This version merges duplicates in the browser and adds Arabic, Persian, Hebrew,
Urdu and Shahmukhi Punjabi, with layouts and text direction for right-to-left
languages. It also closes races in one-use sign-in credentials and OAuth tokens,
and tightens group invitations and browser file access. Upgrading from beta.6
needs no database or storage changes; older installations should follow the
upgrade instructions.
This is the last feature beta before the release candidate. Remaining 1.0 work
focuses on polish, hardening and testing against real identity providers.
- Merge duplicate groups in the browser with compact field choices, touch controls, and PDF attachment deduplication.
- PDF merges keep both files when transferring a note would trigger Zotero's attachment-parent sync bug.
- The browser adds Arabic, Persian, Hebrew, Urdu and Shahmukhi Punjabi, with localized counts and language preferences shared across devices.
- Right-to-left layouts mirror menus, sidebars and icons, with dragging and pane resizing working in either direction.
- Mixed-language text reads in its own direction in items, notes, public pages and inputs, preserving authors' note directions.
- Arabic and Hebrew fonts load locally when needed, including Persian, Urdu and Shahmukhi Punjabi characters.
- The theme menu and confirmation after changing languages use the selected language.
- Note and attachment menus no longer close themselves when opened below the fold on a phone.
- Screen readers recognize nested collections, and the profile settings link has sufficient contrast.
- Fixed vulnerabilities that could let specially crafted translations run scripts in the browser.
- Scheduled trash cleanup preserves items restored or changed while cleanup was waiting.
- Library archives stay consistent during sync, and restores cannot silently mix them with concurrent changes.
- Passkey registration cannot be completed for a different account from the one that confirmed its identity.
- One-use sign-in credentials and OAuth tokens cannot be redeemed twice by concurrent requests; parallel email guesses share one attempt limit.
- Completed device authorizations cannot be overwritten by stale consent screens.
- Group invitations require a verified matching address or the emailed link; revoked or reissued invitations cannot be accepted from an old page.
- Public-library files require ownership or membership in the browser too; copying items cannot bypass file access or upload policy.