Remove the unused React Native Markdown renderer. Pin safe YAML, shell quoting, tar, and cache dependencies; upgrade npm within the 11 series and apply upstream fixes to its hidden bundled Undici and cache copies.
Add actual-consumer security regressions and an opt-in real npm/ACP upgrade verifier. Typechecks, Web build, Android APK/signature checks, and 2,997 tests passed (23 skipped). Real old-to-new npm installs, ACP initialize, rollback, restart, and fallback retention passed under the desktop Electron runtime.
Android USB-device validation and full desktop automatic-update release gates remain pending. Dependency audit is reduced from 85 to 74 unique advisories; this is not a complete security clearance.
Align editor, AI SDK, query, and Expo SDK 57 dependencies; pin floating versions and rebase the Mermaid and Android sharing patches. Refresh the standalone iOS editor bundle and migrate site content collections while preserving routes.
Validation: typechecks for Web/API, Android, and iOS editor; Web, site, iOS editor, Worker, Docker server, extension, and Android APK builds; 2,994 tests passed, 23 skipped. Built-in browser verified rich-text paste/undo and bilingual site navigation.
USB-device upgrade/data/share verification and desktop cross-version release gates remain pending. Remaining dependency audit advisories are not all resolved.
Video notes keep a hidden marker, and the note list can queue subtitle extraction. The desktop app downloads the audio with yt-dlp and sends it to the selected OpenAI-compatible speech service.
Chrome and Firefox uploads were done by hand. Submit Web Clipper now packages the extension and sends it for review without joining the product release.
Notes open a right-hand assistant that can attach files and asks before changing note content. Desktop can talk to a local ACP agent without handing over the note directory.
Register a per-user Explorer verb that passes the selected file to EdgeEver. The original file stays in place, and each selected file becomes its own note.
Finder was handing the share extension a file-id URL, which was stored as a fake WeChat zip and failed with the chat import dialog. Copy the real file, keep its name, and turn anything that is not a WeChat chat into a note.
tianma-if