Xafloc/NoteFlow

v0.7.6 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 10d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates Performance, Capability, and Quality across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	High	`notes.md` writes are now atomic using tmp file and os.replace `notes.md` writes are now atomic using tmp file and os.replace Source: llm_adapter@2026-07-16 Confidence: high	—
Security	High	Default bind address restricted to 127.0.0.1 (localhost only) Default bind address restricted to 127.0.0.1 (localhost only) Source: llm_adapter@2026-07-16 Confidence: high	—
Security	High	Upload path sanitization, collision renames, and 50 MiB size cap added Upload path sanitization, collision renames, and 50 MiB size cap added Source: llm_adapter@2026-07-16 Confidence: high	—
Feature
Feature	Medium	External `notes.md` edits detected via mtime polling, skipping while editor is dirty External `notes.md` edits detected via mtime polling, skipping while editor is dirty Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	Contiguous task reindex performed after add, update, or delete operations Contiguous task reindex performed after add, update, or delete operations Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Richer AI context modes added: recent N notes, current note, selection, none, with char budget control Richer AI context modes added: recent N notes, current note, selection, none, with char budget control Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Search requests can be aborted while typing Search requests can be aborted while typing Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	AI chat uses in‑memory notes including unsaved session state AI chat uses in‑memory notes including unsaved session state Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Dependency	Low	Unused 'jinja2' dependency dropped Unused 'jinja2' dependency dropped Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance
Performance	Medium	Checkbox toggles no longer re-render every note or run MathJax Checkbox toggles no longer re-render every note or run MathJax Source: llm_adapter@2026-07-16 Confidence: high	—
Performance	Medium	Shared MarkdownIt instance + O(1) task-index lookup implemented Shared MarkdownIt instance + O(1) task-index lookup implemented Source: llm_adapter@2026-07-16 Confidence: high	—
Performance	Medium	Per-note HTML cache added Per-note HTML cache added Source: llm_adapter@2026-07-16 Confidence: high	—
Performance	Medium	Folder task scan changed to linear (O(n)) from quadratic Folder task scan changed to linear (O(n)) from quadratic Source: llm_adapter@2026-07-16 Confidence: high	—
Performance	Medium	Archiver progress check made cheaper, avoiding full HTML re‑serialize each pass Archiver progress check made cheaper, avoiding full HTML re‑serialize each pass Source: llm_adapter@2026-07-16 Confidence: high	—
Refactor	Low	Config file rewritten only when values actually change Config file rewritten only when values actually change Source: granite4.1:30b@2026-07-16-audit Confidence: low	—

Full changelog

Highlights

Performance, safety, and capability improvements for day-to-day use.

Performance

Checkbox toggles no longer re-render every note or re-run MathJax
Shared MarkdownIt instance + O(1) task-index lookup
Per-note HTML cache
Linear folder task scan (was O(n²))
Cheaper archiver progress check (no full HTML re-serialize each pass)

Safety

Atomic notes.md writes (tmp + os.replace)
Default bind is 127.0.0.1 (localhost only); use --host 0.0.0.0 for LAN
Upload path sanitization, collision renames, 50 MiB size cap
Config file only rewritten when values actually change

Capability

External notes.md edits picked up via mtime poll (skips while editor is dirty)
Contiguous task reindex after add/update/delete
Richer AI context modes: recent N notes, note being edited, selection, none, plus char budget
Abortable search requests while typing
AI chat uses in-memory notes (including unsaved session state)

Quality

First unit-test suite (python -m unittest tests.test_core -v)
Dropped unused jinja2 dependency

Install

pip install -U noteflow
# or
brew upgrade noteflow-py   # after formula bump

CLI

noteflow --host 127.0.0.1   # default
noteflow --host 0.0.0.0     # LAN (no auth — use carefully)

Security Fixes

Upload path sanitization, collision‑aware renaming, and a 50 MiB size cap prevent unsafe file uploads
Atomic `notes.md` writes using temporary files and os.replace to avoid partial writes

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Xafloc/NoteFlow

Get notified when new releases ship.

About Xafloc/NoteFlow

All releases →