Skip to content

Nametag

v0.19.0 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 5mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Affected surfaces

crypto_tls rce_ssrf

Summary

AI summary

Bidirectional CardDAV contact sync adds incremental updates, conflict resolution UI, and per‑person toggles.

Full changelog

CardDAV Sync

Nametag can now sync contacts bidirectionally with CardDAV servers including Google Contacts, iCloud, Outlook, and Nextcloud.

Highlights

  • Bidirectional sync — Incremental sync using tokens and ETags, with automatic conflict detection and a side-by-side resolution UI
  • Connection wizard — Provider presets for Google, iCloud, Outlook, and Nextcloud make setup straightforward
  • Import & Export — Import contacts from your CardDAV server (with preview and duplicate detection), bulk export from Nametag, or upload .vcf files directly
  • Auto-export — New and updated contacts are automatically pushed to your CardDAV server
  • Background sync — Configurable cron interval syncs changes automatically
  • Per-person sync toggle — Control which contacts sync to CardDAV; disabling removes the contact from the server while keeping it in Nametag
  • QR code export — Share individual contacts via QR code
  • vCard 3.0/4.0 support — Full field mapping including phones, emails, addresses, URLs, IMs, locations, photos, and custom fields

Security

  • AES-256-GCM encryption for stored CardDAV credentials
  • SSRF protection on imports
  • Zod validation on all CardDAV API routes

Other improvements

  • Real-time sync progress via SSE streaming
  • Photo storage moved to files (no longer base64 in DB)
  • Person detail page updated with all new contact fields
  • Full i18n support across all locales
  • 20+ new test files

Security Fixes

  • AES-256-GCM encryption added for stored CardDAV credentials
  • SSRF protection implemented on imports
  • Zod validation enforced on all CardDAV API routes

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Nametag

Get notified when new releases ship.

Sign up free

About Nametag

Simple personal relationship manager

All releases →

Related context

Beta — feedback welcome: [email protected]