Changelog

Current version: v3.8.1

v3.6.1

Latest
Fixed
  • A folder without a name no longer brings the app down. Since 3.6.0, a folder arriving from another device whose descriptor did not yet carry a readable name crashed the whole window: the sidebar read that missing name to check whether it was a “To tidy” inbox. The folder now shows without a name in the meantime, and the log says which one.

v3.6.0

New
  • “To tidy”: Filarr suggests a place for every file that is waiting. The page takes in the inbox and any folder called “To sort”, “Inbox” or “Downloads”, suggests a folder for each file and says why (“the next one after invoice-0412.pdf”, “like the August and July statements”). Only the really safe placements are pre-ticked: Filarr measures its own accuracy against what you have already filed. It also flags byte-identical duplicates, empty folders, folders asleep for six months and “New folder (2)”. Nothing moves without your consent, every action can be undone, and everything is computed on your device.
  • A “Folders” page: all your folders, what they weigh and what is moving in them. Three views — Tree (size, last activity, sync, one-click filters), Columns (from folder to folder down to the file preview, by keyboard or mouse) and Space (a map where each block is sized by what it takes up). Folders move by drag and drop, and every action can be undone. “Import a folder…” brings in a whole tree from your computer, encrypted like any import.
  • Shared-vault tasks join the Tasks tab, with their vault's name. “My tasks” and “Today” only show the ones assigned to you. You can tick, date and assign them without opening the note: the change goes through the shared note, like a keystroke, and nothing another member is writing gets overwritten.
  • Error reports: a switch, and one code per profile. “Send error reports” can be turned off in Settings › System, and each profile has its own anonymous code, instead of one code shared by every profile on the computer, decoy profile included.
Improved
  • “Back” goes back where you came from. Each tab keeps its own history: the previous folder, the Folders page, the home screen. Alt + ← and Alt + → step back and forward through that same history.
  • Opening a note no longer makes you wait. With 2,000 notes, every opening froze the screen for a second while suggested tags were recomputed over every note; it now opens in a few hundredths of a second, with the same suggestions.
  • A new local profile is born encrypted: it asks for its password and hands you its 12-word recovery phrase, as on first launch.
  • The Notes view bar becomes a header row that no longer covers the note, and names its views: List, Gallery, Kanban, Sticky notes, Database, Calendar, Graph. A task's panel reads in full and widens by dragging its edge.
  • Uninstalling on Windows keeps your profiles. Uninstalling erased the data folder, and with it every local profile, without warning; a reinstall now finds them again.
Fixed
  • A shared-vault note or document no longer silently overwrites what someone else saved. If the note was saved outside live co-editing (a device without the relay, an older version), a banner says so on opening, “Load the newer version” replaces the old text, and a save made anyway opens the arbitration screen. A document you did not touch no longer calls itself “modified”.
  • Opening a note no longer modifies it. A note ending in a list, a heading or a table received an empty paragraph on opening, changed date and went back to sync — and in a shared vault, to every member.
  • “Forgot password” really reopens your files. Two paths left an account with a 24-word phrase that reopened nothing; the wizard now applies the phrase it shows, and says plainly when a phrase does not reopen the files.
  • Three content losses in the editor: Ctrl+Z could replace a note's body with another's, creating a sub-page crashed the editor, and the drawing mode's Text tool let typing replace the selected block.
  • Tasks: no more silent losses when editing them. A monthly task on the 31st no longer drifts to the 30th then the 28th; assigning while another member types no longer targets the wrong task; past eight members, everyone can be assigned; a mention or a date in a title is no longer rewritten as plain text.
  • A moved file keeps its tags, on the desktop and on the web, and the web finally really moves a folder.
  • Version history is no longer lost when switching profiles, and an import no longer reloads every note.
  • A password-protected folder asks for it whatever the path: home, Folders page, search or favourites.
  • An image centred or wrapped in a note is also centred or wrapped on its public page.
  • Server side, already live: the recovery phrase is checked word by word (the server only read the first eleven or twelve); a blocked person no longer comes back into your invitations; an annual subscription is no longer read as expired after a month; “Report this page” works on public pages.

v3.5.9

New
  • A “Tasks” tab in the sidebar, Evernote-style, as a list, a board and a calendar. Tasks from every note, with the My tasks, Notebooks, Notes, Today and Assigned tabs, sorting and filters. On top of that: a board by stage or by day, a month and week calendar, drag a task to reschedule it, bulk actions, and “See in note” that takes you to the task itself.
  • Complete tasks: due date with time and duration, repetition (“Skip this occurrence” moves it without completing it), up to five reminders, flag, priority, stage, description and subtasks. Quick entry in natural language: “Call Léa tomorrow at 3pm !high #work”. Tasks stay in their notes and sync with them, with an identifier shared by the desktop, the web and mobile.
  • Folders in the sidebar: the tree expands and creates a folder in one click. The Trash moves to the bottom of the navigation.
Improved
  • One language on screen. An English-speaking tester saw French in the English interface: previews, version history, shortcuts, dates, sizes, notifications. More than a thousand strings now go through translations, both ways. On a system that is neither French nor English, the app starts in English.
  • The Notes view bar says what it is about: “Show notes as” precedes its icons, since those views show every note and not the open one.
Fixed
  • Collections work again. Since 16 March none could be created (“Failed to create collection”); they can now be created, edited and duplicated, and “Add files” finally lets you fill one.
  • The daily note and “@today” follow the local day. The day was computed in UTC: just after midnight in France, the daily note was yesterday's.
  • The print button for backup codes did nothing, and Ctrl+Shift+N from the Kanban created an invisible note.

v3.5.8

Improved
  • The deletion cap goes from 120 to 1,000 per five minutes. It covers the whole account: emptying a photo folder exhausted it, and the phone then had its own deletions refused. Already live server-side.
  • Images no longer travel with notes. Loading notes carried all their images, twice over, all the way to the screen; only references are passed now, and an image is read only to be displayed. Everything that leaves the app — export, published page, shared-vault deposit, clipboard, versions — puts them back. The daily cleanup no longer freezes the window. Desktop first, the web app at its next deployment.
Fixed
  • A refused manifest publication no longer sends files to the trash. Six downloaded images went there on 22 September: their bytes had been uploaded, but the manifest announcing them had not been published, and the next cycle read their absence from the cloud as a deletion made elsewhere. An absence now only counts as a deletion for what the device itself successfully announced.
  • Two desktops open on the same account no longer push the manifest back and forth. Each published its own view alone, erasing what the other had just added, and the live notification restarted the other three seconds later — 46 versions in 80 seconds, transferring nothing. A circuit breaker now cuts any loop of that kind.
  • Several accounts on one machine no longer mix. “Add an account” left the departing profile's sync running, and a cycle could go out with the other account's session and key. An account that changes address stays recognised.
  • A folder whose parent folder has vanished shows at the root. It appeared nowhere — not on the home screen, not in the tree, not in the trash — while its files were still there. Nothing is rewritten: if the parent returns, the folder goes back to its place.

v3.5.7

Fixed
  • No more “WebSocket was closed before the connection was established” error box on quit. Closing the notification channel while it was still opening raised an error a moment later, with nobody left to receive it.

