LowNotes v0.4.0

✨ Features

• Remove vaults from the list — the vault menu in the sidebar removes a vault from LowNotes without touching its folder or notes, which stay on disk and can be opened again later. Vaults whose folders are no longer found are flagged in the list.
• Load remote images when you choose — images hosted on other websites no longer load automatically in notes and assistant messages. Click a blocked image to show it, or enable Settings → Load remote images; images uploaded through Catbox and Imgur keep loading as before.
• Fresh pair codes — Manage connections → New code invalidates every pair code shared so far, and each code now works only once.
• Diagnostic log — LowNotes keeps a rotating log in its application data folder, opened from Settings → Open log folder, to help investigate synchronization and storage problems. It never contains note content, keys or pairing codes.

🔧 Improvements

• A responsive interface during heavy work — reading and writing notes, collaborative history and synchronization run outside the interface thread, and structural locks are held per vault. Large vaults and slow disks no longer freeze the window.
• Lighter typing and synchronization — edits are merged and saved every 150 ms instead of on every keystroke, the preview follows the text with a short delay, and notes are read once when opened. Periodic synchronization reuses file hashes, skips unchanged collaborative documents and slows down for idle devices, while live collaboration keeps one connection per device and merges queued updates.
• Calmer offline devices — unreachable devices are retried with increasing intervals and report one error instead of one per minute. Sync now, or the device reaching you, retries right away.
• In-app dialogs — confirmations, alerts and name prompts use LowNotes' own dialogs instead of the system windows, which also fixes renaming notes and chats on macOS.
• Language and accessibility — the tray menu, the vault folder picker and the palette preview follow the interface language, and counts use singular and plural forms. Modals receive focus, keep Tab inside and return focus when closed; sidebar rows work with the keyboard and the vault menu closes with Escape or an outside click.
• Opt-in web search services — only DuckDuckGo is enabled by default. Existing settings keep DuckDuckGo and any service already configured with a key.
• Every conflict copy is listed — each conflict stays visible until it is opened or dismissed, instead of only the latest one.

🔒 Security

• Secrets stay in the native process — the interface no longer receives the P2P identity, pairing tokens or provider and search keys. Key fields are write-only: a saved key is shown as saved and can be replaced or removed.
• Content Security Policy — the interface runs under a restrictive policy, and remote content loads only when allowed.
• Stricter pairing — unpaired devices may only send a small pairing request within a time limit, the request is bound to the connection identity and tokens are compared in constant time.
• Safer exports — the destination is chosen in a native save dialog controlled by LowNotes, and remote images embedded in Word/PDF exports must use HTTPS and public addresses.
• Updated dependencies — includes fixes for rustls and lodash-es advisories, and the opener plugin no longer accepts custom file flags from the interface. Dependencies are audited weekly.

🐛 Bug fixes

• Links in the preview — clicking a link no longer replaces the app with a blank page; web links open in the browser and note links open the note.
• Release notes in the update dialog — the update prompt shows what changed in the new version again.
• Identity saving failures — a vault identity that cannot be saved no longer goes online and gets replaced on the next start, which would break existing pairings.
• Network restarts — restarting the network closes the previous connection endpoint first.
• Windows file locks — renames and removals tolerate brief locks from antivirus software and indexers.
• Credential store cleanup — replaced secrets no longer leave orphaned entries in Windows Credential Manager, macOS Keychain or Linux Secret Service.

📝 Documentation

• Security, architecture and synchronization guides — added a security policy, code of conduct, changelog, architecture overview, synchronization protocol and threat model. Devices on v0.3.x keep synchronizing with v0.4.0.
• Verifiable downloads — releases include SHA256SUMS, an SPDX software bill of materials and build provenance attestations; verify a download with gh attestation verify <file> --repo LowBloat/LowNotes. The AUR recipe is published with real checksums for every release.