v0.4.3

Upgrade notes

• docker-compose.yml no longer trusts every private network as a reverse proxy: the
  TRUSTED_PROXY_CIDRS default is now empty. Set it in .env to your proxy's own address (for
  example TRUSTED_PROXY_CIDRS=172.20.0.5/32) before upgrading. Otherwise every user shares the
  proxy's login rate-limit bucket, and an SSO callback or KySignOn pairing URL derived from the
  request (no redirect URI configured) uses KyNotes' own scheme and host. GET /api/v1/installer/network shows whether the proxy is trusted.
• X-Forwarded-Proto and X-Forwarded-Host now count only from a trusted proxy, like
  X-Forwarded-For. Before, any client could choose the SSO callback host and the state cookie's
  Secure flag when no redirect URI was configured.

Changes

• Security: the image is built with Go 1.27.3 (was 1.27.2) for GO-2026-6809: crypto/x509 now
  distrusts compromised intermediate certificates. go.mod sets toolchain go1.27.3 so
  go build from source uses it too.

• The apply-setup and --check handover adds blobTargetConfigured. false means KyNotes
  copies no note ciphertext itself, so the capsule alone is not a full backup.

• New: "Export notebook" downloads the open notebook as a zip of Markdown pages, canvas pages and
  attachments. The browser decrypts and builds it; the server sees nothing new. The file is not
  encrypted, and the browser asks before writing it. docs/EXPORT.md describes the layout.

• Tasks can carry dates in their text: due:2026-11-01, repeat:weekly (also daily, monthly,
  yearly, every-3-days, every-2-weeks) and remind:2026-11-01T09:00, in your browser's time.
  The work queue groups open tasks into Overdue, Today, Upcoming, Later and No date, and shows each
  due date and whether it repeats. Ticking a repeating checklist item adds the next one below it. Turn
  on "Show reminders while KyNotes is open" in Settings to get a notification while a KyNotes tab is
  open; it says only "A task is due" unless you also turn on "Show task text in reminders". Reminders
  that passed with no tab open show as missed in the work queue. Dates and reminders stay inside your
  encrypted pages; the server learns nothing new.

• Optional push reminders: add push:yes beside a remind: time and turn on "Also remind me when
  KyNotes is closed" in Settings. The browser then sends the server only each reminder's time and an id
  the server cannot link to a task, and at that time the server sends an empty push through your
  browser's push service; the notification says only "A reminder is due". Off by default; the setting
  names what the server and the push service learn. Reminder settings are now per account. The server
  creates secrets/vapid.key on first start (migration 0028 adds two tables) and needs outbound HTTPS to
  the browser push services for this feature.

• New: kynotes-mcp, a local MCP server that lets an AI agent read one notebook, and with the
  editor role add pages and append text, as its own KyNotes account. It decrypts on your machine;
  the server still sees only ciphertext. It cannot delete or change existing text. Removing the
  agent from the team revokes it. docs/MCP.md describes setup.

• Fixed: after restoring your key with a recovery code (or linking this browser, or resetting
  your key), notebooks and pages that could not be read before now appear without a reload.

• The recovery-code text now says when you need the code: no browser holds your key and your
  password cannot open it, as after an administrator resets your password, and always on a single
  sign-on account.

• Fixed: the admin console opens at its top after first-run setup instead of partway down.

What's Changed

• docs: verify release images against the release-image.yml signer by @Yoshiofthewire in #73
• chore(deps): bump node from 26.10.0-bookworm-slim to 26.12.0-bookworm-slim by @dependabot[bot] in #74
• chore(deps): bump github.com/Busnes-app/ky-primitives from 0.9.0 to 0.10.0 in the ky-primitives group by @dependabot[bot] in #75
• chore(deps): bump golang from 1.27.0 to 1.27.2 by @dependabot[bot] in #76
• chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 in the go group by @dependabot[bot] in #77
• chore(deps): bump the npm-build group in /web with 2 updates by @dependabot[bot] in #78
• chore(deps): bump the npm-runtime group in /web with 5 updates by @dependabot[bot] in #79
• chore(ci): bump ossf/scorecard-action from 2.4.4 to 2.5.0 in the actions group by @dependabot[bot] in #80
• test(health): pin the ky.health/1 wire contract by @Yoshiofthewire in #81
• feat(web): export a notebook as a zip of Markdown and attachments by @Yoshiofthewire in #82
• feat(web): task due dates, recurrence and in-tab reminders by @Yoshiofthewire in #83
• feat: Go port of note payload crypto for the MCP bridge by @Yoshiofthewire in #85
• feat: opt-in push reminders when KyNotes is closed by @Yoshiofthewire in #84
• feat(mcp): kynotes-mcp, a local MCP bridge to one notebook by @Yoshiofthewire in #86
• Polish KyNotes interface while preserving controls and settings by @Yoshiofthewire in #88
• fix: trust no proxy by default; trust forwarded headers only from it; flag capsule-only backups by @Yoshiofthewire in #87
• docs: clarify standalone installation and test coverage by @Yoshiofthewire in #89
• Remove obsolete pre-launch owner-move upgrade note by @Yoshiofthewire in #90
• Stop pre-filling a personal KyRecovery URL in admin backups by @Yoshiofthewire in #91
• Fix three web bugs found while filming the launch videos by @Yoshiofthewire in #92
• Bump Node to 26.12.1 (CVE-2026-111497) by @Yoshiofthewire in #93
• Release Dependabot changes daily as vX.Y.Z.N by @Yoshiofthewire in #94
• build: Go 1.27.3 for GO-2026-6809 by @Yoshiofthewire in #95
• release: v0.4.3 by @Yoshiofthewire in #96
• Send comment mentions and accept only notebook members by @Yoshiofthewire in #97
• Open the emoji menu only at a word start with two letters by @Yoshiofthewire in #98

Full Changelog: v0.4.2...v0.4.3