Wattle Notes 0.1.9 — security fixes alpha

Superseded by 0.1.10 alpha. The 0.1.9 Mac app fails bundle-signature verification and may be reported as damaged. Use the corrected 0.1.10 package or a later release.

Security fixes for the macOS Apple Silicon developer alpha.

• Updates the bundled SQLite engine to 3.53.2 and Rustls to 0.23.46, addressing the dependency scan findings.
• Enables defensive SQLite settings and verifies compatibility with an index created by the previous engine.
• Removes unused legacy updater ZIP support and backports the upstream GLib iterator safety fix required by the Linux GTK3 stack.
• Adds dependency minimum-version and local-patch integrity checks to CI, with updated source and license notices.

Google sign-in remains built in. Existing local Markdown notes, settings and updater trust are preserved. Install this numeric version 0.1.9 through Settings → App updates, or download the Mac ZIP below.

Mostly vibe coded with AI assistance. This is an alpha; the Mac build is unsigned by Apple and not notarized. Five unmaintained-dependency warnings remain; the repeat npm and Rust scans report no known vulnerability alerts. The Linux backport is additionally checked independently because registry scanners skip local path dependencies.

Assets include the Mac app, matching GPL-3.0-or-later source, checksums and signed updater payload. Website files and local continuity documents are excluded. See docs/dependency-security.md in the source for details and follow-up work.