Kept 1.8.2

Features

• Added an option to follow your device's light/dark mode, with manual selection taking precedence. Appearance also refreshes when returning to the app.
• Improved Smart Capture performance on Android and iOS to better target updates to existing notes.
• Improved checklist editing: Enter splits a row at the cursor, Backspace at the start joins it to the previous row without losing text, and Up/Down arrows move between rows.
• Added scrolling to the sidebar, with collapsible Binders and Labels.

Fixes

• Improved autosaving after a short pause and when leaving or backgrounding the editor.
• Fixed "Make a copy" from an open note.
• Improved Android reminder delivery when the app is closed and prevented duplicate notifications.
• Kept "Saved offline" steady during connection or server outages, with quiet retries and recovery when connectivity returns. Fixed iOS connection failures incorrectly showing "Sync needs attention."
• Improved mobile and foldable layouts, including expanded note grids, solid selection-toolbar backgrounds, and menus that stay inside the toolbar.
• Prevented pull-to-refresh while interacting with the mobile navigation drawer.
• Fixed new-note placeholder alignment, disabled empty-note closing, and checklist indentation when dragging rows.
• Fixed highlighting for Binders and Labels containing Unicode characters, and bundled complete Roboto fonts for accented characters.
• Improved contrast for note controls, reminders, attachments, and link previews.
• Improved recurring reminder and native upload handling, and Claude MCP connection compatibility.

Security

• Fixed stored cross-site scripting in note content, including content written through the API, imported archives, shared notes, and previously cached content.
• Added Content Security Policy and nosniff protection to proxied images while preserving SVG rendering and drawings.
• Moved browser authentication to HttpOnly cookies and removed session credentials from image, download, and realtime URLs.
• Hardened OAuth client metadata URL validation.

Thank you to t-animal and talhayme for finding and reporting the vulnerabilities addressed in this release.

Updating

Update the server and mobile apps together. Older mobile bundles may need updating for protected images, downloads, and realtime connections. Mobile improvements require the corresponding updated iOS or Android app.