v3.5.6

Fixed
  • The app no longer freezes at startup on a large note history. The vault watcher was also watching 6,635 note-version directories: nine seconds of work, and up to a hundred seconds without responding. It now watches only what sync reads.
  • Histories of vanished notes are collected. Versions of a deleted note stayed forever; they are removed thirty seconds after notes load, never those of a living note.

v3.5.5

Improved
  • The first launch no longer freezes the window. The package shipped every development dependency: 563 → 49 MB, and the installer 211 → 112 MB. Immediate splash screen, sync started once the window has loaded, update check after a minute.

v3.5.4

Fixed
  • The deletion cap is recognised from the server status alone. An older server, or a proxy that rewrites the response, no longer turns the refusal into a “transfer failure”.

v3.5.3

Fixed
  • A folder deleted from another device no longer comes back. The deletion rule filed a folder's descriptor among the profile's technical files — the ones nobody ever deletes — so a folder erased from your phone was republished every cycle, indefinitely, with all its contents. It now goes to the local trash whole, recoverable.
  • Deleting many files at once no longer blocks your other devices. The server caps deletions at 120 per five minutes, and that cap covers the whole account: emptying a large folder from the desktop exhausted it for the phone, which then showed a sync error. The desktop now stops at the first refusal and resumes on the next cycle, and the refusal says it is the cap, not a failure.

v3.5.2

Fixed
  • A deletion propagates now, instead of resurrecting. Two devices on the same profile kept sending deleted files back to each other indefinitely. The tombstone now lasts thirty days; a file the cloud no longer holds goes to the local trash (recoverable) instead of being re-uploaded; restoring from the trash sends it back. A guard prevents emptying a vault when the remote manifest was merely reset.
  • A note without its tags or links arrays no longer crashes the views. Notes arriving from another device could lack those arrays, and the database view fell into a red screen.
  • The inbox no longer says “item deleted” for an item type it does not recognise.

v3.5.1

New
  • Publish a note to the web. From the page's “…” menu: the note, and optionally its sub-pages, becomes a page anyone with the link can read, with no account. It is encrypted before it is sent and the key travels in the link, like Send; optional password and expiry, table of contents, badge. The dialog says whether the page is up to date or changed since publishing, republishes in one click, unpublishes. Three live pages on Free, twenty on Solo, no ceiling above.
  • An inbox. The bell at the top gathers everything that concerns you in shared vaults: mentions, replies to your comments, new comments on your pages, resolved threads, assigned tasks — with tabs, archiving, and a click that opens the item. The server only ever receives identifiers, never text.
  • Comments become threads, with reactions. Reply, react, resolve the whole thread and reopen it — in a personal note as in a vault note. Earlier notes stay readable as they are.
  • A task can be assigned to someone, with a due date. Hovering a checkbox, “+ Assign” offers a person and a date. The chip reads “Léa M. · 30 Sep”, in red once the date has passed, and the Tasks view gains “Mine” and “Overdue”.
  • A database row becomes a page. “Create page” opens an ordinary note carrying the row's properties under its title, editable in place. Nothing is added to the note: it is the database that points to it.
  • Find and replace inside a note (Ctrl+F): highlighted matches, a “3 / 12” counter, case sensitivity, “Replace” and “Replace all”.
  • Images open full screen. Double-click, or “Open full screen”: ← / → walk every image in the note, the wheel zooms, 0 returns to actual size, and Copy / Save are at hand.
  • A “…” menu on the page for the settings people change most: font, small text, full width, line numbers, typewriter. These are display preferences: nothing enters the note.
Improved
  • The editor handles like Notion. The “⋮⋮” handle gains Move up / down, Copy block link and a colour palette; the bubble menu gains “Turn into” and “Comment”. From the keyboard: Ctrl+Shift+↑/↓ moves, Ctrl+D duplicates, Ctrl+Shift+0 to 8 transforms — AZERTY included.
  • Several blocks can be selected at once. Esc selects the current block, Shift+↓ extends to its neighbour, Ctrl+A takes the whole note; across the range, delete, duplicate, move, transform, copy and cut act in one gesture.
  • Tables finally have on-screen controls: insert a row or a column, toggle the header row, delete the row, the column or the table, as soon as the cursor is in a cell.
  • Tables group, and filters understand OR. Group by select, checkbox, person, month or text, with collapsible headers and per-group footer calculations; and condition groups, each with its own AND or OR.
  • The app starts with half as much code to load. Both languages, the Word converter, diagrams, formulas, syntax highlighting and the PDF reader all shipped in one block before the first screen, whether or not you opened a single one of those files. Measured on the web build: 8.4 MiB → 3.9 MiB at startup.
  • Files over 64 MiB finally open from the browser: the web now reads the files the desktop splits into blocks, decrypted and verified block by block.
  • On Linux the window no longer flickers: the desktop goes back through X11, and Settings → Desktop → Display on Linux lets you pick the backend or turn off hardware acceleration. If the graphics process dies three times in one launch, acceleration is turned off and the app relaunched, instead of vanishing without a word.
  • Profiles the cloud holds and your device does not are finally visible — and removable. They appeared nowhere and made a restore fail on every launch, on every device.
Fixed
  • The Kanban, gallery, tasks, calendar, mind-map and database views speak French. A hundred and sixty-eight labels were called with a key missing from both languages, so the English default showed. The Tasks view was not translated at all.
  • The editor toolbar speaks French: its twenty-six tooltips were English whatever the language, as were the relative dates in the list.
  • A hundred and eighty French labels get their accents back — settings, trash, profiles, preview.
  • The calendar and periodic notes speak the interface language, and a note “Semaine 38, 2026” created in French is still recognised as periodic after switching to English.
  • The body of a published page is clean: the title is no longer doubled, the page renders its own table of contents, and footnotes are numbered and gathered at the end of the document.
  • A password-protected page opens with its password. The salt and the encrypted content went out in two requests; when the second failed, the page kept a salt that no longer opened anything and no password worked.
  • Native checkboxes and radio buttons are visible again. The style reset stripped them of any drawing, and their state vanished in some thirty dialogs.
  • A fresh profile no longer shows a “Folder notes” folder: the note store's directory was mistaken for a vault folder and shown on the home screen.

v3.1.0

New
  • Mentions in shared vaults: type “@” in a note to pick the vault’s members, and the person named is notified — a bell in the bar, an email, and a click that opens the note. The notification says which note and which vault: the title is decrypted on your device, never by our servers.
  • A display name (Settings → Account) instead of your address, in vault rosters and mention chips. Clear it to go back to your address.
  • Passkeys: sign in with your fingerprint, face or device code, without a password, on app.filarr.com. A passkey opens the ACCOUNT, never the vault — the key that decrypts your files derives from your password and stays on your device.
  • “Check for updates” on demand, in Settings → About. Filarr already checked on its own every four hours; it never said so, and you could not ask.
Improved
  • Transfers now run in parallel — three at a time, and a slot frees up as soon as one finishes instead of waiting for the slowest of a batch.
  • “This account is used on 14 devices” was wrong: a device is now your machine and not your profile, sessions with no activity for thirty days are marked inactive and close with one button, and dead rows go away on their own.
  • Switching profile from the account menu opens that profile, instead of sending you back to the space portal and then the picker.
  • A new profile stores its notes one by one from the start, and the switch no longer blocks itself on a device that counted its own uploads as somebody else’s.
  • Shared vaults: sealed share labels readable and renamable from the desktop, an activity log that tells recolouring from renaming, and emptying the trash as an action on items rather than on the vault.
  • Organizations: SSO has its handle on the desktop, closing an organization warns, purges down to the bytes and can be undone, and the annual plan is finally purchasable although it was priced and advertised at -17%.
Fixed
  • Opening a note no longer marks it “changed”, and a note’s clock only moves when something moves: a note re-stamped for no reason used to win over a real edit made elsewhere.
  • No more ten-megabyte round trip every five minutes between two devices, no more conflict copies made on every cycle, and a co-editing document left behind no longer wins over the most recent version.
  • The desktop app was running a build from 2 September: compilation wrote next to what the app loads, and new features never appeared.
  • In the browser, the “Organization” chip no longer stays lit on a personal account, and “Profile not attached” disappears as soon as attaching has happened.
  • The two-factor skip no longer survives “sign out all devices”; file tagging no longer dies on every reload; notebook ordering done on the phone no longer reverts to alphabetical here.

