Skip to content

NOTO v1.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 03:53
· 70 commits to main since this release
v1.4.0
d005b14

Highlights

  • Accounts work. Sign in with an email and password and Noto is signed in — a real profile on the Home and Account screens, and this browser listed as a device. Everything before this read a fixture.
  • Sign-up, protected by Cloudflare Turnstile. Creating an account now goes through a bot check that is verified server-side, where the secret that makes a token mean anything never reaches a browser.
  • Signed out is still the whole application. Nothing here is a gate. Noto opens, writes and searches with no account, and a build with no Supabase credentials behaves exactly as it did before.
  • Signing out ends the session. It used to walk you to the sign-in screen and leave the session in storage, so the next reload signed you straight back in. It is an action on the account now — offered from the header menu and from the account screen — and the stored session goes whatever the server answers.

Improvements

  • The account screen is a protected route. Signed out, it sends you to sign in and remembers what for, so you land back on it afterwards rather than on Home; a profile, a device list and a security history belonging to nobody are never drawn. Everything else stays open to everyone, because Noto is local-first and the work belongs to the device.
  • A session coming back is no longer mistaken for no session. Reloading the account screen used to throw you off it for the moment the session took to restore.
  • Noto now notices when a session ends somewhere else — another tab, or a refresh token that ran out — and says so, rather than carrying on as though you were still signed in until the next reload.
  • The cloud loads only when it is needed. @supabase/supabase-js moved out of the entry bundle behind a dynamic import, so a visitor who has never signed in no longer downloads 164 kB to be told they are signed out.
  • Password rules are stated once, in @noto/config. The sign-up form and the service previously kept their own minimum and disagreed by four characters, which the person signing up discovered on submit.
  • Validation failures arrive on the field that caused them. The server has always sent per-field detail; nothing was displaying it.

Bug fixes

  • Sign-out did nothing but change the screen. Until this, ending a session meant closing the browser and hoping.
  • A sign-in whose profile could not be loaded reported success and left you on an account screen with nothing on it. It is reported as the failure it is, and the session survives for the retry.
  • Sign-in and sign-up failed from a browser with "Could not reach the server". The Edge Functions' CORS preflight did not name the apikey header that every Supabase call sends.
  • Edge Functions can now import the workspace packages they were always meant to share. Deno could not resolve the extensionless relative imports the bundler accepted, so no function using @noto/backend had ever deployed.

A note on password strength

The Have I Been Pwned lookup, the common-sequence list and the email-substring
rule have been removed from sign-up, and the minimum length is six characters.
A password already present in a public breach corpus is now accepted. Turnstile
and the per-IP rate limit are what guard the endpoint.

Downloads

Windows

Package File
Installer (x64) Noto-1.4.0-win-x64.exe
Installer (ARM64) Noto-1.4.0-win-arm64.exe

macOS

Package File
Disk image (Apple Silicon) Noto-1.4.0-mac-arm64.dmg
Disk image (Intel) Noto-1.4.0-mac-x64.dmg
Archive (Apple Silicon) Noto-1.4.0-mac-arm64.zip
Archive (Intel) Noto-1.4.0-mac-x64.zip

Linux

Package File
AppImage (x64) Noto-1.4.0-linux-x64.AppImage
Debian package (x64) Noto-1.4.0-linux-x64.deb
RPM package (x64) Noto-1.4.0-linux-x64.rpm

Android

Package File
APK (64-bit) Noto-1.4.0-android.apk
APK (32-bit) Noto-1.4.0-android-armeabi-v7a.apk
App bundle (Play Store) Noto-1.4.0-android.aab

The web application needs no download and is always at the latest version.

Verifying a download

Checksums for every asset are published as SHA256SUMS.txt.

sha256sum --check --ignore-missing SHA256SUMS.txt

Updating

Windows and macOS installations update themselves: Noto checks for a new version on startup, downloads it in the background, and applies it on the next restart.

On Linux, replace the AppImage or install the new .deb/.rpm through your package manager.

System requirements

Platform Requirements
Windows Windows 10 or later, x64 or ARM64, 4 GB RAM, 500 MB storage
macOS A supported modern macOS version, Apple Silicon or Intel, 4 GB RAM, 500 MB storage
Linux x64, 4 GB RAM, 500 MB storage
Web A current version of Chrome, Edge, Firefox or Safari

Full details: System requirements

Full Changelog: v1.3.0...v1.4.0

Assets 17
Loading