release: 0.4.1 (security hardening for the local /clip endpoint)

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.4.1
+
+- Security hardening for the local `/clip` endpoint: payloads are validated and normalized before anything touches the vault. Malformed bodies and unknown modes now get a safe 400 response, and error responses no longer leak internal details.
+- Untrusted video ids are sanitized before becoming vault file names, so a crafted id cannot escape the covers folder.
+- Note frontmatter values (title, channel, urls) are escaped, so quotes or newlines in a video title can no longer corrupt a note's YAML.
+- Cover and thumbnail downloads are restricted to http(s) URLs with a 25 MB size cap.
+- An out of range port value in saved settings now falls back to the default 17183.
+- Video frames are saved with a `.jpg` extension matching their actual JPEG bytes; screenshots stay `.png`.
+- Docs: the network use disclosure now spells out why the local endpoint is unauthenticated and what the worst case is.
+
 ## 0.4.0
 
 - Video notes now carry the video's original publish date (`published_at`) in frontmatter; existing notes are backfilled on the next upsert from the same video.

manifest.json

@@ -1,7 +1,7 @@
 {
   "id": "vault-autopilot",
   "name": "Vault Autopilot",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "minAppVersion": "1.4.0",
   "description": "Receive screenshots and video frames from the Obsidian Visual Clipper Chrome extension over a local port and write structured notes into your vault.",
   "author": "liyachen",

versions.json

@@ -2,5 +2,6 @@
   "0.1.0": "1.4.0",
   "0.2.0": "1.4.0",
   "0.3.0": "1.4.0",
-  "0.4.0": "1.4.0"
+  "0.4.0": "1.4.0",
+  "0.4.1": "1.4.0"
 }