github usememos/memos 26.10.0-rc.2
on GitHub

pre-release2 hours ago

Memos 26.10.0-rc.2 brings a new editor that writes and reads memos the same way, per-user usage limits, and calendar versioning. Sign-in, browsing, Markdown rendering, and the server improve throughout.

What's new

  • Editor: Writing and reading share one block editor, so a memo looks the same while you type and after you save. Format with the toolbar over selected text, the slash menu, or Markdown shortcuts. Markdown mode in the ＋ menu edits the raw text and is remembered per device; focus mode opens a narrower sheet with larger text. (#6466, #6481, Markdown mode, #6498, focus mode)
  • Suggestions and transcription: New drafts suggest tags, checklist formatting, and visibility from the current filters or View. Transcribe an existing audio attachment into the draft with the configured provider. (#6367, #6375)
  • Usage limits: The memo length and upload size caps, previously two instance settings, are now one feature with two more metrics: memo count and total storage. Settings › Usage limits holds an ordered list of entries; the last entry is the default for everyone, and an entry above it gives the users it names their own limits. A refused save or upload names the limit it hit, and nothing already stored is hidden or removed. My Account shows your usage. (#6456, #6472, defaults and targets, upload size)
  • Browsing: The selected creator or Space follows you across Timeline, Calendar, Map, and Attachments. Filter by has_attachments and has_image. Signed-out visitors can use Calendar and Map, which now show authors when several people write. Memo timestamps are links. (#6378, #6492, guest browsing, multi-author views, memo links)
  • Spaces: Pick a memo's Space next to its visibility in the editor's audience menu, including when editing. (Space selection, audience menu)
  • Sign-in: With passwords disabled and a single SSO provider, sign-in starts SSO automatically and returns you to the page you wanted. (#6450, SSO loading state)
  • Device preferences: Link previews and double-click to edit are per-browser choices under Settings › Preferences › This device. (device preferences)
  • Release numbering: Versions are YY.MM.N, such as 26.10.0, with -rc.K for candidates and no v prefix. Stable images also publish the month tag (26.10) and stable; candidates publish only their own tag. (#6362, #6469, development versions)

Improvements and fixes

  • Markdown: Tables fill the width with a tinted header and wrap at words. Footnotes collect at the end of a memo with backlinks. Quotes and callouts hold lists, inline HTML such as <ruby> renders again, collapsible sections and heading sizes are consistent between editing and reading, and Bilibili players embed. (tables and footnotes, quotes and callouts, inline HTML, #6364, Markdown layout, #6404, #6490)
  • Code and diagrams: Mermaid diagrams follow the theme and fit the memo's width; code highlighting is lighter. (Mermaid, highlighting)
  • Image previews: Pinch to zoom, pan, and swipe between images; controls stay on screen on mobile, and attachments load on plain HTTP instances. (#6414, #6448, #6401, HTTP attachments)
  • Memos and filters: Pinned memos get a clearer marker in single-creator feeds. New memos keep their place after an immediate edit and take the time of saving under a date filter. has_task_list == false matches memos without the property, constant operands no longer shift later filter conditions, deleting a memo removes its whole comment thread, and blurred content stays out of the detail sidebar. (#6369, pin ordering, #6451, #6457, #6382, folded operands, #6424, #6494)
  • Interface: Refreshed logo and brand copy. Menus, dialogs, and controls share one surface style with visible focus; sidebar menus stay anchored while scrolling, submenus stay on screen in narrow viewports, dialogs restore default focus, toasts follow the theme, and the composer renders with the Home page. (logo, brand copy, #6417, shared controls, #6474, submenu positioning, #6279, #6377, #6402, Home composer)
  • Languages and link previews: Norwegian Nynorsk is available, the Korean hidden-content label is neutral, and previews of large pages find their title and image more reliably. (#6394, Korean wording, preview metadata)
  • Server and security: The HTTP layer now runs on the Go standard library with unchanged routes and behavior; report any difference behind your reverse proxy. The last admin cannot be removed, /healthz reports database outages, the admin's username is hidden from anonymous requests, outbound fetches refuse the CGNAT range, token store failures no longer appear as 401, authorization errors are JSON, hidden paths such as /.well-known/ return 404, and MariaDB works. Go and gRPC are updated for CVE-2026-78669 and CVE-2026-84445. (#6475, #6454, #6491, #6256, #6461, #6504, hidden paths, #6497, #6462, #6453)
  • API: ListAttachments uses the shared opaque page token and returns one only when more results exist. (#6452, page token)

Upgrade notes

  • Upgrade path: Run 0.31.0 once before installing this release if you are on anything older. Versions before 0.22 go through 0.25.3 first. 0.31.0 and 26.10-rc.1 upgrade directly; fresh installs need nothing. (#6362)
  • Everyone signs in again: Access tokens are tied to the account password. All sessions and cached access tokens expire on upgrade, and a password change or admin reset signs the account out elsewhere. Personal access tokens are unaffected. (token binding)
  • Upload size and memo length: The two instance settings are gone and their values are not carried over. The built-in default is 8 KiB per memo and 32 MiB per file with no count or storage limit; set the all-users entry under Settings › Usage limits if you had changed the old caps. (#6456, upload size)
  • Removed options: Double-click to edit is a per-browser preference, and a deployment config that still sets enableDoubleClickEdit is rejected. The composer's formatting toolbar preference, the built-in Tasks View (use a View with has_task_list && has_incomplete_tasks), and the Move to Space action (use the audience menu) are removed. (device preferences, #6466, Tasks View, audience menu)
  • API clients: Update paths and renamed fields; binary protobuf clients regenerate from the new schema. The full list below is the API changelog. (#6447)

