🎉 Release: v2.5.1

ISSUES CLOSED: #1385

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -22,7 +22,7 @@ body:
       label: 前置阅读 | Pre-reading
       description: 我已经自行查找、阅读以下内容（阅读了请打勾） | I have searched and read the following on my own (Please tick after reading)
       options:
-        - label: "[文档/Doc](https://picgo.github.io/PicGo-Doc/)"
+        - label: "[文档/Doc](https://docs.picgo.app/gui/)"
           required: true
         - label: "[Issues](https://github.com/Molunerfinn/PicGo/issues?q=is%3Aissue+sort%3Aupdated-desc+is%3Aclosed)"
           required: true
@@ -65,4 +65,4 @@ body:
         最后，喜欢 PicGo 的话不妨给它点个 star~
         如果可以的话，请我喝杯咖啡？首页有赞助二维码，谢谢你的支持！ 
         Finally, if you like PicGo, give it a star~
-        Buy me a cup of coffee if you can? There is a sponsorship QR code on the homepage, thank you for your support!
+        Buy me a cup of coffee if you can? There is a sponsorship QR code on the homepage, thank you for your support!

.github/workflows/main.yml

@@ -26,11 +26,19 @@ on:
         required: true
         default: false
         type: boolean
-      skip_notarize:
-        description: "Skip Notarization (true/false)"
+      skip_mac_notarize:
+        description: "Skip Mac Notarization (true/false)"
         required: true
         default: false
         type: boolean
+      win_signing_mode:
+        description: "Windows Signing Mode: release-signing(default) or test-signing"
+        required: true
+        default: "release-signing"
+        type: choice
+        options:
+          - release-signing
+          - test-signing
 
 env:
   NODE_VERSION: 22.x
@@ -82,7 +90,7 @@ jobs:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          SKIP_NOTARIZE: ${{ inputs.skip_notarize }}
+          SKIP_NOTARIZE: ${{ inputs.skip_mac_notarize }}
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
@@ -138,11 +146,63 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # 1. Build (Unsigned)
       - name: Build Windows App (${{ matrix.arch }})
         run: pnpm run build && pnpm exec electron-builder --config electron-builder.config.ts --win ${{matrix.target}} ${{ matrix.build_arch }} --publish never
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
 
+      # 2. Upload Unsigned Artifact to SignPath (Intermediate Step)
+      - name: Upload Unsigned Artifact for Signing
+        id: upload-unsigned
+        uses: actions/upload-artifact@v4
+        with:
+          name: unsigned-${{ matrix.arch }}
+          path: dist/*.exe
+          retention-days: 1
+          if-no-files-found: error
+
+      - name: Notification for Signing Start
+        shell: bash
+        env:
+          NOTIFY_URL: ${{ secrets.SIGN_NOTIFICATION }}
+        run: curl "$NOTIFY_URL"
+
+      # 3. Submit to SignPath and Wait
+      - name: Sign Artifact with SignPath
+        uses: signpath/github-action-submit-signing-request@v2
+        env:
+          SIGNPATH_SIGNING_POLICY_SLUG: |
+            ${{ (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v') || inputs.win_signing_mode == 'release-signing') 
+              && 'release-signing' 
+              || 'test-signing' }}
+          ARTIFACT_SLUG: |
+            ${{ (matrix.arch == 'x64-ia32') 
+              && 'PicGo-Windows' 
+              || (matrix.arch == 'arm64') 
+              && 'PicGo-Windows-ARM64' 
+              || '' }}
+        with:
+          api-token: "${{ secrets.SIGNPATH_API_TOKEN }}"
+          organization-id: "${{ secrets.SIGNPATH_ORGANIZATION_ID }}"
+          project-slug: "${{ secrets.SIGNPATH_PROJECT_SLUG }}"
+          signing-policy-slug: "${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}"
+          github-artifact-id: "${{ steps.upload-unsigned.outputs.artifact-id }}"
+          artifact-configuration-slug: "${{ env.ARTIFACT_SLUG }}"
+          wait-for-completion: true
+          output-artifact-directory: "signed-artifact"
+
+      # 4. Replace Unsigned with Signed & Fix Blockmap (Critical for Auto-Update)
+      - name: Replace Unsigned with Signed & Update latest.yml
+        shell: powershell
+        run: |
+          # Move signed artifacts to dist folder, overwriting existing ones
+          Move-Item -Path "signed-artifact\*.exe" -Destination "dist\" -Force
+          Write-Host "✅ Signed artifacts moved to dist folder."
+
+          # Run the Node.js script to update latest.yml
+          node scripts/update-win-yaml.js
+
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
         with:

CHANGELOG.md

@@ -1,3 +1,24 @@
+## :tada: 2.5.1 (2026-02-10)
+
+
+### :sparkles: Features
+
+* windows signature ([#1386](https://github.com/Molunerfinn/PicGo/issues/1386)) ([781cf30](https://github.com/Molunerfinn/PicGo/commit/781cf30))
+
+
+### :bug: Bug Fixes
+
+* **plugin:** plugin search error ([ef07c15](https://github.com/Molunerfinn/PicGo/commit/ef07c15)), closes [#1383](https://github.com/Molunerfinn/PicGo/issues/1383)
+
+
+### :package: Chore
+
+* **notification:** add notification for windows sign ([#1387](https://github.com/Molunerfinn/PicGo/issues/1387)) ([592f985](https://github.com/Molunerfinn/PicGo/commit/592f985))
+* update link ([27464dc](https://github.com/Molunerfinn/PicGo/commit/27464dc))
+* update picgo version to support s.ee ([e2e05ae](https://github.com/Molunerfinn/PicGo/commit/e2e05ae)), closes [#1385](https://github.com/Molunerfinn/PicGo/issues/1385)
+
+
+
 # :tada: 2.5.0 (2026-01-27)
 
