memos/CHANGELOG.md

Changelog

0.30.0-rc.1 (2026-07-14)

⚠ BREAKING CHANGES

• Access control: Instances without --instance-url (or MEMOS_INSTANCE_URL) now run in private mode. Anonymous visitors are sent to sign-in and anonymous API access is limited to setup, authentication, and shared-memo routes. Set the instance URL to retain the previous public behavior. (d1cef7a)
• Filters: now() has been replaced by the now timestamp variable, and time fields now use CEL timestamps. Update saved shortcuts to use expressions such as created_ts >= now - duration("24h") or timestamp(<epoch>) instead of comparing time fields with bare epoch values. (26f4b73)
• MCP: The MCP server is now a stateless, tools-only endpoint generated from the OpenAPI schema. The previous prompts, resources, tool-filtering headers and route aliases, and unprefixed tool names have been removed. Clients that used them must switch to /mcp and the new service-prefixed tool names. (#6026)

Highlights

• Markdown editor: Rebuilt the editor as a single CodeMirror 6 decorated-source editor. Markdown is preserved verbatim while headings, formatting, tags, and mentions are styled in place. The editor also adds tag completion, list indentation, and a toggleable formatting toolbar with headings, lists, task lists, code blocks, bold, italic, strikethrough, and inline code. (5a73d7d) (e3c231f)
• MCP: Replaced the hand-written MCP implementation with a curated OpenAPI-driven tool surface that reuses the public API's authentication and authorization. The final toolset includes memo, comment, relation, reaction, shortcut, identity, and attachment operations, including attachment uploads. (777d227) (0e1d821)
• Deployment configuration: Identity providers and supported instance settings can be supplied as validated JSON files under /etc/secrets. File-backed settings act as runtime overrides and cannot be changed through the UI or API until the files are removed. (0038295)
• Memo feeds: Added persisted controls for one, two, three, or automatically fitted columns; compact mode; and link previews. Multi-column feeds stay balanced as cards resize, while newly created memos remain easy to find above pinned content. (177d65a) (e3e4ae1)
• Webhooks: Added Standard Webhooks HMAC-SHA256 signing secrets, webhook editing, and a signing-status indicator. Secrets are generated server-side, shown after creation, and can be revealed later from the edit dialog; malformed secrets now fail validation. (#6013) (#6027)
• Filters: Expanded CEL shortcuts with string matching, regular expressions, collection predicates, timestamp accessors, set operations, and an untagged-memos example. (f0e4a56) (b787bfa)
• Tag settings: Tag colors and content-blur rules are now per-user. Existing instance tag settings are copied to current users during migration. (#6017)
• Internationalization: Added a searchable locale picker, expanded European locale coverage, and completed missing Japanese and Simplified Chinese translations. (4183985) (a47d049)
• Interface: Refreshed the sign-in, sign-up, and About pages and aligned common controls across the app. Compact rendering is now opt-in in single-column feeds, so full memo content is shown by default. (564da94) (cafa56f)
• Markdown and storage: Added GFM footnote rendering and navigation, plus an insecure_skip_tls_verify option for S3-compatible storage with self-signed certificates. (1020060) (#6039)

Fixes and polish

• Authentication and setup: Stabilized SSO option loading, added OAuth client-auth auto-detection, and distinguished fresh instances from populated instances that no longer have an admin. (6c17e87) (96cb653)
• Editor: Improved formatting toggles and keyboard shortcuts, file paste and drop handling, focus-mode layout, caret behavior in empty space, and CodeMirror spacing. (c349c15) (#6076) (#6093)
• Memos and comments: Preserved expanded task-list state, loaded every comment page, and included the parent memo relation in comment webhook payloads. (ecbe2ab) (#6083)
• Tags: Tags inside links are no longer parsed as memo tags, literal tags can be escaped with a backslash, and tag names support Unicode combining marks. (a50ce09) (#6051)
• API and security: Cross-origin API requests now work with bearer tokens while cookie authentication remains same-origin, and ListUsers now returns consistent paginated results. (385fa22) (4bc3928)
• Interface: Replaced mismatched memo skeletons with a delayed spinner, improved mobile control spacing, and truncated long location labels without hiding the full address. (#6047) (3b601b8)
• Container: Prevented the entrypoint from restarting indefinitely when MEMOS_UID=0. (#6061)

0.29.1 (2026-06-04)

Bug Fixes

• markdown: keep task item content in one grid column (7c3bff4)
• support <meta name=description> in link previews (#6000) (e8d32e8)
• web: render video attachment posters on mobile (0e2a9a9)

