nikunjsingh93/react-glass-keep v1.0.5

Glass Keep 1.0.5

on GitHub

Glass Keep 1.0.5 brings compact note layouts, improved sharing, offline editing, English/Hindi support, richer Google Keep imports and security fixes. These notes cover the cumulative changes shipped in 1.0.2–1.0.5.

New in 1.0.5

• Cleaner note editor: Copy note link, Make a copy and Public sharing now live in the note's three-dot menu.
• Public-link expiry dropdown: choose 1 day, 7 days, 30 days, 90 days, 1 year or Never. Never links stay active until the owner revokes/replaces them or deletes the note. Existing timed links keep their expiry.
• Compact, Keep-style layout: notes start left to right, then fill the shortest available column instead of leaving large blank spaces below shorter cards. Placement adjusts when cards or the viewport resize; pinned notes remain separate.
• Sharing usability: new options have English and Hindi labels, sharing dialogs appear above the editor, and a manual-copy dialog is available when clipboard access is unavailable.

Notes and checklists

• Reorder checklist branches with accessible Move up / Move down controls.
• Create nested sub-items, indent/outdent branches and toggle a parent together with its descendants.
• Hide/show completed checklist items, with the preference remembered per note on the device.
• Make independent note copies for templates. Copies belong to the current user, start unpinned and do not inherit collaboration permissions.
• Select all notes matching the current search/tag filters, clear the selection and confirm bulk deletion. Changing filters clears the selection.
• Choose English or Hindi on the sign-in screen or in Settings. The choice persists on the device; note content stays in its original language.
• Reuse existing tags through suggestions and combine several sidebar tags with AND filtering.

Offline editing and collaboration

• Per-account IndexedDB snapshots and a persistent queue support offline creation, edits, checklist changes, copies, deletion, archiving and note reordering.
• Queued changes survive reloads and synchronize after reconnecting or signing in again to the same account.
• Server-recorded operation identifiers prevent a lost acknowledgment from applying a queued write twice.
• Note revisions reject stale writes; writes from one client are serialized without silently overwriting newer server changes.
• Conflicts preserve the local draft and require an explicit decision: download the draft, use the server version or keep local changes.
• Ownership/revision metadata is returned consistently after note creation and loading.
• Shared-note metadata is saved independently of content, and realtime updates refresh the correct archive/active view.

Sign in and visit notes online before relying on offline access. Keep the device's browser site data until queued changes finish synchronizing. New sign-ins, imports, sharing changes and AI require a connection.

Google Keep imports, backups and duplicates

• Import Takeout ZIPs, folders or individual JSON files.
• ZIP/folder imports resolve PNG, JPEG, GIF and WebP attachments; missing or unsupported attachments are reported in the preview.
• Preserve labels, checklist structure, pin state, timestamps, colors and archive state.
• Skip notes owned by another person by default, with an option to include them and an account-email field for exports that explicitly identify the owner.
• Optionally restore sharing with existing Glass Keep usernames that exactly match sharee emails. Sharing is opt-in and unmatched users are reported.
• Imports skip duplicates by default, with an option to deliberately retain copies. Matching considers type, trimmed title, content, checklist structure, tags and image contents; timestamps, color, pin and archive state are excluded.
• Find existing duplicate groups in Settings, review extra copies and confirm deletion.
• JSON backups include archived notes and attachments. Large restores are split into batches, with partial failures reported.
• Keep ZIP imports enforce limits of 100 MB decompressed and 5,000 ZIP entries.

Private links versus public sharing

Only the owner can create, replace or revoke a public link. Public-link tokens are stored as hashes, and links can expire or be revoked even when created with Never.

Security and deployment fixes

• Sanitize note, AI-response and public-note Markdown through the shared DOMPurify renderer.
• Stop service-worker caching of authenticated API responses, set API responses to no-store and clear legacy shared API caches.
• Add authentication throttling, server-side password validation and password-change session revocation.
• Store indexed recovery-key digests and migrate older recovery-key hashes after successful sign-in. Recovery keys grant account access; they are not encryption keys.
• Make session duration configurable through JWT_TTL (default 7d) and return expired sessions to sign-in.
• Preserve existing configured JWT secrets and the original fallback. The blocking JWT-secret startup requirement introduced in 1.0.2 was removed in 1.0.3; existing installations do not need a JWT change to upgrade.
• Require operator-supplied INITIAL_ADMIN_USERNAME and INITIAL_ADMIN_PASSWORD only when starting with an empty user database.
• Add configurable TRUST_PROXY for Nginx Proxy Manager and other trusted proxies, fixing ERR_ERL_UNEXPECTED_X_FORWARDED_FOR when configured for the deployment.
• Update dependencies and use Node 24 LTS in Docker.
• Report the running application version through /api/health.

Docker / Portainer update

Published for Linux AMD64 and ARM64:

nikunjsingh/glass-keep:1.0.5
nikunjsingh/glass-keep:latest

Both tags were verified against this multi-platform manifest:

sha256:eb7ad10116db64465fe016258b5b14c1e2426fd7ab9c10cd34f7fd23a6403599

1. Back up the database and keep the existing data volume and JWT secret.
2. For one Nginx Proxy Manager, set TRUST_PROXY=1 on the Glass Keep container and restrict access to the app port to that proxy. Leave it unset for direct access without a proxy; do not set it to true.
3. Pull the new image and recreate/redeploy the container in Portainer, preserving its volume and other settings.
4. Reload browser/PWA windows. Older clients without note revisions receive HTTP 428 rather than overwriting notes.
5. Open /api/health and confirm "version":"1.0.5".

Existing accounts and notes are retained by the additive database migrations.

Validation

• 14 automated API, security, import, checklist and offline-storage tests passed.
• Both browser regression flows passed, including note saving/conflicts, account isolation, Hindi selection, tag filtering, imports, menu actions, public-link creation/revocation and offline edits followed by synchronization.
• Mixed-height card packing checked at desktop, tablet and phone widths, plus a visual layout inspection.
• Production build passed; production dependency audit reported zero known vulnerabilities.
• Container smoke checks passed on AMD64 and ARM64: startup, proxy headers, login, native SQLite, ownership, archived backups, the exact tested frontend and AI module loading. AI model inference was not exercised.

Resolved issues

#2, #12, #14, #15, #16, #19, #20, #21, #23, #25, #27, #29 and #31.

Native Android apps and home-screen widgets (#13) remain outside this release.

Source: 4ad456a.