## ravindu644/Droidspaces-OSS — v6.4.5…v6.5.0

_113 commits._

### Features
- **feat(systemd): add unit inspection and override.conf editing (#260)** (b5d4f34)
- **feat(ui): swipe between service filter categories on the service list** (893eaec)
- **app: add launcher long-press shortcuts** (7ba97ee)
- **Add POCO F6 / Redmi Turbo 3 (peridot) — DroidSpaces LXC mode, working (#242)** (12859a9)
- **feat(ui): Swipe to switch between home, containers, and control panel tabs (#241)** (37d7154)

### Fixes
- **fix: detect MSS clamp and port-forward removal in the rule probe** (3c9821f)
- **fix: reinstall host network rules when netd flushes them** (cf9f008)
- **app: fix: bump termux terminal to 0.118.3 so fish stops printing "5u"** (ab96668)
- **fix: report user namespaces as optional, not a hardening regression** (0388a54)
- **Fix blurry launcher icon on Xiaomi tablet desktop and dock (#253)** (0e022a2)
- **fix(monitor): drain console PTY master in background mode (#247)** (9096c5a)
- **fix(security): detach terminal session client on dispose to stop Activity leak** (3b22762)
- **fix(security): quote container-derived paths and drop unsafe names on config load** (6eed430)
- **fix(security): reject control characters in single-line container-config values** (01a7bb8)
- **fix(security): fail closed when the rootfs validator cannot run** (f7b3ce4)
- **fix(security): remove unused RECEIVE_BOOT_COMPLETED permission and no-op BootReceiver** (c0af39d)
- **fix(ui): disable Check Requirements button when backend is missing or corrupted** (523436a)
- **fix(ui): make Accent Color settings row background match sibling rows** (2c85869)
- **fix(security): enforce HTTPS for rootfs repos and block cleartext traffic** (e448468)
- **fix(security): disable allowBackup on the root-privileged app** (5c4ba1c)
- **fix(security): allow-list container name and user before building su -c payload** (241bfaf)
- **fix(security): quote bare rm -rf path in installer cleanup** (299d654)
- **fix(security): shell-quote imgPath in disk-usage stat command** (3055be0)
- **fix(security): shell-quote file-picker paths in root ls/test commands** (2cc3b3c)
- **fix(security): validate systemd/openrc service names to prevent host-root command injection** (842c816)
- **Revert "fix(security): refuse to load a group/other-writable config"** (ecf412c)
- **fix(ui): jump directly between tabs instead of scrolling through them** (462ddce)
- **fix(net): re-base jump verdicts on raw iptables delete (fixes ELOOP)** (6b63827)
- **fix(net): actually remove DS iptables rules on cleanup; stop phantom drop logs** (9696c76)
- **fix(net): keep uplink route monitor alive across internal reboots** (f87862f)
- **fix(security): validate container mount marker before host bookkeeping** (a8a0a29)
- **fix(security): bounds-check 4-byte netlink attribute reads** (e168073)
- **fix(security): guard nl_nest_end against a NULL nest pointer** (247e6ca)
- **fix(security): validate container_ip before the iptables shell sweep** (86c2f58)
- **fix(security): use async-signal-safe write() in SIGINT handler** (70ef5f4)
- **fix(security): scrub LD_*/IFS env before the daemon re-execs as root** (5fd8a2f)
- **fix(security): validate port_forwards proto in the config parser** (4371206)
- **fix(security): replace weak rand() UUID fallback with getrandom(2)** (267714d)
- **fix(security): add SOCK_CLOEXEC to transient AF_INET sockets** (feb7586)
- **fix(security): use atomic close-on-exec for transient fds** (6601337)
- **fix(security): add O_NOFOLLOW to bind_vfile target creation** (b0e3ffe)
- **fix(security): clamp gen_uptime out_len to bytes actually written** (2117b89)
- **fix(security): fix format-string arg mismatch in domount_silent** (af4a123)
- **fix(security): guard size==0 underflow in sanitize_container_name** (9fb229a)
- **fix(security): set SOCK_CLOEXEC on route-monitor and DHCP sockets** (6a73f76)
- **fix(security): write sysvinit initctl only through a verified FIFO** (59ddf21)
- **fix(security): reject socket peers outside the daemon PID namespace** (79449ca)
- **fix(security): force NUL-termination of socketd wire target field** (2c46cff)
- **fix(security): refuse to load a group/other-writable config** (174b75c)
- **fix(security): create pidfile and container.config non-world-writable** (e5d47e7)
- **fix(security): safe temp-file creation, reject symlinked bind targets** (7be27b9)
- **fix(security): pin bind-mount target inode to defeat symlink swap race** (995fe9b)
- **fix(security): length-aware growth in gen_stat() /proc/stat buffer** (eb3824b)
- **fix(security): check getgrouplist() return in daemon peer auth** (71e5368)

