v2.83.1

Self-hosted ZenNotes server 2.83.1. Please update: this is a security release for the browser client. Details are in the advisories: GHSA-f33v-gwvr-3j4g and GHSA-896c-3jmh-p7h4.

Security

• Only this server's own pages can use a browser session. On the default 127.0.0.1 bind, pages on other local ports no longer get credentialed CORS. Writes, deletes, uploads and the live-changes socket are refused from other sites, with a 403. To allow another local page on purpose, list it in ZENNOTES_ALLOWED_ORIGINS, or use ZENNOTES_DEV.
• A loopback server with no token answers only to local names: IP addresses, localhost and its subdomains, or names you list in the new ZENNOTES_ALLOWED_HOSTS. A server with a token, or on another bind, is unaffected.
• The web client's script can only connect to its own server and Unsplash (connect-src).
• The startup banner tells the truth about which origins are allowed.

Behavior changes

• JSON endpoints now require Content-Type: application/json and answer 415 otherwise. Every ZenNotes client already sends it; a script using curl -d alone needs -H 'Content-Type: application/json'. The README shows a working example.
• With no token on a loopback bind, a local proxy that forwards a public name needs that name in ZENNOTES_ALLOWED_HOSTS, or a token.
• ZENNOTES_ALLOWED_ORIGINS=* now admits other origins without the session cookie: bearer clients work, cookie-only requests from them get 401.

The browser package is unchanged from 2.83.0 (web-2.83.0-web.h3bde8bddf79885a8). No Go dependency changes: vendorHash is unchanged.

Verification before publication: go, docker, docker-upload, mcp-contract and nix checks passed on #78 at a793cbb, including macOS and Windows; two independent reviews found nothing blocking. The release workflow (run 42135320900) built the five binaries from that commit. Every binary matched SHA256SUMS and the manifest matched the pin. The macOS arm64 binary was run: it reports v2.83.1, gives no CORS headers to another loopback port, answers a cross-site text/plain delete with 403 and JSON without its content type with 415, and accepts a bearer JSON write. The real web client was driven in Chrome against this code with no refused requests and no CSP violations. Windows and Linux binaries were checked by checksum only.

Docker: adibhanna/zennotes:2.83.1, 2.83 and latest are published from this tag.

Thanks to Jan Kahmen (turingpoint) and @na-henry for reporting these.