v0.31.0-rc.1

0.31.0-rc.1 (2026-08-30)

Summary

Memos 0.31.0-rc.1 introduces first-class Spaces for collaboration while preserving individual memo ownership. It also brings a unified sidebar and global composer, inline attachment images and optional media metadata, Saved Views, richer link previews, and consistent tag and mention parsing.

This release candidate separates instance access policy from its public URL and strengthens attachment authorization, database upgrades, and live-update performance. Existing memos keep their identity, author, visibility, and relations and start as Unassigned rather than being placed into a generated default Space.

⚠ BREAKING CHANGES

• Saved Views: Saved Views replace Shortcuts throughout the API, MCP surface, persisted settings, resource names, and web routes. ShortcutService and /api/v1/users/*/shortcuts/* become MemoViewService and /api/v1/users/*/views/*, and the web route moves from /shortcuts to /views. Stored shortcut data is migrated automatically, but API clients, MCP integrations, and saved links must be updated. (#6167)
• Memo ownership: Instance administrators are no longer implicit memo collaborators or Space members. Memo, attachment, reaction, relation, and share mutations are author-controlled; Space administrators manage the Space and its membership but cannot edit another author's memo. (#6228)
• Comments: Comments now have independent visibility, placement, and lifecycle. CreateMemoComment no longer inherits the context memo's visibility, so an unspecified value becomes PRIVATE. SetMemoRelations rejects COMMENT relations, and deleting a memo removes only that memo, its owned resources, and incident relations instead of cascading into comment memos. (#6228)
• Reactions: Removed Reaction.content_id from the public API; integrations must identify the memo from the request or reaction resource name. Stored reactions are migrated to internal memo IDs, and orphaned reactions whose memo no longer exists are discarded. (#6221)
• Managed attachments: Managed Markdown images must be bound to the memo before or during the same mutation. S3-backed attachments no longer return presigned object URLs in external_link; clients should use the authenticated Memos file route. (#6169) (#6210)
• Usernames and mentions: Username lookup and authentication are now exact-case. New and renamed usernames use 1–36 ASCII letters, digits, or interior hyphens, and mentions follow the same Markdown-aware grammar. Legacy usernames remain addressable, but email-like, underscore-containing, or non-ASCII legacy spellings cannot be authored as new mentions. (#6134)
• Quick Find: Removed the global Cmd/Ctrl+K shortcut. Quick Find remains available from the sidebar search action. (#6219)
• RSS: Removed the Explore and per-user RSS feeds. /explore/rss.xml and /u/:username/rss.xml now return 404. (#6243)

Upgrade notes

• Instance access: Public or private access is now stored independently of instance-url. The first upgraded startup preserves the legacy behavior—instances with a configured URL become public and those without one remain private—but later URL changes no longer alter access. Upgrade all replicas before changing the mode because older binaries still infer access from the URL. instance-url must now be an absolute HTTP(S) URL without credentials, a query, or a fragment. (#6225)
• Spaces: Existing memos remain Unassigned and no default Space is created. Deleting a Space permanently deletes every memo directly assigned to it and its owned resources, while removing a member leaves their contributions in place. Accounts with active Space memberships cannot be deleted, even with force. (#6228)
• Database migrations: SQLite, MySQL, and PostgreSQL migrations preserve existing memo data, migrate Saved Views and legacy storage settings, and retain generated-ID high-water marks. (#6184) (#6247)
• Tag indexes: Existing memo payloads are not automatically rebuilt for the new tag grammar. Rendering and editing use the new rules immediately, while tag filters and statistics adopt them as each memo is next saved. (#6132)
• Deployment: Private webhook destinations can now be limited to exact hostnames, IP addresses, or CIDRs with --webhook-private-network-allowlist. The blanket --allow-private-webhooks option remains compatible but is deprecated. Building Memos from source now requires Go 1.27. (#6217) (#6225)

Highlights

• Collaborative Spaces: Added first-class Spaces with ADMIN and USER memberships. Each memo—including a comment—remains author-owned and may be Unassigned or placed in exactly one Space without changing its identity. Placement and audience remain independent: use the new SPACE visibility for members-only reading. (#6228)
• Space-aware browsing and management: The Space switcher scopes Home, Explore, memo creation, statistics, filters, and attachments, while Archived, Inbox, profiles, and Settings stay global. Administrators can manage metadata and roles and invite existing users, but an invitation grants no access until the invitee accepts. New Spaces use UUIDv4 identifiers by default and also support custom stable UIDs. (#6230) (#6232) (#6234) (9d2b77c)
• Navigation and writing: Replaced the dual navigation rails with one route-aware, resizable sidebar containing the calendar, Saved Views, tags, Quick Find, and contextual resource navigation. A global composer can create a memo from any authenticated route. (#6144) (#6148) (#6219)
• Inline images and media details: Added cursor-aware image insertion from upload, paste, drag-and-drop, or existing attachments, with retry and draft-restoration support. Users can optionally preserve normalized dimensions, camera details, capture time, location, and video duration and inspect them in the attachment viewer. (#6169) (#6172) (#6180)
• Attachment storage: Added named storage configurations with stable IDs so existing S3 attachments remain readable across configuration changes. Legacy settings migrate automatically, and managed S3 files are proxied through authenticated routes with range-request support. (#6184) (#6210)
• Tags and mentions: Unified parsing across the backend, renderer, editor, filters, statistics, and API. Tags now consistently support multilingual text, emoji, hierarchy, numeric values, -, +, &, and word-internal apostrophes while respecting Markdown context; mentions now follow the exact-case username grammar. (#6132) (#6134) (#6135)
• Link previews: Added standards-based oEmbed, Open Graph, Twitter Card, JSON-LD, HTML metadata, and semantic fallback discovery, with bounded fetching, caching, request coalescing, and existing SSRF protections. (#6206)
• Filtering and live updates: Added location-aware memo filtering and reduced redundant SSE connections by sharing one visible-tab connection across browser tabs and lowering server fanout overhead. (#6181) (dd18002)

Fixes and polish

• Editor and Markdown: Preserved IME composition, restored Windows emoji input, matched tag autocomplete on hierarchical path segments, kept task checkboxes controlled, prevented currency from being parsed as inline math, aligned outline links with rendered headings, and scoped presentation toggles correctly. (#6159) (#6216) (#6227)
• Attachments and sharing: Kept share tokens on shared-memo thumbnails, linked attachment-library media back to source memos, and detected HEIC and HEIF uploads reliably from filename extensions. (#6155) (#6246) (c4221c6)
• Database reliability: Began SQLite memo mutations with BEGIN IMMEDIATE so concurrent writers queue instead of intermittently returning SQLITE_BUSY, and hardened 0.31 upgrades against malformed legacy settings and generated-ID reuse. (#6192) (#6247)
• Navigation and interface: Preserved memo scope across global navigation, separated Archived from Space scope, restored sidebar and outline behavior, constrained the resizable month calendar, and kept select menus above parent popovers. (#6161) (83eab44) (040f9ae)
• Maps and localization: Restored keyless OpenStreetMap tiles, added Hebrew and comprehensive RTL support, refreshed Japanese, Traditional Chinese, and Russian translations, and corrected the French memo-link label. (#6182) (#6203) (#6215) (#6241) (#6242)
• API and settings: Omitted unset protobuf message fields from gateway JSON while preserving scalar defaults and empty lists, and enforced the configured memo-content length limit. (#6156) (45c3a79)
• Security: Updated golang.org/x/crypto to 0.52.0 to address CVE-2026-39829. (#6152)