### Backend
- **droidspaces: bump v6.5.0** (7e67165)
- **Translated using Weblate (Chinese (Simplified Han script)) (#274)** (2635482)
- **src: app: re-ordered korean locale in the locales_config.xml** (8644b60)
- **formatted src/seccomp.c -s** (e6df0e3)
- **app: drag to reorder upstream interfaces in container config** (fdca598)
- **Korean Resource Activation  (#269)** (6f31e04)
- **Translated using Weblate (Chinese (Traditional Han script)) (#266)** (761d4a1)
- **UI imporvements (#264)** (b528c28)
- **Translated using Weblate (Korean) (#258)** (7412f6f)
- **app: refactor: localize strings introduced by unit inspection/override editor** (5d19d89)
- **seccomp: block KSU magic-reboot fd install and neutralize GRANT_ROOT escape (#262)** (5228bf7)
- **post: Implement Devuan-specific umount script patches (#263)** (b8f21bc)
- **Translated using Weblate (Czech) (#256)** (2242f37)
- **Translated using Weblate (Romanian) (#243)** (0b270d3)
- **app: validate tarball is a Linux rootfs before install** (1f1639f)
- **Use fixed latest release URL for kernel download (#244)** (31c3b69)

### Docs
- **docs: add Poco X6 Pro (duchamp) to the supported devices list (#268)** (1362e4f)
- **docs: add motorola edge 30 to supported devices list (#249)** (0fc8344)

### Chore
- **refactor: clear compiler warnings left by the refactor** (9b2eacc)
- **refactor: collect Settings toggles via collectAsStateWithLifecycle** (77689eb)
- **refactor: dedupe wizard-scoped ViewModel resolution in navigation** (9acf48a)
- **refactor: render the container list with LazyColumn + stable keys** (3d6a4bc)
- **refactor: group ContainerCard callbacks into ContainerCardActions** (a4b919a)
- **refactor: move InstallationScreen orchestration into AppStateViewModel.performInstallation** (711e554)
- **refactor: move ContainersScreen operations into ContainerOperationsViewModel** (9ea611b)
- **refactor: dedupe ABI->arch mapping into DeviceArch** (19e3302)
- **refactor: remove dead @Deprecated buildUptimeCommand** (e11371a)
- **refactor: make SummaryItem icon type-safe via overloads** (0c85f75)
- **refactor: dedupe countEnvVars into ValidationUtils** (276b272)
- **refactor: fix net_mode default drift between model and parser** (a6d1932)
- **refactor: key/remember recomputed lists to cut needless recomposition work** (2e5ab92)
- **refactor: bound usage-monitor coroutines, prune download jobs, privatize app scope** (430c1d8)
- **refactor: extract daemon-mode root shell into DaemonModeRepository** (05b01a6)
- **refactor: route ContainerViewModel scan through a ContainerRuntime gateway** (2bf0fa6)
- **refactor: share warning card, confirm gate and footer across dangerous dialogs** (3ce17df)
- **refactor: extract shared StatusPill component** (971bbc4)
- **refactor: collapse GatewaySettingsSection params into GatewayConfig** (f4c695a)
- **refactor: extract DsTextFieldDefaults for duplicated OutlinedTextField colors** (e72f846)
- **refactor: merge ToggleCard/SettingsRowCard into shared SettingsCard** (21714f3)
- **refactor: extract shared DialogFooterRow for dialog Cancel/Confirm rows** (ec777f8)
- **refactor: extract shared PrimaryActionBottomBar across wizard screens** (1ba1b12)
- **refactor: delete dead StatusBarStyle.kt** (139349e)
- **refactor: unify Procd/OpenRC/Systemd screens into InitServiceScreen** (7c5bf7d)
- **refactor: unify Edit/Config screens into ContainerConfigForm + ContainerConfigState** (56c8f75)
- **refactor: wrap repeated payload-drain idiom in socketd_drain_payload** (334c006)
- **refactor: share pidfile resolve/prune helpers between scan loops** (cb6de8a)
- **refactor: shell-quote multi-arg su -c command in run_in_rootfs** (95fcdf6)
- **refactor: call p_printf explicitly instead of #define printf in print_page** (e4280cb)
- **refactor: centralize tx11/virgl flag ownership in ds_config_free** (aa6c6ca)
- **refactor: compute doc nav-hint width by display columns, not byte fudge** (08e6540)
- **refactor: unify socket peer authorization into ds_peer_authorized** (1660135)
- **refactor: share Termux socket-bridge setup for PulseAudio and VirGL** (95d2746)
- **refactor: share forked-daemon-child preamble across A/V helpers** (0508150)
- **refactor: extract generic socketd_grow_array for record buffers** (eef4db0)
- **refactor: use in-tree remove_recursive to clear stale PulseAudio config** (9a6856b)
- **refactor: unify pidfile sidecar path builders** (3102b97)
- **refactor: free cur_base on OOM early-return in remove_matching_rules** (296c380)
- **refactor: drop premature ds_config_free in start_rootfs boot-failure path** (6638be2)
- **refactor: remove dead payload-drain block and stale TODO in socketd bridge** (f85f250)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/ravindu644/Droidspaces-OSS?utm_source=github-action)._