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "picgo",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "private": true,
   "main": "dist_electron/main/index.js",
   "description": "A powerful & simple image uploader for creators.",
@@ -55,7 +55,7 @@
     "mime-types": "^3.0.2",
     "mitt": "^3.0.1",
     "multer": "^1.4.5-lts.1",
-    "picgo": "^2.0.0",
+    "picgo": "^2.0.1",
     "qrcode.vue": "^3.3.3",
     "semver": "^7.7.3",
     "shell-path": "2.1.0",

pnpm-lock.yaml

@@ -75,8 +75,8 @@ importers:
         specifier: ^1.4.5-lts.1
         version: 1.4.5-lts.2
       picgo:
-        specifier: ^2.0.0
-        version: 2.0.0
+        specifier: ^2.0.1
+        version: 2.0.1
       qrcode.vue:
         specifier: ^3.3.3
         version: 3.6.0(vue@3.5.25(typescript@5.9.3))
@@ -4349,8 +4349,8 @@ packages:
   pend@1.2.0:
     resolution: {integrity: sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==}
 
-  picgo@2.0.0:
-    resolution: {integrity: sha512-FefLRpMHuYP19C6TpKHs83kot9BQxOT9GwpwM6DxFh4YW35Ttg1IwdQwVQAgWYLA7Pzwpd6Aro+yw+x07XMz/Q==}
+  picgo@2.0.1:
+    resolution: {integrity: sha512-AC98GsS3zmDZzTAg55oavreBgJRwNnRtfqvauAAuTanMC0QU3sidBEYsOG2SWdDMlzN/RDxybOo7t9z6Asouaw==}
     engines: {node: '>= 20.19.0'}
     hasBin: true
 
@@ -10561,7 +10561,7 @@ snapshots:
 
   pend@1.2.0: {}
 
-  picgo@2.0.0:
+  picgo@2.0.1:
     dependencies:
       '@hono/node-server': 1.19.9(hono@4.11.6)
       '@picgo/i18n': 1.0.0

scripts/update-win-yaml.js

@@ -0,0 +1,79 @@
+const fs = require('fs')
+const path = require('path')
+const crypto = require('crypto')
+const yaml = require('js-yaml')
+
+const distDir = path.join(__dirname, '../dist')
+const yamlPath = path.join(distDir, 'latest.yml')
+
+if (!fs.existsSync(yamlPath)) {
+  console.log('⚠️ latest.yml not found in dist/. Skipping update.')
+  process.exit(0)
+}
+
+console.log(`Reading ${yamlPath}...`)
+const yamlContent = fs.readFileSync(yamlPath, 'utf8')
+let doc
+
+try {
+  doc = yaml.load(yamlContent)
+} catch (e) {
+  console.error('❌ Failed to parse latest.yml:', e)
+  process.exit(1)
+}
+
+// Get all .exe files in dist directory
+const files = fs.readdirSync(distDir).filter(f => f.endsWith('.exe'))
+
+if (files.length === 0) {
+  console.log('⚠️ No .exe files found in dist/.')
+  process.exit(0)
+}
+
+let updated = false
+
+files.forEach(file => {
+  const filePath = path.join(distDir, file)
+  
+  // 1. Calculate new Hash and Size
+  const buffer = fs.readFileSync(filePath)
+  const hash = crypto.createHash('sha512').update(buffer).digest('base64')
+  const size = fs.statSync(filePath).size
+
+  console.log(`Processing ${file}:`)
+  console.log(`  -> New Hash: ${hash}`)
+  console.log(`  -> New Size: ${size}`)
+
+  // 2. Update entries in 'files' list
+  if (Array.isArray(doc.files)) {
+    const fileEntry = doc.files.find(f => f.url === file)
+    if (fileEntry) {
+      fileEntry.sha512 = hash
+      fileEntry.size = size
+      updated = true
+      console.log('  -> Updated file entry in yaml object')
+    }
+  }
+
+  // 3. Update root path entry (if exists)
+  // electron-builder's latest.yml usually has root path, sha512, size 
+  // corresponding to the main file of current build (usually x64 or current arch)
+  if (doc.path === file) {
+    doc.sha512 = hash
+    doc.size = size 
+    updated = true
+    console.log('  -> Updated root path entry in yaml object')
+  }
+})
+
+if (updated) {
+  // 4. Dump back to file
+  // lineWidth: -1 prevents long strings from wrapping, keeping it clean
+  const newYamlContent = yaml.dump(doc, { lineWidth: -1 })
+  fs.writeFileSync(yamlPath, newYamlContent, 'utf8')
+  console.log('✅ latest.yml updated successfully.')
+  console.log('New yaml content:')
+  console.log(newYamlContent)
+} else {
+  console.log('⚠️ No matching entries found in latest.yml to update.')
+}

src/renderer/pages/Plugin.vue

@@ -461,7 +461,7 @@ function _getSearchResult (val: string) {
         })
         .filter((item: INPMSearchResultObject) => {
           // filter out fake picgo plugins from picgo.net
-          if (item.package.description.includes('picgo.net') || item.package.description.includes('PicGo官方')) {
+          if (item.package.description?.includes('picgo.net') || item.package.description?.includes('PicGo官方')) {
             return false
           }
           return true