New updates have arrived for SnapToWindow

Download at https://snaptowindow.com/download

What’s New

v0.1.22 · September 2026

This one is a security release, and there’s nothing to see. Snapping works exactly as it did in v0.1.21, on Windows and on macOS. What changed is the code SnapToWindow uses to talk to GitHub when it checks for updates, which is the only reason SnapToWindow ever goes online.

A stricter handshake for update checks

Once at launch and every hour after that, SnapToWindow asks GitHub whether a newer version exists. That request runs over TLS through rustls, the Rust TLS library. On September 14, rustls disclosed a flaw in how it handles TLS 1.3 handshakes (RUSTSEC-2026-0285, rated medium). Encryption switches on partway through a handshake, and the spec is strict about the seam: messages from either side of the switch must not share a record, and a connection that mixes them has to be dropped. Rustls let it slide. A message that should have arrived encrypted was accepted in plaintext, as long as it was packed in right behind the message that turns encryption on.

v0.1.22 ships rustls 0.23.45, which drops those connections the way the spec intends.

What it meant in practice

Not much, and that’s the good news. The handshake is still authenticated end to end, so nobody sitting between you and GitHub could use the flaw to tamper with it or pose as GitHub. What it did allow was for the server on the other end to send, in the clear, parts of the handshake that should have been encrypted — and the server on the other end is GitHub.

The update itself never rested on the connection alone, either. Every SnapToWindow update is signed, and the app checks that signature against a key built into it before installing anything. A tampered download fails the check, and the install stops there.

Low risk, then. But lenient is the wrong thing for a TLS library to be, so it’s fixed.

Fixes under the hood

• Rustls moves from 0.23.40 to 0.23.45, bringing rustls-webpki, the certificate-checking library underneath it, from 0.103.13 to 0.103.15.
• A targeted cargo update -p rustls only gets as far as 0.23.43, which is still affected, because it leaves rustls-webpki where it was. Reaching the fix takes cargo update -p rustls --precise 0.23.45. Worth knowing if you ship Rust too.
• npm audit and cargo audit both report zero known vulnerabilities. cargo audit still prints seven informational notices about crates Tauri depends on that are unmaintained or contain unsound code. Two sit in Linux-only code and never reach the Windows or macOS builds; the other five should clear once Tauri releases an upgrade it has already merged.

Already running SnapToWindow? It will find v0.1.22 on its next check and add “Install Update (v0.1.22)” to the tray menu. Choose “Check for Updates...” to look right away.

As always: SnapToWindow stays out of your way. It runs from the tray, answers your shortcuts, and there’s no account to create.