Join our communities

Changelog

I was going to do a bit more work before releasing but Nextjs ruined everything by having a shit tons of CVE and I had to be a responsible adult and fix them all. Also disclaimer, you'll notice a Claude icon popping in the contributors tab, that's not done by me but by a lovely contributor who actually added some seriously good improvements to this release. They used Claude quite heavily and I don't mind as I went through the code, tested and adjusted things accordingly when they weren't meeting the project standards (frankly these pull requests were almost perfect). My stance on AI is still the same, if the code is good and you reviewed it, I welcome it.

features

• Add a + button on the kanban columns to quickly create an item within a status (thank you @nikolai-andree)
• Add option to hide redundant statuses from kanban card items (settings -> personal preferences -> kanban) (thank you @nikolai-andree)
• Add indent button and numbered list button to the editor toolbar #503 (thank you @nikolai-andree )

bufixes

• Fix layout issue around kanban status manager (thank you @nikolai-andree)
• Cannot archive checklists #499
• TOC not working while editing a note #510
• Fix diagram modals being suddenly embedded in the note body, this was caused by the recent IOS fixes, test suite didn't catch it because it technically works, it's just shit UX 😆
• Add new line at the end of notes when saving to avoid [noeol] on opinionated editors (e.g. vim)
• Fix timer state not persisting during changes on kanban #512
• Fix checklist duplicate ids after file drop import #501

direct dependency upgrades

• @excalidraw/excalidraw: 0.18.0 -> 0.18.1 (XSS via Mermaid/KaTeX)
• mermaid: 10.9.4 -> 10.9.6 (Gantt chart infinite loop DoS)
• next: 16.2.3 -> 16.2.6 (2x high-severity: DoS + middleware bypass)
• next-intl: 4.9.1 -> 4.9.2 (prototype pollution)
• uuid: 11.1.0 -> 11.1.1 (buffer bounds check)
• ws: 8.19.0 -> 8.20.1 (uninitialized memory disclosure)

resolutions added/updated

• **/mermaid: 10.9.4 -> 10.9.6 (force patched version for transitive deps)
• brace-expansion: >=5.0.6 (DoS via large numeric range, pulled in by multiple deps)
• postcss: >=8.5.10 (XSS via unescaped </style>, pulled in by next)