eseifert/altero v1.0.0-beta.6

on GitHub

Back up before upgrading: this version renames attachment storage. On its first start, beta.6 runs two database migrations and renames every stored attachment file to the digest of its own bytes, reading and hashing each one, so that start takes about as long as reading the storage directory from disk. Keep free space for your largest web snapshot, back up the database and the storage directory together, and do not go back to beta.5 afterwards without restoring both (upgrade).

New in the browser. Notes, written in an editor that saves Zotero's own note format, standalone or under an item. Files, picked or dragged in from the computer, replaced and renamed, with web links beside them. A note or attachment under an item can be moved to the trash from its own pane.

• A note or attachment under an item can be moved to the trash from its pane in the browser, and restored or deleted from the trash (items).
• The note editor's / menu test waits for the editor to see the caret move, which a busy CI machine overtook.
• The end-to-end suite keeps the test server's output and how it exited, which CI uploads when a run fails.
• Desktop acceptance covers files added, renamed and replaced in the browser, and a desktop's replacement winning a race.
• Files are stored under their own digest, so no upload or restore can replace another library's; the first start renames them (upgrade).
• Downloads serve the file an upload registered, not any digest an attachment's md5 names; zotero.org draws the same line (registered).
• The browser interface renames an attachment's file and edits its title, as Zotero Desktop's attachment pane does (files).
• The browser interface adds files — picked or dragged in from the computer — and web links, and replaces a file, with progress shown (files).
• ALTERO_MAX_UPLOAD_MB sets the largest attachment file accepted from any client; the default stays 1 GiB (config).
• An attachment's md5 is checked to be a digest on write and when a file is served, closing an authenticated path traversal. Reported by @arminbahl in #62.
• Desktop acceptance covers notes: browser notes reach both desktops intact, and Zotero's own note editor output is the browser editor's test corpus.
• Building the image with compose.build.yaml fetches current base images and uv; a cached old uv:latest failed the uv version check (build).
• The browser interface writes notes, standalone or under an item: format by selecting or typing /, full screen, saved as you type (notes).