v3.0.0

New
  • Theme workshop: compose your own look — background, surfaces, text, accent, borders — with a live preview and three animated backdrops on top of the solid ones. A theme now carries the whole appearance: not just colors, but the font, the corner radii and the bar layout too.
  • Modular home, forty blocks further: twenty additional blocks and twenty variants of the existing ones, four more built-in layouts, and the base layout fully redrawn. Your own layout can be saved under its own name and found next to the shipped templates.
  • Layout template marketplace: publish your home layout, install someone else’s in one click. Every package is signed end to end — Filarr refuses to install what it cannot verify.
  • One listing per template: preview, four-image gallery, thumbnail instead of an emoji icon, a real screenshot of the layout, description, author pen name, an official badge that cannot be borrowed, and the author’s other publications.
  • Block-by-block conflict resolution on a vault note, with the final rendering in front of you while you choose — instead of a blind pick between two whole versions.
Improved
  • Update a marketplace listing in one click, and republish by picking the next version instead of typing it. A rejected publication names the block that blocks it and the numbers at fault, before the upload is even attempted.
  • A withdrawn listing says who can still see it, and the catalog becomes a real grid: centered column, fixed accents, comfortable reading width.
  • A note opens in the window when you read it and in the full editor when you write it — and a vault note finally takes the editor’s chrome, without misrepresenting what is actually saved.
  • The side column shows one panel at a time instead of stacking them all, and the surface curves away around the floating bar.
  • On a grid card, sharing reads at a glance (silhouettes) and the padlock is visible.
  • A cancelled invitation no longer holds a seat hostage, and the seat counter states what it actually counts.
Fixed
  • The background backdrop — invisible until now because it was mounted in the wrong place — finally renders, and the Midnight theme’s halo closes cleanly at any window size.
  • Setting the home width no longer blocks publishing the layout, and an empty block keeps its frame, icon and caption instead of vanishing — taking the full row rather than one column out of twelve.
  • Two people writing in the same vault note works, and the note opens in the Notes tab like any other.
  • Fixing the rank of someone you invited works whichever half of the gesture is already done, and an invited person exists where you look for them — their invitation link can be found again.
  • A network outage is no longer mistaken for a denied vault, and a failed load no longer stays "in progress" forever: the message names the problem and offers the action that fixes it.
  • The collapse buttons work (a style rule was ignoring them), the side rail no longer covers the page, floating panels no longer slide underneath it, and the bottom menus fit inside the window.
  • The graph settings panel no longer loses a row per section for want of a scrollbar, and removing a favorite happens where you added it.
  • Web client: a session lasting more than fifteen minutes is no longer kicked out (the access token is refreshed before every call instead of being assumed valid), layout export and import work from the browser, two desktop-only bridges are no longer mounted without a platform guard, and the share settings page no longer falls back to the share list.

v2.35.0

New
  • A "Manage vault" page per shared vault, at its own address: overview, members, invitations, activity, settings, key, trash.
  • Per-vault settings — name, description, size cap, trash policy — and statistics: what the vault holds, what it weighs, what it consumes.
  • Freeze a vault: immediate read-only for every member while you sort out an incident.
  • Add a member of the space directly, picked from a list — no more retyping an email address.
  • Re-seal items still under an older key, so a newcomer can read the vault’s past too.
Improved
  • A single invitation row that states its outcome — sent, expired, declined, accepted — instead of four statuses scattered around. Expired invitations are visible and can be reissued.
  • Whoever is granted access learns about it, by email and on their home, and the invitee knows which account to open the invitation with before acting.
  • What other people do arrives without reloading the page, and shared-vault notes are read from the Notes tab, in the real editor.
  • Empty a vault’s trash in one gesture, and activity filters to find a specific event in a busy feed.
  • Every empty tab says what to do, and an outage no longer disguises itself as emptiness: you know whether it is quiet or broken.
Fixed
  • Editing a note together no longer produces a conflict, and a note is recognizable at a glance.
  • A vault admin invited into a space they do not administer can finally read the directory they need in order to invite.
  • The vault name survives a key rotation instead of disappearing on the first member removal.
  • On the web, notes render on reload of an already-unlocked profile.

v2.34.0

New
  • Four views on a note database: table, dashboard, gallery, calendar — each with its own settings — plus computed columns derived from the other columns.
  • One record per row: clicking a row opens it as a full page, with its properties and its content.
  • Built-in note templates, offered at creation, that actually exercise the whole editor (callouts, databases, columns, toggles) instead of being empty skeletons.
  • Distraction-free mode: the interface fades away and only the note remains. With keyboard shortcuts to enter it and to share a note.
  • Send a note into a shared vault, with a badge saying where the copy lives — and a note remembers which vaults its copies went to.
Improved
  • A Notion export arrives whole: images, databases and attachments included.
  • Pasted or imported Markdown becomes real blocks — headings, lists, tables, code, images — instead of a wall of text.
  • The cover fades on scroll and the bar recenters: the header gives back a hundred pixels as soon as you start reading, and folds in three steps instead of two.
  • Note panels on hover (configurable) to keep the writing surface clear, and a resize handle on blocks, in width as well as height.
Fixed
  • The mind map no longer misses nested headings, clicking a heading targets the right one, and jumping to a heading re-anchors while the layout is still settling.
  • Shares created from the app appear on the web dashboard and stay recoverable from another device — the share key is sealed to the account custody, in the format the site knows how to open.

v2.33.0

New
  • A shared vault behaves exactly like a folder: multi-select, drag and drop, trash, shortcuts — the same gestures as everywhere else. Vaults sit among the folders on the home and open at their own address.
  • A file moved into a vault leaves a shortcut behind: you find where it was, and one click takes you there.
  • A single dialog to manage access to a vault, instead of four scattered paths.
Improved
  • Recognize a person at a glance, by their initials and color, everywhere they appear.
  • Explorer cards say who something is shared with and open the vault directly.
  • The number of people on a share is read in one query, without naming them — the list no longer slows down rendering.
  • The activity panel names what it is transferring instead of announcing a nameless file.
Fixed
  • A locked vault refuses to hand back plaintext, even outside the interface: the door closes at the core of the application, not just at the screens. Previously, locking mostly put a screen in front of a door that stayed open.
  • Locking closes the door first and shows the screen after — and no longer loses your in-flight keystrokes. The screen now says why it locked: inactivity, sleep, session lock, manual gesture.
  • A banner template no longer drags the icon, cover and home note of the folder it is applied to along with it.

