build: sign macOS server releases and refresh dependencies

.github/workflows/release.yml

@@ -198,7 +198,10 @@ jobs:
             --dir macos-release \
             --pattern "ClickClack-${version}-mac-*.dmg" \
             --pattern "ClickClack-${version}-mac-*.zip" \
-            --pattern "ClickClack-${version}-mac-SHA256SUMS.txt"
+            --pattern "ClickClack-${version}-mac-SHA256SUMS.txt" \
+            --pattern "clickclack_${version}_darwin_*.tar.gz" \
+            --pattern "ClickClack-${version}-mac-server-SHA256SUMS.txt" \
+            --pattern "ClickClack-${version}-mac-server-notarization.json"
 
       - name: Verify checksums and sealed apps
         env:

.goreleaser.yml

@@ -15,7 +15,6 @@ builds:
     goos:
       - linux
       - windows
-      - darwin
       - freebsd
     goarch:
       - amd64

CHANGELOG.md

@@ -2,10 +2,15 @@
 
 ## Unreleased
 
-- Personal sidebar channel order now follows your account across browsers and devices, with the existing local cache retained for offline use. Thanks @isaiahknight-va.
+## 0.7.0 - 2026-09-30
 
-- Corrected the source-install pnpm version and quickstart caller-authentication count to match the current toolchain and authentication guide. Thanks @KrasimirKralev.
+**Highlights:** Personal channel order follows your account across browsers and devices.
+
+- Personal sidebar channel order now follows your account across browsers and devices, with the existing local cache retained for offline use. Thanks @isaiahknight-va.
+- Signed and notarized macOS server archives with the Foundation Developer ID, alongside the desktop installers, and verify their notarization tickets on a clean runner before publication.
+- Updated SQLite, virtual scrolling, Wrangler, and Oxc tooling while preserving runtime minimums and the 48-hour dependency release-age gate.
 - Updated DOMPurify, Vite, Electron 43, desktop packaging, Wrangler, Node.js types, and pnpm while preserving runtime minimums and the 48-hour dependency release-age gate; Docker builds now include every workspace manifest for frozen-lockfile validation.
+- Corrected the source-install pnpm version and quickstart caller-authentication count to match the current toolchain and authentication guide. Thanks @KrasimirKralev.
 
 ## 0.6.0 - 2026-09-24
 

apps/api/internal/webassets/dist/200.html

@@ -110,7 +110,7 @@
 		<link href="/_app/immutable/chunks/DY4e0N_F.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/DK3Fl9T5.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/Dt-HX3Vu.js" rel="modulepreload">
-		<link href="/_app/immutable/entry/app.NCg4_ALR.js" rel="modulepreload">
+		<link href="/_app/immutable/entry/app.CcIPi_UR.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/uBIymjUX.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/xihTtKlq.js" rel="modulepreload">
 		<link href="/_app/immutable/nodes/0.D4IHQq8_.js" rel="modulepreload">
@@ -133,7 +133,7 @@
 
 					Promise.all([
 						import("/_app/immutable/entry/start.C5Qg5koL.js"),
-						import("/_app/immutable/entry/app.NCg4_ALR.js")
+						import("/_app/immutable/entry/app.CcIPi_UR.js")
 					]).then(([kit, app]) => {
 						kit.start(app, element);
 					});