v1.1.2

Security fixes

Please upgrade. Several of these matter for any instance that is reachable from the internet, and most for one behind the built-in Cloudflare tunnel.

• Client addresses behind a proxy. Behind a proxy that appends to X-Forwarded-For (Cloudflare, so also the built-in tunnel, and nginx in its usual setup) salt.md read the first entry, which the caller writes. Anybody could name their own address: a fresh one for every password guess past the sign-in limit, or somebody else's, to use up that address's budget of wrong tokens, which refuses every token from there, valid ones included. Only the entry the proxy wrote counts now.
• Links in the print view and on shared pages. A link inside the text went out as typed, so a link written as javascript: ran on one click with the session of whoever had the page open. Every link is checked now, and both documents carry a Content-Security-Policy that admits only their own script.
• Workspace scope and agent rules. A token limited to one workspace could create pages in another, instantiate its templates, export it and take back changes in it. A workspace set to No agents or Only signed-in connections still took writes from tokens over REST, and an unrestricted token could read and write its pages over MCP by id. A viewer's import, and MCP create_page / create_database without a workspace, could land in a workspace the viewer may only read (thanks to @mungle for #78). Writing now goes through the same gates as reading.
• Open editors after access ends. An open editor kept receiving every edit after its reader lost the page: made private, removed from the workspace, signed out. Access is checked again every 15 seconds and the editor closes.
• A page nobody could open. Anybody with write access could make a page unopenable in the editor for everyone, with a few hundred tiny edits and by ignoring the request to compact them. Such a page opens again.
• Share passwords could be guessed as fast as requests arrived. Guesses are limited per link and address, on the form and on the JSON route.
• Go 1.27.2. 1.1.1 was built with Go 1.25, with ten reachable standard-library advisories that are fixed only in 1.26.9 and 1.27.2. Binaries and the image are built with Go 1.27.2 now; govulncheck reports nothing reachable. The frontend lockfile is refreshed within its ranges (npm audit: 27 findings to 4, none of them shipped to the browser in a way that matters, see below).

Fixes

• An open tab could undo an agent's write (#79). Typing in the second before an agent rewrote a page, a tab whose connection dropped during the rewrite, or a tab loading the page at that moment could put the old text back, with the agent's text in no revision. Every write from outside the editor now starts a new document generation; a stale copy is refused and kept in the page history instead. Thanks to @d-perelygin for the report.
• Sharing (#68). Opening the globe menu published a page on the spot, so looking at a page's sharing state shared it, and checking whether Stop sharing had worked published it again under a new address. The menu now only shows the state; a link exists after Create link or New link. Changing the expiry or password waits for New link instead of silently replacing the link you just copied, a refused Stop sharing says so, and public pages are sent with Cache-Control: no-store. The library shelf that lists pages visible to the workspace is called Workspace instead of Shared.
• An open collection kept its first copy of the schema and sent it back with every view change, so a property an agent had added meanwhile disappeared when somebody resized a column. Only the changed half is sent now, and open views pick up schema changes as they happen.
• A saved filter without a value no longer takes a collection view down (#71).
• The slash menu shows each group once (from #77).
• Moving a page to the trash returns to its parent and closes its tab (from #77).

New

• Agent keys from listed addresses only. Instance settings → Access → Agent keys: an opt-in list of addresses and networks. With it on, API tokens and signed-in agents are accepted only from there, over MCP and REST; browser sign-ins are not affected. Add Anthropic (Claude) fills in the range Anthropic publishes for Claude's connectors. Claude Code running on your own computer calls from your own address.
• cloudflared stays current. salt.md now updates the cloudflared it downloaded itself: daily, checked against the SHA256 GitHub records for the file, and a running tunnel restarts on the new version in a few seconds. The settings show the version and offer Check now. The tunnel token no longer appears in the process list.
• The library and the graph open pages with the modifier rule (#71).

Upgrading

Nothing to do beyond replacing the binary or pulling the image; there is no data migration. If you run salt.md behind two proxies in a row, let the inner one resolve the visitor's address (see Reaching it from outside in the wiki), or every visitor arrives as the outer proxy.

What is left in npm audit needs Vite 8 or Mermaid 12: the development server, and a low-rated KaTeX issue inside Mermaid. Both are separate decisions.

What's Changed

• Small fixes: config normalize, header passthrough, modifier-click follow-ups by @d-perelygin in #71
• Enforce workspace content permissions consistently by @mungle in #78

Full Changelog: v1.1.1...v1.1.2