v2.32.0

New
  • Invite someone into a space and grant them a vault in one go: the host declares the intent at invitation time, and access opens by itself as soon as the person joins. The host’s app seals what it promised on its own — never with a key it has not verified — and the server stays incapable of fabricating access.
  • The theme and accent color follow your profile, not the computer: two profiles on the same machine no longer overwrite each other.
Improved
  • Pending access is named on both sides: the inviter sees who they are opening to, the invitee sees what awaits them.
  • The slash menu remembers recent commands and floats them to the top.
Fixed
  • Preferences chosen at first launch go to the profile, and signing in no longer asks again for choices already made.
  • The profile picker scrolls instead of overflowing the window when there are many profiles.
  • A full document can no longer be overwritten by an empty one: the editor refuses and explains. And an unreadable file no longer enters a co-editing room — it would have been saved empty on the first agreement.

v2.31.0

New
  • "Open with…" on a file: pick the built-in editor, the system application, or another editor — and remember the choice for that file type.
  • `.docx` files open in Filarr by conversion, never by overwrite: the original stays intact, alignment is preserved, and any layout loss is announced before you continue.
  • A syntax-highlighted code editor for around forty additional extensions, an editable CSV/TSV grid faithful to the original separator, quoting and line endings, and an `.ics` calendar editor that preserves verbatim the parts it does not understand.
  • Line-by-line comparison of the real content between two versions of a file, with an obvious way to trigger it from the history.
Improved
  • Preview `.fdoc` documents without opening the editor, and `.svg` files render instead of opening as source code.
  • "New document" only offers formats that actually exist, with valid starting content.
Fixed
  • Two files opened at the same time no longer collide in the temporary folder, and the round trip back to the cloud no longer loses your edits.

v2.30.0

New
  • Every folder can have its own color, icon, cover, banner and home note — inherited from its parent, or cutting inheritance to live its own life. Three ready-made home templates, applied in one click.
  • A home layout exports to a `.filarrlayout` file and re-imports on another device or into someone else’s app. It follows a published vault, and the web client knows how to read it.
  • Several editors can register for the same extension, and you choose.
Improved
  • The Folders block resizes vertically, page width is adjustable, and blocks resize freely in width as well as height — the old percentage-step system is gone.
  • A size cap at opening time, declared by each editor, instead of a silent freeze on a huge file.
  • The native window-button strip is measured rather than guessed: no more app controls sliding under the system buttons, whatever the Windows configuration.
Fixed
  • Version history stores the real content of each version — previously, restoring an earlier version did not restore the expected bytes.
  • A file that is not UTF-8/LF is no longer mangled on save: its encoding and line endings are preserved. And editing a V3-encrypted file no longer downgrades it to the previous format.
  • The quota is computed as a real delta, and a hybrid rename that fails says so instead of leaving an ambiguous state.

v2.29.0

New
  • The home becomes a grid of blocks you compose: recent notes, notes without a folder, folders, shared vaults, activity, favorites — added, moved and resized in edit mode, on a 12-column grid engine. Your layout is encrypted and synced across your devices.
  • Midnight theme: a deep dark, consistent all the way into the notes — plus "Living Midnight", Filarr’s first animated theme.
  • Five bar layouts (including floating and side), picked from a selector with preview thumbnails, with a hideable top bar and tab bar.
  • The Board view becomes a real spatial canvas: notes are placed freely, moved and linked on a plane you pan around.
  • Paste or drop an image straight into the editor.
Improved
  • Drag-and-drop indicators you cannot miss, and navigation while dragging: you can enter a folder while holding the file. Plus move-to-root, inline folder creation and recent destinations.
  • Shared vaults become the normal explorer: same view, same gestures, same cards.
  • Incremental note saving: no more stalling while typing in a long note.
  • Reworked @ menu search, actionable potential links with live suggestions, toggle and callout blocks deletable from the keyboard, slash commands usable inside lists.
  • A detailed sync activity panel, and real profile synchronization across devices.
  • File requests are open to every account, with a per-account quota instead of a plan restriction.
Fixed
  • No more light selections and hovers punching holes through dark themes, and Ctrl+B is fixed.
  • Sticky notes are stable: moving one no longer shifts the others, and the freeze on selection is gone.
  • Display preferences no longer leak from one profile to another, imports started from the tray finally show up in the app, and no palette command leads to a nonexistent page any more.

v2.28.0

New
  • Filarr becomes extensible: plugins can add editors, views and formats without touching the core of the application. Each plugin runs in a sandbox, with no free network access and no way to exfiltrate plaintext — unreviewed code can run without putting your data at stake.
  • Plugin marketplace: browse, install and update from inside the app, over an end-to-end signed supply chain. Filarr refuses to install what it cannot verify.
  • Docs, the first in-house plugin: a complete `.fdoc` document editor, usable in the personal explorer as well as in vaults, with co-editing and visible remote cursors.
  • Share one specific item with one specific person, without opening the whole vault, plus a "Shared with me" screen gathering everything opened to you.
  • An invitation inbox in the account: accept, decline, or nudge.
  • Encrypted folders inside vaults: a real tree, built client-side, with no migration.
Improved
  • Every capability a plugin requests is declared, displayed and refusable, with full developer documentation: architecture, API, limits, publishing.
  • Activity feed in vaults: who did what, readable by every member.
  • Comments no longer die: they live in vaults, on notes as well as on files.
  • Collaboration comfort: "so-and-so is typing…", typing trails attributed to their author, named editing sessions.

v2.27.0

New
  • Trash for shared vaults: a deleted item goes there, stays visible to members, and is restored in one gesture. Restoration already existed server-side — with no door to reach it.
  • Filter a vault’s items to find what you are looking for in a busy vault, and search that finally crosses vaults: a vault stops being a silo.
  • Preview for 19 additional formats directly inside a shared vault.
Improved
  • Removing a member rotates the vault key, and Filarr verifies who it is re-sealing to before doing it, instead of trusting a fingerprint that may have changed in the meantime. A changed fingerprint now requires explicit confirmation.
  • A rotation no longer silently condemns pending invitations: they are reissued with the new key.
  • Items in the trash count towards the quota and say so, instead of occupying invisible space; and purging can no longer overwrite an item a colleague has just restored.
  • Renaming a file no longer re-uploads it entirely: only the metadata changes.
Fixed
  • Renaming a vault and changing a member’s role finally work — the route was blocked server-side — and a vault can no longer end up with no owner at all after a removal.
  • A file dropped into a vault becomes editable again: it was frozen for life.
  • Signing in brings your profiles back (cloud restore existed with no screen to trigger it), deleting a profile also removes it from the cloud, and signing out locks everything — previously only a third of the state was forgotten.
  • Being removed from a space leaves a readable trace instead of an empty screen.

v2.26.0

Improved
  • Screens no longer offer gestures the server refuses: every button reflects the role’s real permissions.
  • Version history for a vault file — included in the plan but out of reach until now — is browsable and restorable.
Fixed
  • A shared vault can finally be deleted by its owner.
  • Deleting your account no longer wipes your guests’ shared vaults: their access survives the host’s departure.
  • Deleting the container no longer bypasses legal hold: an item under retention stays retained, even if its folder disappears.
  • Two key versions no longer share an editing room neither of them could read, and a disconnected peer stops appearing "online" and hands the pen back instead of holding it forever.
  • No more going "offline" four times an hour on a perfectly stable connection, and a member ejected from a session finds out instead of typing into the void.