0.29.0 (2026-05-27)

Features

• about: add about page with bird sprites (411ba7b)
• activity-calendar: aggregate by ViewContext.timeBasis (8daef1d)
• add <Placeholder> component with ASCII bird states (#5949) (8c16ffa)
• add configurable --log-level flag (#5934) (f1e2a06)
• add dedicated shortcuts page (#5942) (1df6479)
• add link metadata endpoints (9c5c604)
• frontend: add pixel bird tilemaps (cf55f11)
• memo: add task list quick actions (#5983) (648b3bd)
• memo: create memos on the selected calendar date (#5925) (ef55013)
• notification: add smtp email settings (cd4f28a)
• placeholder: add woodpecker tilemap (638e4f3)
• render link metadata cards (0bc5669)
• stats: admin instance resource statistics (ea0625d)
• stats: support filtered all-user stats (88ac3ec)
• transcription: explicit STT settings with provider, model, prompt (#5926) (238f27d)

Bug Fixes

• avoid update event on memo create attachments (#5961) (3c3382a)
• delete user cleanup (#5981) (e53b7d9)
• editor: wrap selected text when pasting URL (e0bb3a2)
• fileserver: preserve HDR image metadata in thumbnails (c724232)
• frontend: correct static cache headers (084f40b)
• frontend: use correct url path for memos in sitemap.xml (#5921) (603781f)
• httpgetter: prevent DNS rebinding in link metadata fetch (078488c)
• markdown: align list items with checkboxes (e008b1a)
• memo: enforce parent visibility for comments (4a1e401)
• s3presign: preserve motion media payload (7f1f53f)
• security: enforce attachment ownership on memo updates (35bf761)
• sse: stream initial response and refresh tokens (21303e8)
• user: omit internal settings from list responses (#5917) (1df3fe7)
• web: sync avatar changes immediately after profile update (#5903) (328396a)

Performance Improvements

• lazy load heavy first-screen dependencies (#5947) (a6024ee)

0.28.0 (2026-04-27)

Features

• auth: add SSO user identity linkage (#5883) (d688914)
• memos: choose created or updated time for memos (#5894) (c268551)
• redesign account and SSO management (#5886) (ee17998)

Bug Fixes

• auth: harden authorization and username validation (#5890) (0fb83a7)
• disable modal prop on DropdownMenu to prevent scroll disappearing (#5861) (d98f665)
• fix legacy username auth flows (#5885) (30c0611)
• markdown: split mixed task and bullet lists (e2c6084)
• reduce list memo query overhead (#5880) (5063804)
• web: preserve task checkbox state (#5867) (b5863d7)

0.27.1 (2026-04-19)

Bug Fixes

• mixed-case user resource names (#5853) (01be01f)
• release: inject build version into artifacts (f8a304b)
• user resource names can be uuidv4 from idp sub claim (#5856) (bbded58)

0.27.0 (2026-04-18)

Features

• add --allow-private-webhooks flag to bypass SSRF protection (#5694) (cd5816c)
• add blur_content attribute to tag metadata settings (#5767) (45b2153)
• add Gemini transcription provider (#5830) (d87539a)
• add GitHub release installer and release workflow (1ed542c)
• add live refresh via Server-Sent Events (SSE) with visual indicator (#5638) (ea0892a)
• add MCP server with PAT authentication (47d9414)
• add outline navigation to memo detail sidebar (#5771) (6b30579)
• ai: add BYOK audio transcription (#5832) (101704c)
• ai: add instance AI providers and transcription (#5829) (83ed32f)
• attachments: add Live Photo and Motion Photo support (#5810) (4b4e719)
• cli: add version subcommand (#5731) (0ba4c0f)
• editor: add voice note recording to the memo composer (#5801) (c0d5854)
• extract title from first H1 heading into memo property (#5726) (1e688b2)
• i18n: update sse connect label in Chinese (#5732) (89c6902)
• instance: add canonical tag metadata setting (#5736) (65d14fb)
• instance: add notification transport setting (#5737) (a249d06)
• mcp: enhance MCP server with full capabilities and new tools (#5720) (b8e9ee2)
• mcp: harden tool exposure and side effects (#5850) (583c3d2)
• mcp: refactor MCP server to standard protocol structure (803d488)
• memo-editor: add compact live waveform recorder panel (#5817) (e51985a)
• memo-preview: support comment metadata in previews (#5768) (e176b28)
• memo: add image sharing in detail view (38fc22b)
• memo: add share links for private memos (#5742) (3f3133d)
• mentions: add memo mention parsing, notifications, and rendering (#5811) (24fc8ab)
• replace auto-increment ID with UID for identity provider resource names (#5687) (92d937b)
• show inline comment preview in list view (3a5d3c8)
• store: change default storage type to local filesystem (78efa68)
• treat tag setting keys as anchored regex patterns (#5759) (9e04049)
• ui: allow navigating between images with arrows in preview dialog (#5669) (104d2ec)
• user: add per-user tag metadata settings (#5735) (330291d)
• web: add demo mode banner (#5836) (35504cc)
• webhook: dispatch webhook on memo comment creation (7c1defb)

