Skip to content

NotallyXYZ 1.1.3

Choose a tag to compare

View all tags
@Turtlecute33 Turtlecute33 released this 29 Oct 22:57
· 57 commits to main since this release
v1.1.3
4982e52
This commit was signed with the committer’s verified signature.
Turtlecute33 Turtlecute
SSH Key Fingerprint: 1fgzJlwk8OlOBEuXdLl+m01foZIi1UWGyvcb0b6zxh8
Verified
Learn about vigilant mode.

Fixes

Security and robustness fixes for sync on all platforms.

  • All clients: API responses and blob downloads have a size limit (blob downloads larger than 1 GiB are not kept). A blob that is too large for the server stays pending while a note uses it, and the note push continues. Before, on macOS such a blob stopped all note uploads, and on Linux and Windows it was marked as uploaded. Attachment names are counted in UTF-8 bytes.
  • Android: skips an attachment that does not open, so one bad attachment does not stop each sync. After a failed live sync, it waits before it tries again. Reminder loops have a cap and jump over old minute and hour steps, so a reminder with a very old date cannot hang the app.
  • macOS, Linux and Windows: do not save a note body that grows past 393,216 UTF-16 units (the Android limit). Android cuts a longer body, and a later edit on Android could push the cut note to all devices.
  • macOS: shows save errors in the editor and in the status bar. It does not follow redirects and refuses a server URL with a user name or password. It does not apply a label whose id does not match its value, and it repairs a note that does not decode. Risky attachment types (for example .app installers, scripts, .webloc) show in Finder and do not open. Duplicate does not open a copy that was not saved.
  • Server: mem_limit 256m and GOMEMLIMIT 192MiB (was 128m / 96MiB). The key parser also removes carriage returns. server/PROTOCOL.md gives the body limit, the label id rule and the attachment name rule.

Update

  • Android: install NotallyXYZ-android-1.1.3.apk over 1.1.2 (same signing key).
  • macOS with Homebrew: brew upgrade --cask notallyxyz.
  • Linux and Windows: built by GitHub Actions and attached a few minutes after the release.
  • Server: ghcr.io/turtlecute33/notallyxyz-server:1.1.3 (also :1.1 and :1). If you use your own compose.yaml, set mem_limit: 256m and GOMEMLIMIT: 192MiB.

Android APK SHA-256: e485dc92ca0994e94db361a07ab42cf44aea8580cb6fcfe12b685d65e7d507c3
Signing certificate SHA-256: 81776480a2afa0aced066d0b44631dd2159e267d10555a8cefcabd5c9ef9b48b

Check: sha256sum -c SHA256SUMS --ignore-missing. Desktop files: gh attestation verify <file> -R Turtlecute33/NotallyXYZ.

Assets 10
Loading