v2.25.0

New
  • Shared vaults are no longer reserved for organizations: any paid account can create a vault and invite family or colleagues into it, with identical end-to-end encryption. A personal space is bootstrapped automatically on first use.
  • Relations between databases: a row in one database can point at rows in another, with rollups — count, sum, average — right inside a column.
  • A conflict resolution screen for when two devices edited the same note offline.
Improved
  • An invitation leads somewhere: the link opens an acceptance screen explaining who is inviting, to what, and which account to sign in with — and it reaches the installed app instead of getting stuck in the browser.
  • Vault notes are editable by the members entitled to it, with filtered views and assisted cleanup of stale items.
Fixed
  • An invitation is surfaced inside the app — previously nothing anywhere said you had been invited. Declining an invitation declines the right one, and an unclicked invitation no longer locks the inviter/invitee pair forever.
  • The end of a subscription finally has a server-side effect: limits drop back to the free plan instead of staying at the old level.
  • The purchase button on the web works — and when it fails, it says so.

v2.24.0

New
  • End-to-end encrypted real-time editing: two people edit the same note simultaneously, each seeing the other’s keystrokes appear as they happen. The server sees nothing — it only relays encrypted packets it cannot decrypt.
  • A note database can fill itself from a source — a folder of files, another database — instead of being typed in by hand.
Improved
  • Near real-time sync: a change made on one device shows up on the other within seconds, instead of waiting for the next cycle.
  • Lossless merge: concurrent edits combine instead of overwriting each other, including after a network outage.
  • The Sync button becomes conclusive — it says when it is really done — and Pause really pauses.
Fixed
  • A single tab drives synchronization when several are open, instead of watching them fight.
  • Conflict safety net: a real divergence produces a clearly named conflict copy, and a divergence that does not exist produces none at all.
  • Unreadable cloud profiles are skipped instead of blocking the whole cycle, and the manifest write is retried instead of giving up on the first failure.

v2.23.0

New
  • Real databases inside notes: drop a table of rows and columns into the middle of a page — it lives in the note, sorts, filters and reorders.
  • Property types: text, number, select, multi-select, date, checkbox, URL, email, phone, person, file, created and modified dates — with a default value on selects.
  • "Fill from link": paste a URL into a row and click ⚡ to pull the page’s title, description and image and populate the columns automatically. Strictly optional: the fetch goes through a relay you enable explicitly, and nothing leaves without the gesture.
Improved
  • Drag-and-drop column reordering, one-click column creation, and a "+" column that is always visible.
Fixed
  • Translated slash menu, usable date picker, guards on row hover, and no more silent failures.

v2.22.0

New
  • Filarr arrives in the browser: app.filarr.com opens your vaults, notes and files from any computer, with nothing to install. Decryption happens in your browser — the key never leaves your machine.
  • Two-way sync with the desktop app: what you write on the web reaches the desktop, and the other way around.
  • Passkey unlock — fingerprint, face or device PIN, without retyping your password. "Stay unlocked" remains an explicit choice, never a default.
  • A two-level security posture page explaining in plain words what the server can and cannot see.
Improved
  • A browser-native interface: clean top bar, consistent keyboard shortcuts, native scrolling, and a paper theme alongside the dark ones.
  • Opening files: displayable types open in a tab, the rest download under their real name.
  • Fast loading: versioned assets are cached for a year, the entry page always revalidated.

v2.21.0

New
  • Import an entire Obsidian vault: notes, [[wiki]] links, folders and attachments, converted into encrypted Filarr notes.
  • A vault created offline can be published to your account — becoming syncable, shareable and backed up — without ever being re-sealed: no phase where your data goes back to plaintext.
  • QR code pairing between desktop and a mobile device, on a reworked key-exchange protocol: the session is no longer destroyed before the other device has read the key.
Improved
  • Full graph settings: attraction and repulsion forces, link distance, centering, decay — with the same granularity as Obsidian — plus groups, colors and filters to read a graph of several hundred notes.
  • Resume after interruption: publishing a vault picks up at launch where it stopped, and a duplicate adopted along the way is merged instead of duplicated.
  • Every download verifies its SHA-256 fingerprint before being accepted, and the API now exposes a versioned contract so the mobile and web apps can evolve without breaking.
Fixed
  • An unreadable vault index is no longer reset: Filarr refuses to start from scratch on a damaged index — a potential cause of data loss — and reports the problem.

v2.20.0

New
  • "Move into the vault" on import: Filarr encrypts the file, verifies that the encrypted copy decrypts back byte for byte, and only then securely deletes the original. Before, adding a file to the vault left a plaintext copy on disk — the protection of encryption undone by the file forgotten next to it.
  • "Protect in place": instead of filing the document away inside the app, Filarr turns it, where it is, into an encrypted `.filarr` file that only opens through Filarr. A whole folder becomes a single container that opens as a browsable mini-vault. "Unprotect" gives the file or folder back in the clear.
  • A tray icon: locked/unlocked state at a glance, quick actions (protect a file, lock everything, purge temporaries), and left click for compact mode.
  • Compact mode: a small, elegant palette — drop a file to protect it, unlock, find your recent items, lock everything — without opening the whole application.
  • Right-click "Protect with Filarr" in Explorer, on a file or a folder, with multi-selection grouped into a single dialog.
  • Global shortcuts (Ctrl+Alt+F for compact mode, Ctrl+Alt+Shift+L to lock) and automatic locking on session lock, on sleep, or after inactivity.
Improved
  • Temporary file purge: decrypted copies (preview, opening, drag-to-desktop) are securely erased, automatically on lock and on exit or on demand. An honest note reminds you that erasure stays "best effort" on SSDs and recommends enabling BitLocker/FileVault.
  • Never any data loss: on any failure — encryption, verification, deletion — the original is kept intact.
  • A container protected on another device shows a clear "cannot decrypt it here" message, distinct from a corrupted file.

v2.19.0

New
  • Direct upload for Filarr Send: shared files no longer transit through the server — the browser sends them straight to encrypted storage. Faster, and the technical ceiling that detour imposed is gone. If direct upload is not available, Send falls back to the old path on its own.
  • Send caps now depend on your plan, resolved server-side and therefore untamperable: 2 GB, 3 active sends and 10 views anonymously; 2 GB and 5 sends on Free; 10 GB, 10 sends, 50 views and 14 days on Solo; 25 GB, 25 sends, 200 views and 30 days on Pro.
  • Every transfer now shows a percentage, a speed ("12.4 MB/s") and an estimated time remaining — in sync as well as in Send, on upload as well as on download.
Improved
  • Concurrent sends are counted per account for signed-in users: a shared corporate network no longer throttles a subscriber.
  • An organization can restrict, never widen: external shares disabled, password required, expiry capped.