Bug Fixes

• access token refresh on web app (#5681) (3010f10)
• add unix socket file permission setting (755 -> 660) (#5849) (0fc1dab)
• api: appease image size lint (ff6389a)
• api: improve SSE hub design and fix double-broadcast on comments (c53677f)
• api: make credentials write-only and restrict sensitive settings to admins (9d3a74b)
• api: reduce memory pressure in backend paths (c456637)
• api: remove public activity service (#5734) (04f239a)
• api: restrict user email exposure to self and admins (#5784) (a24d420)
• api: switch user resource names to usernames (#5779) (acddef1)
• api: tolerate missing related users in memo conversions (#5809) (25feef3)
• auth: recover session via refresh cookie when localStorage is empty (#5748) (551ee1d)
• backend tests action (065e817)
• clear content search filter when selecting shortcut (#5499) (2c3f9e3)
• correct typos in comments, error messages, and identifiers (#5704) (8f43e80)
• detect legacy installations with empty schema version (9628d3d)
• editor: show newly linked memos when editing a memo with attachments (026ea92)
• ensure comment divs span full width in MemoDetail (ce44164)
• fileserver: render SVG attachment previews (40fd700)
• filter: enforce CEL syntax semantics (0e89407)
• frontend: restore sitemap and robots routes (fee7fcd)
• handle chunk load errors after redeployment with auto-reload (#5703) (bdd3554)
• harden memo content iframe and HTML sanitization (7e21b72)
• hide transcribe button without AI provider (ab53329)
• improve image preview dialog and live photo trigger (aafcc21)
• improve installer compatibility and docs (f90d9a4)
• improve KaTeX and Mermaid error handling and overflow (6b37fcc)
• include plain URLs and tags in memo snippet generation (#5688) (3d4f793)
• lint: correct goimports struct literal alignment after removing write-only credential fields (#5794) (9610ed8)
• map: align dark mode map styling (7ac9989)
• map: refine Leaflet controls and memo map styling (894b3eb)
• markdown: support height/width attributes on img elements (737acbb)
• memo-editor: scope Cmd+Enter save to the active editor (#5745) (05810e7)
• mysql: handle CreateMemo custom timestamps with FROM_UNIXTIME (#5673) (09d73e8)
• normalize attachment MIME types before validation (c3e7e2c)
• preserve draft content when tab is suspended or editor remounts (9ca7122)
• prevent local attachment uploads from overwriting files (4add9b0)
• prevent stale comment drafts from being restored (e520b63)
• remove duplicate Japanese locale keys (efeb28c)
• render audio attachments as inline players (#5699) (2ccb98a)
• restrict archived memo access to creator only (#5707) (f4154d0)
• routing: redirect unauthenticated users to /explore when public visibility is allowed (98859eb)
• server: close SSE clients during shutdown (a5ddd5a)
• sync html lang attribute with active locale (#5753) (be00abe)
• tag parsing truncates emojis with variation selectors (#5496) (3ea6ea3)
• tags: allow blur-only tag metadata (#5800) (1921b57)
• toggle focus mode do not reset editor height (#5504) (0729779)
• ui: show comment editor above the comment list (#5662) (6b0736b)
• ui: unify metadata component styles across MemoView and MemoEditor (664b8c5)
• unify live photo previews around LIVE badge playback (6b0487d)
• webhooks: trigger memo updates for attachment and relation changes (#5795) (acbc914)
• web: prevent MemoContent prop leaks (22519b5)
• web: refine attachment media layout (a0d83e1)
• web: refresh memo detail cache after editor save (333c9df)
• web: use BroadcastChannel to sync token refreshes across tabs (bbdc998)

Performance Improvements

• batch load memo relations when listing memos (#5692) (1e82714)