# ForgeFlow 0.9.1

## Gitea binary updater repair

- Downloads the actual release attachment through `browser_download_url` instead of treating the Gitea attachment metadata response as an executable.
- Keeps the Gitea token on the configured Gitea origin and follows HTTPS object-storage redirects without leaking credentials.
- Adds regression coverage for attachment metadata lookup, direct browser download URLs and cross-origin redirect safety.
- Improves diagnostics when an older updater receives JSON attachment metadata.

Because ForgeFlow 0.8.9 and 0.9.0 contain the broken attachment endpoint, upgrading to 0.9.1 requires one manual installer run. in-app updates work normally again after 0.9.1 is installed.