Breaking API changes

  • Access tokens are now bound to the user's password hash and become invalid immediately after a password change or
    an administrator password reset. Pre-upgrade access tokens are also rejected; clients must refresh them or sign in
    again. The browser session that changes its own password can still refresh; other refresh sessions are revoked.
  • Usage limits replace the instance-wide upload size and memo content caps. StorageSetting.upload_size_limit_mb
    and MemoRelatedSetting.content_length_limit are removed and old values are not migrated. The limits are the
    USAGE_LIMITS instance setting, instance/settings/USAGE_LIMITS, an ordered list of entries read and replaced whole
    through GetInstanceSetting and UpdateInstanceSetting; the first entry naming a user applies, the last entry
    applies to all users. UserUsage returns the limit set in effect as limits plus limit_index. Exceeding a limit
    returns RESOURCE_EXHAUSTED with reason QUOTA_EXCEEDED and metadata metric, limit, and usage.
  • MemoRelatedSetting.enable_double_click_edit is removed; double-click editing is now a per-browser preference in
    the web client and is no longer an instance setting. MemoRelatedSetting keeps the single field reactions = 1. A
    deployment config file that still sets enableDoubleClickEdit is rejected.
  • The API no longer carries a v1 version marker. Every client must update its paths:
    • REST routes move from /api/v1/... to /api/... (for example GET /api/memos). Server-sent events move from
      /api/v1/sse to /api/sse.
    • The proto package memos.api.v1 is now memos.api, so Connect and gRPC procedures move from
      /memos.api.v1.<Service>/<Method> to /memos.api.<Service>/<Method>.
    • Resource types move from memos.api.v1/<Type> to memos.api/<Type>.
    • The domain of google.rpc.ErrorInfo details is now memos.api.
    • For this release only, requests to /api/v1/... and /memos.api.v1.* return 410 Gone with an UNIMPLEMENTED
      error that points here. The next release removes these routes.
  • Field numbers in every message are renumbered from 1 in declaration order, and all reserved ranges are removed.
    JSON field names are unchanged; clients that use the binary protobuf encoding must regenerate from the new schema.
  • Enum values are renumbered from 0 in declaration order, including User.Role (ADMIN = 1, USER = 2) and
    UserSetting.Key (GENERAL = 1, WEBHOOKS = 2, TAGS = 3). Clients that send numeric enum values must update them.
  • Names now follow AIP conventions:
    • MemoService: ListMemoAttachments, ListMemoRelations, ListMemoComments, CreateMemoComment,
      ListMemoReactions, and UpsertMemoReaction take parent instead of name (REST path variable
      {parent=memos/*}). ListMemoCommentsResponse.memos is now comments. The nested MemoRelation.Memo type is
      now MemoRelation.MemoRef. The MemoShare resource singular/plural is now memoShare/memoShares.
    • UserService.ListAllUserStats is now ListUserStats. It requires a parent: users/- for all users (REST
      GET /api/users/-/stats instead of GET /api/users:stats) or users/{user} for one user. The response field
      stats is now user_stats.
    • BatchGetUsersRequest.usernames is now names and takes resource names (users/{user}), not bare usernames.
    • PersonalAccessToken.created_at, expires_at, and last_used_at are now create_time, expire_time, and
      last_use_time.
    • LinkedIdentity.idp_name and extern_uid are now identity_provider and external_uid;
      CreateLinkedIdentityRequest.idp_name is now identity_provider.
    • The MemoView and UserNotification resource singulars are now memoView and userNotification.
    • UserStats.tag_count is now tag_counts.
    • MemoImportPlan, MemoImportReport, and MemoImportIssue are now ImportMemosPlan, ImportMemosReport, and
      ImportMemosIssue. ImportMemosPlan.memos and attachments are now memo_count and attachment_count;
      ImportMemosIssue.memo is now memo_uid.
    • UserNotification.SpaceInvitationPayload.State is now InvitationState.
    • UpdateUserSettingRequest.setting and ListUserSettingsResponse.settings are now user_setting and
      user_settings; UpdateInstanceSettingRequest.setting and BatchGetInstanceSettingsResponse.settings are now
      instance_setting and instance_settings.
    • SignInResponse.access_token_expires_at and RefreshTokenResponse.expires_at are both now
      access_token_expire_time.
    • SignInRequest.SSOCredentials is now SsoCredentials, and its idp_name is now identity_provider.

Please report regressions in GitHub issues.

New Contributors

Full Changelog: v0.31.0...26.10.0-rc.2

Check out latest releases or
releases around usememos/memos 26.10.0-rc.2

Don't miss a new memos release

NewReleases is sending notifications on new releases.

Get notifications