Skip to content

Super Productivity

v18.10.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

android flowmodoro flowtime habit-tracker ios issue-tracker
+13 more
linux local-first macos pomodoro pomodoro-timer privacy productivity task-manager time-tracker time-tracking to-do-list todo windows

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 1mo

The v18.10.0 release patches stored XSS and RCE vulnerabilities affecting notes, images, plugin execution, and CSP handling.

Why it matters: Critical severity (95) security fixes for stored XSS and RCE across multiple surfaces require immediate attention from developers, SREs, and security engineers.

Summary

AI summary

Updates Calendar, Planning & Reminders, Integrations & Plugins, and Desktop & Android across a mixed release.

Changes in this release

Security Critical

Fixes stored XSS and RCE vulnerabilities in notes, note images, plugin nodeExecution, and CSP handling.

Fixes stored XSS and RCE vulnerabilities in notes, note images, plugin nodeExecution, and CSP handling.

Source: llm_adapter@2026-06-12

Confidence: high

Feature Low

Adds completed-task filter to search.

Adds completed-task filter to search.

Source: llm_adapter@2026-06-12

Confidence: high

Feature Low

Includes note content in global search and improves folder search support.

Includes note content in global search and improves folder search support.

Source: llm_adapter@2026-06-12

Confidence: high

Feature Low

Adds keyboard shortcuts to the fullscreen note editor.

Adds keyboard shortcuts to the fullscreen note editor.

Source: llm_adapter@2026-06-12

Confidence: high

Feature Low

Adds optional shortcuts for scheduling and a shortcut to set task deadlines.

Adds optional shortcuts for scheduling and a shortcut to set task deadlines.

Source: llm_adapter@2026-06-12

Confidence: high

Feature Low

Adds hover tooltips to reminder popups and restores imported legacy task reminders.

Adds hover tooltips to reminder popups and restores imported legacy task reminders.

Source: llm_adapter@2026-06-12

Confidence: high

Feature Low

Makes recurring CalDAV plugin occurrence edits and deletes safer and quieter.

Makes recurring CalDAV plugin occurrence edits and deletes safer and quieter.

Source: llm_adapter@2026-06-12

Confidence: high

Bugfix Medium

Fixes overlapping same-time tasks in Schedule view.

Fixes overlapping same-time tasks in Schedule view.

Source: llm_adapter@2026-06-12

Confidence: high

Bugfix Medium

Fixes recurring tasks being double-counted in Today and planner views.

Fixes recurring tasks being double-counted in Today and planner views.

Source: llm_adapter@2026-06-12

Confidence: high

Bugfix Medium

Fixes Android WebView white screens on resume.

Fixes Android WebView white screens on resume.

Source: llm_adapter@2026-06-12

Confidence: high

Full changelog

For all current downloads, package links, and platform-specific notes: check the wiki.

Highlights

  • Redesigned the idle dialog with a choice-first flow.
  • Overhauled the Focus Mode screen UX.
  • Added checklist progress, bulk actions, and notes editor UX improvements for tasks.
  • Added a project completion experience.
  • Improved boards project selection with multi-select and sidebar support.

Search, Notes & Shortcuts

  • Added a completed-task filter to search.
  • Included note content in global search and improved folder search support.
  • Added keyboard shortcuts to the fullscreen note editor.
  • Added optional shortcuts for scheduling and a shortcut to set task deadlines.
  • Improved long-word wrapping, soft line breaks, and checklist labels in markdown notes.

Calendar, Planning & Reminders

  • Improved calendar design and recurrent task calendar design.
  • Allowed writable plugin calendar events to be rescheduled from Schedule.
  • Fixed overlapping same-time tasks in Schedule.
  • Fixed recurring tasks being double-counted in Today and planner views.
  • Added hover tooltips to reminder popups and restored imported legacy task reminders.
  • Made recurring CalDAV plugin occurrence edits and deletes safer and quieter.

Sync, Backup & Data Safety

  • Improved CalDAV calendar discovery and handling of missing DAV response headers.
  • Preserved entity order during sync data repair.
  • Made “Use Server Data” recoverable and guarded the destructive choice.
  • Kept local sync and schedule settings local during sync.
  • Added Android automatic backup restore and automatic backup file limit configuration.
  • Surfaced native WebDAV errors more clearly.

Integrations & Plugins

  • Added Redmine issue search by ID, non-Latin search support, and optional project identifiers for global search.
  • Added Jira issue priority display and fixed auto-import pagination, proxy handling, transitions, and yesterday worklog time.
  • Added configurable GitHub issue provider API base URL.
  • Added Azure DevOps auto-import limit configuration.
  • Included Trello workspace boards in the picker.
  • Migrated Gitea and Linear issue providers to plugins.
  • Showed plugin authors and returned plugin dialog results.

Desktop & Android

  • Restored BMP/AVIF desktop background image support.
  • Improved desktop sync-folder handling and tray title settings.
  • Added a day/night Android launch splash background.
  • Fixed Android WebView white screens on resume.
  • Improved Android timer notifications and background behavior.
  • Made Android back button close popups and added Vanadium WebView support.
  • Deferred mobile notification permission prompts until first use.

Security & Privacy

  • Fixed stored XSS/RCE-related vulnerabilities in notes, note images, plugin nodeExecution, and CSP handling.
  • Hardened desktop URL, file path, backup loading, and local file URL handling.
  • Reduced logging of local paths, issue payloads, provider configs, archived task data, dragged task objects, and other sensitive data.
  • Hardened plugin iframe isolation and nodeExecution grants.

Performance & Polish

  • Reduced per-task store subscription and selector overhead.
  • Improved heatmap and Super Sync account badge contrast.
  • Improved task, project, tag, habit, navigation, work-context, and calendar UI details.
  • Fixed task menu keyboard handling, subtask shortcut behavior, project menu typeahead, and kanban in-progress tag cleanup.

Full Changelog: https://github.com/super-productivity/super-productivity/compare/v18.9.1...v18.10.0

Security Fixes

  • Fixed stored XSS/RCE vulnerabilities in notes, note images, plugin nodeExecution, and CSP handling; hardened desktop URL/file handling and reduced sensitive logging

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Super Productivity

Get notified when new releases ship.

Sign up free

About Super Productivity

Advanced todo list app with integrated timeboxing and time tracking capabilities. Integrates with Jira, GitHub, GitLab, Redmine and OpenProject.

All releases →

Related context

Beta — feedback welcome: [email protected]