From b42b5722e607be6c8179cfe51ef929d24dc7115a Mon Sep 17 00:00:00 2001 From: liyachen Date: Sat, 18 Jul 2026 14:49:29 -0400 Subject: [PATCH] release: 0.4.1 (security hardening for the local /clip endpoint) --- CHANGELOG.md | 10 ++++++++++ manifest.json | 2 +- versions.json | 3 ++- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a309053..c17d632 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## 0.4.1 + +- Security hardening for the local `/clip` endpoint: payloads are validated and normalized before anything touches the vault. Malformed bodies and unknown modes now get a safe 400 response, and error responses no longer leak internal details. +- Untrusted video ids are sanitized before becoming vault file names, so a crafted id cannot escape the covers folder. +- Note frontmatter values (title, channel, urls) are escaped, so quotes or newlines in a video title can no longer corrupt a note's YAML. +- Cover and thumbnail downloads are restricted to http(s) URLs with a 25 MB size cap. +- An out of range port value in saved settings now falls back to the default 17183. +- Video frames are saved with a `.jpg` extension matching their actual JPEG bytes; screenshots stay `.png`. +- Docs: the network use disclosure now spells out why the local endpoint is unauthenticated and what the worst case is. + ## 0.4.0 - Video notes now carry the video's original publish date (`published_at`) in frontmatter; existing notes are backfilled on the next upsert from the same video. diff --git a/manifest.json b/manifest.json index eeeb41b..0db1db9 100644 --- a/manifest.json +++ b/manifest.json @@ -1,7 +1,7 @@ { "id": "vault-autopilot", "name": "Vault Autopilot", - "version": "0.4.0", + "version": "0.4.1", "minAppVersion": "1.4.0", "description": "Receive screenshots and video frames from the Obsidian Visual Clipper Chrome extension over a local port and write structured notes into your vault.", "author": "liyachen", diff --git a/versions.json b/versions.json index 0781eb1..f3c7ae1 100644 --- a/versions.json +++ b/versions.json @@ -2,5 +2,6 @@ "0.1.0": "1.4.0", "0.2.0": "1.4.0", "0.3.0": "1.4.0", - "0.4.0": "1.4.0" + "0.4.0": "1.4.0", + "0.4.1": "1.4.0" }