v2.18.0

New
  • Direct transfer for sync: the server no longer relays your bytes, the app sends them straight to encrypted storage. The ~1 GB-per-request technical ceiling is gone, and import goes up to 5 TB per file (instead of 5 GB), with flat memory whatever the size.
  • Incremental (delta) sync: only changed blocks are re-sent. Editing 5 MB inside a 4 GB video transfers ~5 MB, not the whole 4 GB — ideal for VM images, large archives and video projects.
  • Streaming video and audio: instant playback and seeking inside a multi-gigabyte file, without ever decrypting it all at once — only the passage being played is decrypted. Large PDFs open page by page, large ZIP archives are listed without downloading everything.
Improved
  • Parallel upload: several chunks leave at the same time, saturating your connection instead of losing time on round trips.
  • Resume after a drop: an interrupted upload picks up where it stopped.
  • Large files already present but not syncable — encrypted with the device key — are automatically re-prepared for sync, with no re-import.

v2.17.0

New
  • A new streaming encryption format: files go up to 5 GB (instead of 500 MB), encrypted block by block as they flow, with flat memory (~100 MB) whatever the size — instead of loading the whole file into memory several times over.
Improved
  • Much faster: ~550 MB/s with hardware encryption, and opening a file is faster too (the old format re-paid an expensive computation on every read).
  • Tamper-proof: each block is authenticated with its position — impossible to truncate, reorder or graft in a chunk of another file without immediate detection.
  • Backwards compatible: your existing files stay readable, and only new large files use the new format.
  • Import now goes through the file path instead of copying it into memory — no more RAM-bound limit.

v2.16.0

New
  • Preview for `.7z` and `.rar` archives: the contents display, browse, and text files open in a pane — without leaving Filarr, without writing anything in the clear to disk.
  • Real decompression: 7z (LZMA/LZMA2/Deflate) and compressed RAR5 are genuinely extracted, not merely listed.
Improved
  • The engine is written in pure JavaScript — the app’s security hardening forbids WebAssembly — and its correctness was verified byte for byte against WinRAR and 7-Zip, plus thousands of malformed-archive cases that fail cleanly instead of hanging.
  • Password-encrypted archives, or archives in an unsupported format (PPMd…), are listed with a clear note rather than failing the preview.

v2.15.0

New
  • "Skip to content" link: on load, the first Tab press reveals a link that jumps past the header and sidebar straight to the main content.
Improved
  • Note cards operable via keyboard in the Kanban, Masonry, Sticky and Database views: a card is now focusable and `Enter` opens the note — previously they were reachable with the mouse only.
  • Row actions revealed on focus: action buttons that used to show only on hover now also appear when reached via the keyboard.
  • Fully keyboard-driven flashcard review: `Space` reveals the answer and `1`–`4` grade the card (Again / Hard / Good / Easy).
  • Math and diagrams now exposed to screen readers: KaTeX equations emit their MathML layer (`math` role + label) and Mermaid diagrams get an image role + label — until now both were completely invisible to a screen reader.
Fixed
  • Global focus ring: every button, menu item, tree entry or interactive element finally shows a crisp outline when reached via the keyboard. The CSS reset stripped the outline from buttons and only restored it for input fields — so the majority of controls had NO focus indicator at all.
  • Focus restoration on modal close: focus returns to the element that opened the modal, instead of jumping back to the top of the page.
  • Light theme contrast: secondary text (dates, counters, metadata) in the `lofi`, `sky`, `sakura` and `terracotta` themes now meets WCAG AA — it was previously below the legibility threshold.
  • Notifications: announcement politeness now depends on type (error / warning = assertive, success / info = polite), and the nested live regions that caused duplicate announcements have been removed.
  • Notes mode bar: correctly announced as a group of toggle buttons with pressed state, instead of an incomplete tabs widget.

v2.14.0

New
  • Obsidian-style local graph — open a note, switch to Graph view and turn on "Local": the graph narrows to the open note and its neighborhood, with an adjustable depth of 1 to 3 hops, instead of the unreadable global graph on a real vault. It automatically falls back to the global graph when no note is open.
  • Graph search: typing a name dims the nodes and edges that don't match and highlights the matches, Obsidian-style. The search field was there all along but was dead code and filtered nothing.
  • Database view — column filtering and visibility are finally actionable: a "Filter" button (property + operator + value: contains / equals / empty / not empty) and a "Properties" button to hide or show columns. The filtering engine and persistence already existed, but nothing was calling them — filters stayed empty and every column stayed visible.
  • "Recents" section at the top of the notes list: your most recently visited notes, one click to jump back.
  • Bulk pinning: pin or unpin several notes at once from the selection bar.
Improved
  • `Tab` key in the editor: it now moves between cells in a table and indents inside a code block, instead of being swallowed everywhere.
  • Localized calendar: month and day names now display in the app's language and refresh when you switch languages — they were previously hardcoded in English.
Fixed
  • Kanban columns now persist: your custom columns survive a reload. Before, they vanished and every card fell back to "inbox", wiping out the board's organization.
  • The "Generate from notes" flashcard action is now idempotent: it preserves the spaced-repetition (SM-2) progress of existing cards, only adds new Q/A pairs, and no longer creates a duplicate deck. Before, each run reset all progress to zero.

v2.13.0

New
  • Formatted Word `.docx` preview rendered directly in the preview panel: headings, lists, and images render faithfully. Conversion via `mammoth` runs 100% client-side (offline), with output sanitized by `DOMPurify`.
  • Interactive CSV / TSV table preview: click-to-sort on headers, full-text filter, automatic header-row detection, and virtualized rendering to stay smooth even on large files.
  • HTML preview rendered in an isolated frame — no scripts run, no network requests — with a toggle to the source code.
  • In-document content search: text from `.docx`, `.csv`, and text files is indexed on open and becomes findable through search.
  • Bulk Move / Copy: select multiple items and move or copy them in one go (the buttons were permanently greyed out).
  • Group files by type, date, or first letter, in both grid and list views (the menu previously did nothing).
  • Click-to-sort by column on the "Name", "Size", and "Modified" headers (list view).
  • Keyboard navigation in the file browser: arrow keys, `Enter` (open), `F2` (rename), `Delete`, `Ctrl+A`, `Home`/`End`.
  • PDF thumbnails in grid view (first-page preview), alongside image thumbnails.
  • Storage quota shown in the footer for cloud accounts, with a color cue that warns as you approach the limit.
  • Folder color and emoji to spot a folder at a glance.
  • "Show in Explorer" via right-click on a file.
  • Drag a file to the desktop: `Alt`+drag exports the decrypted file to the OS, while a normal drag stays an internal move.
  • New Terracotta theme: a warm light theme with sand/cream backgrounds and clay accents.
  • New Plus Jakarta Sans font available in settings.
  • Secure deletion of temporary decrypted copies: those created for drag-and-drop and "Show in Explorer" are securely wiped after a delay and on app close.
Improved
  • Enterprise space now shown as "Coming soon" (disabled) until it's ready, with an option to hide it entirely at startup.
Fixed
  • Offline PDF preview: the reader no longer loads its worker from a CDN — it's now bundled and handed to `pdf.js` via a `blob:` URL (compatible with the app's strict CSP). The preview works with no network and no longer leaks any request.
  • Command palette fully translated — its chrome was hardcoded in French.

