This release includes 3 security fixes for security teams reviewing exposed deployments.
Published 5mo
Productivity & Wikis
✓ No known CVEs patched
This release patches 3 known CVEs
Affected surfaces
crypto_tls
rce_ssrf
Summary
AI summaryBidirectional CardDAV contact sync adds incremental updates, conflict resolution UI, and per‑person toggles.
Full changelog
CardDAV Sync
Nametag can now sync contacts bidirectionally with CardDAV servers including Google Contacts, iCloud, Outlook, and Nextcloud.
Highlights
- Bidirectional sync — Incremental sync using tokens and ETags, with automatic conflict detection and a side-by-side resolution UI
- Connection wizard — Provider presets for Google, iCloud, Outlook, and Nextcloud make setup straightforward
- Import & Export — Import contacts from your CardDAV server (with preview and duplicate detection), bulk export from Nametag, or upload
.vcffiles directly - Auto-export — New and updated contacts are automatically pushed to your CardDAV server
- Background sync — Configurable cron interval syncs changes automatically
- Per-person sync toggle — Control which contacts sync to CardDAV; disabling removes the contact from the server while keeping it in Nametag
- QR code export — Share individual contacts via QR code
- vCard 3.0/4.0 support — Full field mapping including phones, emails, addresses, URLs, IMs, locations, photos, and custom fields
Security
- AES-256-GCM encryption for stored CardDAV credentials
- SSRF protection on imports
- Zod validation on all CardDAV API routes
Other improvements
- Real-time sync progress via SSE streaming
- Photo storage moved to files (no longer base64 in DB)
- Person detail page updated with all new contact fields
- Full i18n support across all locales
- 20+ new test files
Security Fixes
- AES-256-GCM encryption added for stored CardDAV credentials
- SSRF protection implemented on imports
- Zod validation enforced on all CardDAV API routes
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]