Keep shared offline defaults and download optional fonts into a validated cache with reliable export fallbacks. Prune stale Android DOM assets and refresh the smaller iOS editor bundles.
Preserve lazy startup boundaries through direct shared exports and dependency-aware splitting. Add ESM graph and Chrome startup checks to prevent eager editor and font loading.
Opening a shared note on a phone meant copying the link to another
device. Add a collapsible "QR code" section to the note and notebook
share dialogs that renders the public link as a scannable code.
- Rendered with qrcode.react 4.2.0 (SVG, no dependencies), loaded with
the share dialogs only.
- Dark modules on a white panel in every theme so phone cameras can
read it; labelled for screen readers, no native title tooltip.
- Hidden for password-protected links, so the code never replaces the
password the recipient still has to receive separately.
- Copy in all four catalogs.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
* refactor: resolve oxlint correctness findings without behavior changes
- Snapshot iterations that mutate their collection with Array.from()
instead of a spread (live childNodes, self-removing disposers, a Set
extended inside its own loop).
- Drop empty spread fallbacks, redundant regex escapes, Boolean() casts
inside negations, a rethrow-only try/catch and statement ternaries.
- Use startsWith/endsWith for anchored literal checks in the extension.
- List U+FE0F explicitly in the mobile attachment emoji class; the
matched set is unchanged.
- Fix the WeChat copy fixture, where \oint in a template literal lost its
backslash and the block formula never exercised \oint.
- Document the intentional control-character regexes (filename
sanitizing and input validation), the throwing provider stream test,
Astro's generated type reference and the mobile auto-sync finally
block with narrow inline exceptions.
* ci: run oxlint correctness rules on pull requests
Pin oxlint 1.88.0 and enable only its correctness category across apps/
and packages/, excluding build output, vendored code and the iOS app.
Findings are errors and the script passes --deny-warnings, so CI fails
on any finding. no-unused-vars stays off until unused code is removed
in a dedicated pass.
test:desktop listed 40 of the 49 Electron main-process test files by hand,
and the five ACP tests that need the desktop working directory ran in a
second command. Four files were missing from both lists
(desktop-device-model, edit-context-menu, rpc, window-lifecycle), so the
desktop build never ran them.
The first command now runs everything under apps/desktop/src/main and
ignores only the five tests the second command runs with --cwd
apps/desktop. The renderer tests and the sidecar step are unchanged, and a
new main-process test is picked up without editing the script.
Record sanitized request URLs, redirects, timing, HTTP errors and proxy resolution from the actual updater session. Include the trace in copyable update diagnostics. Refs #513
Remove the unused React Native Markdown renderer. Pin safe YAML, shell quoting, tar, and cache dependencies; upgrade npm within the 11 series and apply upstream fixes to its hidden bundled Undici and cache copies.
Add actual-consumer security regressions and an opt-in real npm/ACP upgrade verifier. Typechecks, Web build, Android APK/signature checks, and 2,997 tests passed (23 skipped). Real old-to-new npm installs, ACP initialize, rollback, restart, and fallback retention passed under the desktop Electron runtime.
Android USB-device validation and full desktop automatic-update release gates remain pending. Dependency audit is reduced from 85 to 74 unique advisories; this is not a complete security clearance.
Align editor, AI SDK, query, and Expo SDK 57 dependencies; pin floating versions and rebase the Mermaid and Android sharing patches. Refresh the standalone iOS editor bundle and migrate site content collections while preserving routes.
Validation: typechecks for Web/API, Android, and iOS editor; Web, site, iOS editor, Worker, Docker server, extension, and Android APK builds; 2,994 tests passed, 23 skipped. Built-in browser verified rich-text paste/undo and bilingual site navigation.
USB-device upgrade/data/share verification and desktop cross-version release gates remain pending. Remaining dependency audit advisories are not all resolved.
Video notes keep a hidden marker, and the note list can queue subtitle extraction. The desktop app downloads the audio with yt-dlp and sends it to the selected OpenAI-compatible speech service.
tianma-if