This version closes two ways somebody else's content could run a script in your browser: a note, and an attached web page. Upgrading needs no database changes.
- Notes and citations can no longer run a script in the browser;
bibandcitationescape markup in fields, as zotero.org does. Reported by @arminbahl in Issue#30. - Attachments opened in a browser tab run no scripts, and the browser interface sends a Content-Security-Policy (headers).
- Cases, emails and statutes show their titles throughout the browser interface instead of “(untitled)” (Issue#22).
- The browser interface is translated into 17 more languages, 48 in all.
- The container image is built on Debian 13 (trixie), with OpenSSL 3.5 instead of the end-of-life 3.0 (Issue#29).
- The container image is about 60 MB smaller: uv, which only the build needs, stays out of it.
- The container image runs on its own for a quick trial, keeping a SQLite database on its
/datavolume. - The library draws the shape of its rows while they load.
- A profile's item types meet WCAG contrast; found by the new browser tests with axe.
- Item searches ignore case in every alphabet on SQLite too:
überfinds “Über”. - Tag searches match case, as on zotero.org:
/tags?q=ficno longer finds “Fiction”.