1.2.3

Fixed

• Concurrent edits to a note are no longer overwritten. Appending a Price
  Watch row and refreshing the auto-filled description both read the note,
  built a new body from it, and wrote that back. Anything typed in between —
  and an Aladin price lookup leaves a whole network round-trip of room — was
  silently discarded. Both paths now use Vault.process(), which reads and
  writes as one atomic operation.
• Sentence case in six UI strings: four settings names ending in Key → key,
  plus the Reading log and Price check headings.

Security

Development-toolchain only — the packages below live in devDependencies and
never reach the bundled main.js.

• Bumped vitest 2.1.9 → 3 and @vitest/coverage-v8 to match, clearing two
  critical advisories in @vitest/mocker (arbitrary file read/execute while
  the Vitest UI server is listening). Dependabot never proposed this because
  the fix needs a major bump — npm audit surfaced it instead. With the
  follow-up npm audit fix for transitive brace-expansion and fast-uri
  advisories, npm audit goes from 9 vulnerabilities to 0.

Changed

• Dependency bumps: eslint 9 → 10, @types/node 22 → 26, happy-dom 15 →
  20, esbuild 0.25.5 → 0.28.1 (includes a path-traversal fix in esbuild's
  dev server), eslint-plugin-obsidianmd 0.4.1, globals, typescript-eslint,
  and the actions/checkout + actions/setup-node CI actions to v7.
• Configured obsidianmd/ui/sentence-case with this plugin's own vocabulary
  (acronyms, provider brand names, and an ignore list for Korean UI copy and
  literal placeholder strings), taking lint from 48 warnings to 2. The rule
  stays on so it keeps checking English UI strings.