v2.12.0

New
  • Enterprise OIDC SSO login (`Authorization Code` + PKCE) with just-in-time (JIT) member provisioning. The enterprise space is rolling out progressively and stays labeled "Coming soon" in-app until it's fully finalized — the work described here is built server/admin side.
  • Admin SSO console: OIDC connection configuration and DNS-based domain verification.
  • Passwordless unlock after SSO (opt-in): a device-bound key decrypts the FEK at launch for smooth access once authenticated via SSO.
  • Versioned governance policy engine, enforced both client- and server-side, without ever exposing keys (zero-knowledge).
  • Mandatory MFA with a forced enrollment flow, IP allowlisting on login and session refresh, and absolute server-side session expiry.
  • Device fleet management: device inventory, remote revocation and wipe with proof of execution, idempotence, and cancellation.
  • Policy-driven retention and preservation: version and trash retention, plus legal holds that block destruction of data under hold.
  • Sharing governance — closing the Filarr Send bypass — and offline policy enforcement.
  • Governance policy editor built into the admin console.
  • Configurable SIEM sinks with a dedicated `security_admin` role: cron-scheduled drain, R2-anchored exports, a DLQ replay queue for reliability, and R2 counter-check.
  • Audit log retention: hard delete and a signed truncation checkpoint.
  • Login, 2FA, and device instrumentation in the audit log, with an organization monitoring dashboard.
  • Organization key pair sealed by the admin, with key transparency and anti-MITM guard.
  • Team vault recovery escrow: opt-in and gated on members' cryptographic consent, revocable and GDPR-compliant.
  • Shamir k-of-n secret sharing: coordinator-led multi-party recovery, in-place conversion of the org key to Shamir, key rotation and re-split (changing the holder set or the threshold).
  • Recovery dashboard: active policy, transparency fingerprint, and rotation.
  • Filarr Send/Request for professional deposits: custom deposit pages linked to a verified recipient.
  • Depositor-side dashboard, with email reminders sent from the server.
  • Deposit requests: per-plan and per-vault gating, pagination, automatic reminders, and rate-limit purge.
  • Client directory with fully configurable columns, explicit client groups, and direct link-delivery emails.
  • Notion import finalized and enabled; both importers (Obsidian + Notion) are now hardened and tested.
  • Zero-knowledge custody: new `kdf_scheme` column and a re-wrap endpoint to re-seal the recovery key.
  • Founder cockpit on `admin.filarr.com`, alongside an infrastructure cockpit.
Improved
  • Refresh token now carried in an `HttpOnly` cookie (dual channel), reducing XSS exposure.
  • Email redesign with a handmade template showing the organization avatar, and a custody guard enforced on authenticated sends.
  • Webhooks V2: event filtering, DLQ replay, and a test ping.
  • Professional design pass on the admin console and the SIEM sinks UI.
Fixed
  • Password change no longer voids the FEK recovery envelope — custody recovery stays valid after a password change.
  • Billing: the displayed storage limit followed old values (10/50 GB) instead of the 25/150 GB actually enforced.

v2.11.0

New
  • Obsidian-style linked notes — live transclusion `![[My note]]` embeds the target note's content inline (not a link, the content itself), rendered live and always current: edit the source and every embed follows. `![[Note#Heading]]` targets a section, `![[Note#^block]]` a specific block, `![[Note|other label]]` an alias. Unified autocomplete for `[[…]]` and `![[…]]` with mode switching, and renaming a note automatically propagates to every `![[…]]` that points to it.
  • Notes trash — deleted notes move to a recoverable trash instead of being lost; embeds pointing to a deleted note are flagged as orphaned.
  • Reminders — new dedicated `/reminders` page with inline snooze and completion, an overdue badge, and click-to-jump straight to the item. Attach a reminder to a file or a note, with recurrences and preset templates, live multi-device sync and bulk operations. Native Windows notifications with in-notification action buttons (snooze / complete) and open-at-login so the scheduler runs in the background.
  • Hardware security key (Solo+) — enroll/remove a YubiKey or any WebAuthn-compatible key in Settings; the lock screen offers "Use my security key" as soon as one is enrolled. Your password still works (the key is an option, not a replacement). The key stays local to the device, never pushed to the cloud: the KEK is derived from the WebAuthn PRF output via `HKDF-SHA-256` and the FEK never leaves the crypto core.
  • Hidden / decoy vault (Solo+) — a second vault unlocked by a separate password: under duress, entering the decoy password opens a believable profile instead of your real vault. Set up via a dedicated modal in Settings, with an honest disclosure of the feature's limits. The decoy vault generates an independent FEK (never the real one) and never touches the real profile's keychain.
  • Hot Folder Watch — a new rule type in Settings → Hot Folders: point a folder on your PC (Downloads, Scanner, Screenshots…) at a target Filarr folder, and everything landing there is automatically encrypted (`AES-256-GCM` with the profile FEK) and synced to the cloud — drop a PDF and it shows up encrypted in the vault within a second. Editing a `.md` in VS Code or Obsidian replaces the version in the vault (same identifier, history preserved, no duplicates), and optional deletion mirroring flips a file to `deleted` when it disappears from the OS folder.
  • Hot Folders — N independent rules, each with its own source, target folder, filters (subfolders, extension, max size), post-import action (keep / secure-erase / move) and auto-tags (Solo/Pro). Built-in guardrails: anti-loop, anti-overlap, system-path rejection, an executable blocklist, and a safety threshold that suspends the deletion cascade if too many files vanish at once (USB drive unplugged, NAS offline). Plan limits: Free 1 rule, Solo 3, Pro unlimited; a per-rule "Scan now" button forces a catch-up pass.
Improved
  • Redesigned Settings — two-column navigation: a sticky category sidebar on the left, scrollable content on the right. Each category has its own URL, directly navigable and linkable.
  • Folders — new "single click opens details, double click opens the file" option.
Fixed
  • Unexpected logouts — reworked session refresh: no more logout when multiple requests refresh the token in parallel (wake from sleep, reconnection) or when a network response is lost. Single-flight mutex on the app side, a 30 s grace window on server-side token rotation, and the sliding window extended to 90 days, with a clear distinction between a network failure (session kept) and a genuinely revoked token (real logout).
  • Profile isolation — no more state leaking between profiles on profile switch; orphaned folder tabs are cleaned up on switch.
  • Startup — fixed a TDZ error at boot (Electron imports hoisted to the top).
  • Reminders — removed a duplicate legacy snooze handler.

v2.10.1

Fixed
  • Sync regression introduced in `v2.8.0` by the ETag / `If-None-Match` optimization on the manifest: when the server returned `304 Not Modified`, the sync engine reused the local manifest directly as the remote view, so the merge compared strictly identical entries and never scheduled a push for new files or local edits as long as no other device touched the cloud manifest.
  • Symptoms: edited notes stopped syncing to the cloud between sessions, the local scan found `pending_upload` entries but the merge log reported "0 upload, 0 download, 0 conflicts", and the manifest version counter could increment without any chunk actually being pushed.
  • Fix: on a `304` response, the remote view is now rebuilt from the local manifest with `pending_upload` entries filtered out, letting the merge correctly detect files to push — no migration needed, just restart Filarr and the next sync catches up on the accumulated backlog.

