Velta 1.4.74 closes a local door

Version 1.4.74 is a small release with one security cut that matters. The Android and browser background service talks to the app through a token-gated WebSocket on port 20808. An HTTP bridge on 127.0.0.1:20809 never worked. It is removed, along with the content-security rule that allowed it.

The web build also stops accepting an old test switch that could load the WebAssembly core from somewhere other than the app’s own wasm folder. That package is now called velta-wasm.

What else changed

• The reaction tray lists each emoji once. A few had been duplicated, and one showed up three times.
• The separate velta-core-service package builds again, and it no longer crashes on the first message, so replies can reach a backgrounded app.
• Demo mode keeps the “add a second device” QR on screen until you cancel it.

macOS is still a universal test build. It is ad-hoc signed and not notarized, so the first open still needs the quarantine cleared, or an approval under Privacy & Security.

• Release notes
• Compare with 1.4.73