0.1.6

What's new

• Adds per-send, opt-in support for HTTPS JPEG, opaque PNG, and static GIF images referenced by Markdown image tokens.
• Uses an SSRF-hardened transport with public-IP validation, DNS pinning, isolated TLS sockets, same-origin redirects, strict deadlines, and bounded downloads.
• Reuses the existing EPUB image validation, hashing, deduplication, and privacy preflight pipeline.
• Cancels active remote downloads and presigned document uploads when the send is cancelled or the plugin unloads.
• Keeps remote transparent PNG/WebP conversion disabled because browser decoding cannot be cancelled safely; SVG remains planned for 0.1.7.

Verification

• 241 automated tests
• Typecheck, ESLint, production build, and dynamic-code bundle policy
• Live public HTTPS image fetch and Obsidian 0.1.6 load validation
• GitHub artifact provenance attestation

Full Changelog: 0.1.5...0.1.6

Notes to Kindle 0.1.5

What's new

• Convert vault-local transparent PNG and static WebP images to opaque JPEG entirely inside Obsidian.
• Flatten transparent pixels onto a white background before EPUB packaging.
• Reject APNG and animated WebP before browser decoding.
• Revalidate, hash, deduplicate, cache, and budget the exact converted JPEG bytes.
• Limit conversion attempts and deduplicate identical source bytes to prevent resource amplification.
• Show converted-image count and metadata behavior in the privacy preflight.

Remote images remain disabled for the planned 0.1.6 work. SVG remains disabled for the planned 0.1.7 work.

Verification

• 212 automated tests passing.
• Typecheck, lint, production build, generated-bundle policy, and security review passing.
• End-to-end conversion and rendering verified in Obsidian and on a physical Kindle.

Full changelog: 0.1.4...0.1.5

Notes to Kindle 0.1.4

What's new

• Include validated vault-local JPEG, opaque PNG, and static GIF images in EPUB exports.
• Resolve images relative to root and embedded notes, with SHA-256 deduplication and bounded resource limits.
• Add an explicit privacy preflight before image bytes and retained EXIF/GPS metadata are sent to Amazon.
• Preserve remote and unsupported images as safe alt text or omission markers without downloading them.
• Support Amazon's exact current CAPS upload host (zme-caps.amazon.com) while retaining strict URL validation.

Verification

• 201 automated tests passing.
• Typecheck, lint, production build, generated-bundle policy, and EPUBCheck 5.3.0 passing.
• End-to-end delivery verified on a physical Kindle.

Full changelog: 0.1.3...0.1.4

Notes to Kindle 0.1.3

Notes to Kindle 0.1.3

This release replaces JSZip with fflate to remove obsolete browser polyfills from the generated bundle. EPUB output remains compatible: the mimetype entry is still first and stored uncompressed, while document entries use DEFLATE compression.

Community review readiness

• Removes all dynamic <script> element creation and new Function patterns inherited from JSZip.
• Adds a CI and release gate that rejects those patterns if they return.
• Limits release assets to the files supported by the Obsidian Community directory.
• Enables GitHub Issues as the public support channel.

This app was not created or endorsed by Amazon.

Full Changelog: 0.1.2...0.1.3

Notes to Kindle 0.1.2

Notes to Kindle 0.1.2

This release adopts the approved Community Plugin identity Notes to Kindle (notes-to-kindle). The pre-community send-to-kindle identity is deprecated but preserved in release history and credential migration compatibility.

Upgrade from 0.1.1

1. Disable send-to-kindle in Obsidian.
2. Rename the plugin folder to notes-to-kindle.
3. Replace main.js and manifest.json with the 0.1.2 release assets while preserving data.json.
4. Re-enable Notes to Kindle and confirm the default device and hotkeys.

Existing credentials remain compatible and are not stored in data.json.

This app was not created or endorsed by Amazon.

Full Changelog: 0.1.1...0.1.2

0.1.1

Full Changelog: 0.1.0...0.1.1

0.1.0

0.1.0\n\n- Harden Amazon STK auth, request signing, and upload flow\n- Improve account visibility and destination management in plugin settings\n- Add runtime destination picker for sending notes\n- Audit security posture and remove dynamic XML regex parsing