v0.8.1

Released: 2026-07-25

Changes since v0.8.0 (a1dca20..merge of #125–#131). A security + robustness batch from @samirhvbr, integrated with additional hardening.

Security

SSRF blocked in the external-image fetch (PR #130 by @samirhvbr, hardened on integration): The "fetch an image URL → upload to S3" endpoint downloads a client-supplied URL server-side — a classic SSRF sink on a self-hosted box (LAN hosts, localhost, cloud metadata at 169.254.169.254). A new EgressPolicy guard validates the scheme, resolves the host, rejects the request unless every resolved address is public, and pins the connection to the validated IP (closing the DNS-rebinding window). Integration added a 25 MB streamed size cap (a hostile public URL could otherwise OOM the server) and redirect following with per-hop re-validation (each Location is re-checked, and legit CDN redirects work again).
Stored XSS blocked in the markdown preview (PR #131 by @samirhvbr, hardened on integration): The preview rendered note HTML via innerHTML, so <script>, onerror, javascript: URLs, etc. executed. Rendered markdown is now sanitized with DOMPurify before injection, with a strict <iframe> allowlist that keeps YouTube/Vimeo embeds working. Integration added stripping of interactive form controls (<form>/<input>/<button>/…) so a note can't render a phishing form, plus tests for host-confusion bypasses (userinfo / subdomain / protocol-relative).

ImageMagick 7 compatibility (PR #129 by @samirhvbr): detect and use the magick binary alongside the legacy convert/mogrify.

Stop I18n.locale leaking between tests (PR #128 by @samirhvbr).
Make the base64-rejection specs immune to concurrent writes (PR #127 by @samirhvbr).