note-mark

Thanks to @brx-zyy for their security report.

Changes

Fixes

• security vulnerability GHSA-6p2v-mc83-63wr; Users with write access can rename notes into locations where they only have read access

Changed

• bump deps

Full Changelog: https://github.com/enchant97/note-mark/compare/v1.1.0...v1.1.1

This release adds some minor new features and fixes a security vulnerability.

Thanks to @Moritz-cmd for their security report.

The security vulnerability is not a major one and can only be exploited if you had a vulnerable OIDC provider. See the security disclosure post for more info.

Changes

Fixes

• security vulnerability GHSA-4937-wfv8-7crc; No username validation on OIDC username

Changed

• bump deps
• code tidy

Added

• #262; custom css override
• #265; editor can insert asset pictures
• #266; ability to toggle random slug suffix generation

Full Changelog: https://github.com/enchant97/note-mark/compare/v1.0.3...v1.1.0

This release is just to fix bugs and fix a few reported security vulnerabilities.

Thanks to @alham-rizvi and @arpitjain099 for their security reports.

Changes

Fixed

• security vulnerability GHSA-3j7j-3hq5-h3rp; No audience check during RFC 8693 token exchange
• security vulnerability GHSA-7g73-5rrw-446p; Tree listing filters on the owner instead of the requester
• #283; long slugs will go out of bounds

Changed

• Bump deps
• add a minimum password length
• add some hosting documentation

Full Changelog: https://github.com/enchant97/note-mark/compare/v1.0.1...v1.0.3

This release fixes not being able to change the user password (issue #281) and improves the interface styling on different smaller device widths.

Changed

• use inline errors for user settings
• bump deps

Fixed

• dropdown causing layout shift on mobile
• IOS auto-zoom on editor
• #281; Update password fails

Full Changelog: https://github.com/enchant97/note-mark/compare/v1.0.1...v1.0.2