SnapToWindow – Updates for November 2026 – Snaps Stay on the Right Display
3 min read
New updates have arrived for SnapToWindow
Download at https://snaptowindow.com/download
What’s New
v0.1.23 · November 2026
One fix you can see, on macOS, and a round of security updates you can’t. If you move Desktops between monitors, snapping now keeps a window on the screen you’re looking at instead of throwing it back to the one you left. The rest is maintenance: a safer unzipper in the updater and newer versions of nearly everything SnapToWindow is built on.
Snaps stay on the display you moved to
macOS lets you move a whole Desktop (a Space) to a different monitor. Its windows come along, but macOS doesn’t resize them to fit. Move a Desktop between a large external display and a smaller laptop screen, and its windows can end up bigger than their new screen or hanging off its edge.
That confused SnapToWindow about where a window was. To pick a display to snap to, it took the centre point of the focused window and asked which display contained it. For a window hanging off a screen, the answer could be none of them, and in that case SnapToWindow fell back to the primary display. Press a shortcut, and the window snapped onto the main monitor, usually the one you had just moved the Desktop away from.
v0.1.23 asks a better question: which display does the window overlap most? A window that’s mostly on your external monitor belongs to it, wherever its centre happens to fall. If a window overlaps no display at all, SnapToWindow picks the nearest one instead of defaulting to the primary. That’s the rule Windows already uses (MONITOR_DEFAULTTONEAREST), so both platforms now agree on where a window is.
Windows wasn’t affected. SnapToWindow already asks Windows for the nearest monitor.
A safer unzipper in the updater
In October, zip, the Rust library Tauri’s updater uses to unpack zipped Windows updates, disclosed three flaws in how it extracts archives (RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369). A malicious archive could carry Unix setuid and setgid permission bits through extraction, or plant symbolic links that point outside the folder it was unpacked into.
v0.1.23 moves the updater to zip 9.2, where all three are fixed.
What it meant in practice
Nothing, for SnapToWindow, for three separate reasons. The zip code is only built into the Windows app, and the flaws are about Unix permissions and symlinks. SnapToWindow’s Windows updates are .msi installers, not zip files, so the updater never reaches the extraction code at all. And every update is checked against the signing key built into the app as soon as it finishes downloading, before anything is unpacked or installed.
Unreachable, then. But code that ships in the app shouldn’t carry known holes, reachable or not, so it’s updated.
Fixes under the hood
- Rustls moves from 0.23.45 to 0.23.46, closing four more advisories (RUSTSEC-2026-0346 to 0349). Two need features SnapToWindow doesn’t use (Encrypted Client Hello and Brotli certificate compression), and one only leaks secrets through custom logging code. The fourth could let an attacker on the network nudge later connections from post-quantum to classical key exchange: still encrypted and authenticated, just without the post-quantum protection.
- Rustls-webpki moves to 0.103.16 and webpki-root-certs to 1.0.11. Both stop trusting a set of emSign intermediate certificates whose private keys became public (RUSTSEC-2026-0382, RUSTSEC-2026-0383). On Windows and macOS, SnapToWindow checks GitHub’s certificate against the operating system’s own trust store, and webpki-root-certs isn’t in those builds at all, so this one is about keeping the libraries current.
- Tokio moves to 1.54.1, which fixes an unsound file-descriptor API (RUSTSEC-2026-0386).
- Tauri moves to 2.12, with every plugin updated alongside it. Tauri’s npm packages now move in lockstep with its Rust crates. The updater upgrade had left them a version apart, and Tauri’s build tools refuse to build that.
- TypeScript 7, React 19.3, windows-rs 0.62, core-graphics 0.25, thiserror 2 and dirs 7. Tauri already uses windows-rs 0.62, so Windows builds no longer carry two copies of it. dirs 7 still finds your settings in the same folder, so nothing needs migrating.
- The old objc crate is gone. The macOS code had already moved to objc2, and objc was only hanging on through an unused declaration.
- Vite 8.3.5 and source-map-js 1.2.2 fix npm audit findings in the build tools. Neither ships in the app.
- npm audit and cargo audit both report zero known vulnerabilities. cargo audit’s informational notices are down from seven to two now that Tauri’s upgrade has landed, and both remaining ones sit in Linux-only GTK code that never reaches the Windows or macOS builds.
Already running SnapToWindow? It will find v0.1.23 on its next check and add “Install Update (v0.1.23)” to the tray menu. Choose “Check for Updates...” to look right away.
As always: SnapToWindow stays out of your way. It runs from the tray, answers your shortcuts, and there’s no account to create.