Repository navigation
v0.2.0
What's new
This release is mostly about protecting your data. A pre-1.0 review of the whole codebase turned up several ways information could be silently lost — nothing that had necessarily gone wrong for anyone, but each a real possibility. All of them are now fixed.
Your data is safer
- Merging duplicate contacts no longer discards history. Previously, merging two records kept only one side's interaction log, tags, news mentions and screenshots — the other side's was deleted. Everything from both contacts is now preserved.
- Backups are now guaranteed to be readable. Backups were copied straight from the live database file, which meant a backup taken at the exact moment the app was writing could be saved in a damaged, unrestorable state. Backups are now made from a proper snapshot. This affects automatic backups, manual exports, and moving your vault to a new location.
- Deleting things in a shared project now sticks. Deleted contacts, project members and log entries could reappear the next time collaborators synced. Deletions now propagate properly.
- Changes from collaborators who work offline no longer go missing. If someone worked offline and synced later, some of their entries could be skipped permanently. All entries now arrive.
- Interactions logged against several shared projects reach all of them, rather than only the first.
- Deleting a contact now removes its screenshots instead of leaving encrypted files behind on disk.
- Large exports work. Exporting or converting a project with more than 999 contacts previously failed outright.
Shared projects
- Two different people who share a phone number are no longer merged into one contact. Matching a collaborator's contact against your own now requires a matching email address; a shared office or family line isn't enough on its own.
- Whether you've seen or dismissed a news alert is now personal to you. Marking an alert read no longer changes anything for your collaborators, and vice versa.
- What "sync" actually promises is now written down. The user guide and security page explain the practical rule (avoid editing the same project at the same moment), what a Dropbox-style "conflicted copy" file means, and why you shouldn't delete one if you see it. This is a documentation change — the behaviour is unchanged — but it covers a case where you could lose work without realising.
Fixes and smaller things
- Duplicate detection now finds pairs it previously missed when related duplicates had been dismissed earlier.
- Reminders that came due while notifications were switched off now appear once they're switched back on.
- "Date added" filters no longer select the wrong day depending on your timezone.
- The version link in Settings now shows the correct version in installed builds.
- Calendar and contact-card exports handle long lines and unusual characters correctly.
- Development builds no longer share a database with the installed app.
Security transparency
The security page now states plainly that Sourcerer has not yet had an independent third-party security audit. The encryption uses standard, well-reviewed building blocks rather than anything homegrown, and the source is open for anyone to inspect — but no outside reviewer has examined it, and that's worth knowing when deciding whether it fits your threat model. An external review has been applied for, and this will be updated when the status changes.
Dependency security updates were also applied, clearing all resolvable advisories in the build toolchain.
Details
- chore: v0.1.18 by @tomcardoso in #425
- Fix dev builds colliding with production database by @tomcardoso in #427
- Fix data loss when merging duplicate contacts by @tomcardoso in #444
- Sync: explicit replication state — per-project push tracking, full-scan pull, deletion tombstones by @tomcardoso in #449
- Fix appVersion IPC, ICS/vCard spec nits, and add ESLint to CI by @tomcardoso in #450
- Sync fidelity: preserve handle created_at; don't discard sync data on conflict-copy cleanup by @tomcardoso in #451
- Fix orphaned screenshot files, UTC date-filter bug, and notification-checker nits by @tomcardoso in #452
- Fix SQLite variable limit in exports; extract shared-project creation flow by @tomcardoso in #453
- Use VACUUM INTO for consistent database snapshots in backups by @tomcardoso in #454
- Require email match for UUID adoption; make mention read state per-user by @tomcardoso in #455
- Index every co-owner of an email/phone in dedup detection by @tomcardoso in #456
- Document the sync engine's actual consistency guarantees by @tomcardoso in #457
- Clear all resolvable Dependabot alerts by @tomcardoso in #458
- Release v0.2.0 by @tomcardoso in #459
- Give the SQLCipher-heavy test suites room on Windows CI by @tomcardoso in #460
Full Changelog: v0.1.18...v0.2.0
Installation
macOS
Download Sourcerer-0.2.0-arm64.dmg
Open the .dmg and drag Sourcerer to your Applications folder.
First launch: macOS may show a security warning. Go to System Settings → Privacy & Security and click Open Anyway, or right-click the app and choose Open.
Linux
Download Sourcerer-0.2.0.AppImage
Make it executable and run it:
chmod +x Sourcerer-0.2.0.AppImage
./Sourcerer-0.2.0.AppImageWindows
Download Sourcerer.Setup.0.2.0.exe
Run the installer.
Updating
If you already have Sourcerer installed, the app will notify you when a new update is ready. Click Update available in the title bar, then Restart to update once the download completes.
Resources
About the other files
Files ending in .blockmap and latest-*.yml are required for the in-app updater and must remain attached to the release. If you are downloading Sourcerer manually, you do not need these files — you only need the .dmg (macOS), .AppImage (Linux), or .exe (Windows) installer.
