Maintenance

Material Icons added to editor, settings, and dashboard screens. General UI improvements across all screens for visual consistency.

v0.6.6 Security relevant
Security fixes
  • 0.0.0.0/8 IP range blocking
  • Hardened API key loading process
Notable features
  • Disk I/O caching for loadTasks
  • Visual loading indicators and ARIA busy states
v0.6.4 Security relevant
Security fixes
  • PBKDF2-hardened API key storage
  • Double HMAC timing attack prevention
Notable features
  • Navigate To action block
  • HTML template variable support
v0.6.3 New feature
Notable features
  • Password visibility toggle
  • Action palette keyboard navigation
  • Discord release notifications
v0.6.1 New feature
Notable features
  • Autosave implementation
  • Manual version creation
  • Text input blur-save
v0.6 New feature
Security fixes
  • SSRF vulnerability mitigation
  • IP range validation improvements
Notable features
  • Native ARM support
  • Modular architecture refactoring
  • Dashboard enhancements
v0.5.8 Security relevant
Security fixes
  • Server-side code injection (RCE) in scrape.js
  • Extraction script execution RCE
  • Event loop blocking prevention
v0.5.7 New feature
Notable features
  • Disable automated recording switch
  • Stateless execution toggle
v0.5.6 Security relevant
Security fixes
  • SSRF hardening via localhost-only agent calls
  • Rate limiting on auth endpoints
  • Secure cookies in production
0.5.5 New feature

Exposed `APP_VERSION` via `src/utils/appInfo.ts` to enable version display within the application. Added `VersionPanel` to the system tab to allow users to/from copy the running package version.

0.5.4 New feature

Implemented unsaved-task protection by tracking serialized task state, disabling the "Save" button when no changes are detected, and adding a `beforeunload` hook to warn users of pending edits. Updated `App.tsx` and `EditorLoader` to manage and propagate the propagate `hasUnsavedChanges` flag and dirty flag resets.

0.5.3 Mixed

Added AGENTS.md for contributor guidance and compliance. Refreshed README with updated Docker/npm instructions. Enhanced editor features with type block Mode dropdown (replace vs append) and Press block modifier checkboxes and key dropdowns. Updated Action.typeMode definition and agent runtime to support new modes. Added npm-publish.yml workflow for automated publishing.

v0.5.2 Mixed

Implemented `react-window` virtualization in captures screen, settings panel, executions history, and capture modal to improve scrolling performance and prevent UI freezes during long history loads. Introduced `CaptureCard` component and `caputreEntry` type to unify the UI.

v0.5.1 Mixed

Updated Playwright base image to v1.57.0-jammy and hardened APT installs. Improved Docker recording reliability via --disable-dev-shm-usage, explicit video sizing, and EXDEV-safe moves. Polished dashboard scroll with a top fade overlay and updated proxy rotation tooltip guidance.

v0.5 Mixed

Introduced automatic webm screen recordings, a dedicated Captures screen, and an API endpoint (/api/data/captures) for managing captures. Added proxy rotation mode configuration, User Agent settings, and a task-level viewport rotation toggle. Updated the While block editor to use structured fields.

v0.4.3 Bug fix

Fixes three bugs in the Start Task block: it now calls the local server at the correct host and port, stores the server's returned data in {$block.output} for use by downstream blocks, and correctly populates the dropdown with other available tasks.

v0.4.2 New feature

Added proxy import from text files via bulk add host:port:user:rass, and a backend endpoint for proxies. The Proxies UI now includes an Import button.

v0.4.1 Mixed

Added NoVNC support to the headful viewer with a fullscreen toggle and updated the Docker image to include NoVNC tooling and VNC entrypoint. Disabled proxy rotation when only the host IP is available to prevent invalid settings. Updated sidebar logo sizing.

v0.4 Mixed

Updated headful viewer to default to native browser windows and use NoVNC only in containers. Disabled proxy rotation toggle when only host IP is available to prevent invalid settings. Applied minor UI polish to sidebar logo sizing.

v0.3.8 Mixed

Added a CLI entry point and postinstall script to streamline setup, fixed headful noVNC proxying, and reduced production log noise by gating auth and setup debug logging behind NODE_ENV.

v0.3.6 Mixed

Added live action status borders in the editor, a stop button for agent runs, and noVNC controls for stuck keys. Improved agent extraction with CSV support and script handling, implemented session persistence via long/long-lived cookies, and added port auto-fallback.

v0.3 Mixed

Added execution detail view, execution history routing, and task snapshots for history playback and 'run snapshot' functionality. Introduced 10 new agent blocks: If/Else, While, Repeat, For Each, Stop Task, On/Error, On Error, Set Variable, CSV, Start Task, and Merge. Added CSV output support with table view, export, and copy options. Improved toast notifications, ResultsPane, and shadow DOM capture. Fixed JSON editor issues and UI layout/panel updates.

Beta — feedback welcome: [email protected]