v2.10.0

New
  • Filarr Send — anonymous E2EE file sharing without an account, available at `filarr.com/send`. Drag-drop, optional expiry / max downloads / password, byte-by-byte progress bar. Dedicated D1 table `ephemeral_shares`, separate R2 prefix `send/{id}/`, unauthenticated Worker `/send/*` endpoints. Anonymous caps: 2 GB max file, 7 days max, 10 max downloads, 3 active sends / IP. Creator IP stored hashed (SHA-256), never in plain text.
  • Per-plan share limit grid rebalanced for strictly monotonic progression: Free (1 GB / 14d / 10 active / 50 downloads), Solo (10 GB / 90d / 100 active / 1000 downloads), Pro (50 GB / 1 year / unlimited / unlimited). The initial pass left Pro at the same max file size as anonymous Send (5 GB vs 5 GB) — fixed. Anonymous stays useful for one-off sends (2 GB matches WeTransfer free) while Free and above clearly dominate on expiry, active count, features (revoke, history, 1-per-IP).
  • Owner-side per-share audit log — new D1 table `share_views` (migration 0008) logs timestamp + country (`request.cf.country`) + `/16` subnet on every chunk_0 served. Never the full IP. New endpoint `GET /sync/share/:id/views` (owner-auth only) + expandable "History" button in the /shares page, lazy fetch + per-shareId cache.
  • Separate counters for visits vs downloads — migration 0010 adds `info_view_count` to `shares` and `ephemeral_shares`. The /shares page now shows 2 chips: 👁 page opened, ⬇ completed download. Useful on password-protected shares where lots of visits don't convert (wrong password, abandonment).
  • "One download per IP" option in `ShareFileModal` (migration 0011: `one_download_per_ip` on `shares` only). Reuses the `/16` from `share_views` for dedup — no extra IP storage. Chunks 1+ are not IP-gated (interrupted download can resume). UI hint about the NAT caveat (carrier-grade NAT / corp office share the limit).
  • Dedicated `/shares` page in the sidebar (entry between Automation and Trash), with a large header + subtitle explaining E2EE. Clean empty state for local-only vaults: "Sharing requires cloud sync" + CTA to Settings. Removed from Settings → Encrypted shares.
  • URL recovery via localStorage `filarr-shares-keys-v1` (`{shareId → K_share_base64url}`) — the "Copy link" button in /shares reconstructs the URL even if the modal was closed too fast. Auto cleanup via `pruneLocalShareKeys()` on every refresh. Clear message if K_share is absent (share created on another device).
Improved
  • Recipient page `filarr.com/s/[id]` unified for both modes: tries `/share/{id}/info`, falls back to `/send/{id}/info` on 404. The recipient sees the same URL pattern regardless of mode (authenticated or anonymous).
  • Meta row spacing in the /shares list: `gap: spacing-2 / spacing-3` instead of 1-5, separators rendered as 4px circles at 40% opacity (middots were glued to text before).
Fixed
  • Page `filarr.com/send` no longer 404s — the `next-intl` middleware was redirecting `/send` to `/{locale}/send` which doesn't exist. Mirrored the `/s/` exclusion for `/send`.

v2.9.0

New
  • E2EE file sharing — right-click any file then "Share via link". Filarr generates a `filarr.com/s/{id}#k={key}` URL that decrypts in the recipient's browser, no account required. The `k` key lives in the URL fragment and is never sent to our servers (RFC 3986) — zero-knowledge intact, even with full Filarr compromise.
  • "Re-encrypt at share creation" pipeline: the client reads the file plaintext locally, chunks it in 16 MB pieces, re-encrypts each chunk with a fresh `K_share`, and uploads to a share-specific R2 prefix. Practical consequence: works for all files, including those uploaded before v2.8.0 (legacy internal storage format).
  • Optional password on shares (Solo and Pro) — `HKDF-SHA-256(K_share + password, salt)` derives the actual decryption key, the server never sees the password or the key.
  • Configurable per-share limits: expiry (1h / 24h / 7d / 30d / 90d depending on plan), maximum download count, manual revocation from Settings → Encrypted shares.
  • Settings → Encrypted shares panel: lists active and recently inactive shares (revoked/expired/limit reached), lets you re-copy the URL of an existing share (the key is cached locally on creation) or revoke.
  • Public recipient page `filarr.com/s/{id}` is live: 100% in-browser decryption (WebCrypto), password prompt when required, chunk-by-chunk progress bar, language auto-detected via `Accept-Language` with FR/EN toggle. Tiny bundle (~7 kB), strict CSP, `noindex` — the page never shows up in search engines.
Improved
  • Share modal now theme-aware — uses Modal/Button/Checkbox from the design system and accent CSS variables, no more hardcoded colors.
  • The "Limit downloads" and "Password" options are now interactive cards that visually reflect state (accent border when selected, 60% opacity when the plan doesn't allow it) — no more invisible 16px checkboxes.
  • Real byte-by-byte progress bar during share creation (useful for larger files — creation takes ~1s per 16 MB).
  • Recipient-side counter now reads "downloads" instead of "views" — the server only increments on the first chunk fetch, not on page open. The wording now matches reality.
Fixed
  • Worker `[placement] mode = "smart"` re-enabled in `wrangler.toml` (regression: the setting was lost after a rebase).
  • D1 migration 0007: drop `wrapped_fek` / `wrapped_fek_iv` columns (legacy from the abandoned v1 design) and add `status TEXT NOT NULL DEFAULT 'pending'`. Shares stay in `pending` until all chunks are uploaded — public endpoints reject `pending` with a 404, so half-baked shares can't be fetched.

v2.8.0

New
  • Client-side compression (deflate level 5) before encryption — applied to all text/JSON/Office/code files. The server still only sees opaque ciphertext, but you store ~2-3× more original data in the same R2 quota. Each blob carries a version marker so old files keep decrypting after the rollout.
  • Storage quotas bumped at no extra cost — Solo 10 → 25 GB, Pro 50 → 150 GB. Free stays at 1 GB during the 30-day trial.
  • Max file size 500 MB → 5 GB. Large uploads now use the R2 multipart protocol (16 MB parts, parallelism 3) which sidesteps the Cloudflare Workers 100 MB request cap and supports resumption after a network drop.
  • All file types accepted — the extension blocklist (.exe, .msi, .bat, .dmg, .deb…) is gone. Filarr is end-to-end encrypted: a client-side block was cosmetic (a user could always rename). You can now store installers, scripts, ISOs, with no workaround. The UI shows an informational note reminding you we can't scan encrypted files.
  • Cloud manifest is now compressed with deflate — on accounts with many files the manifest can run to several MB of JSON. ~5× compression on this payload, sync latency drops accordingly.
Improved
  • GET /sync/manifest now honors If-None-Match / 304 — the client sends its local version, the Worker returns 304 with no body if nothing has changed. Saves a full fetch + decrypt on every sync cycle in steady state (which is most cycles).
  • Worker Smart Placement enabled — Cloudflare's runtime now colocates execution with D1+R2 instead of the eyeball. 50-200 ms latency win on /sync/* calls depending on your location.
  • Compression skipped for already-compressed formats (mp4, jpg, png, pdf, docx, zip, 7z…) — detection by extension AND magic bytes to stay robust. CPU saved, ratio unchanged.
Fixed
  • Decryption fallback tries v0 (legacy, marker-less) format on GCM authentication failure of v1/v2 — covers the case where a legacy IV happens to start with a byte that looks like a 0x01/0x02 marker.
  • Worker quota guard now checks projection against current usage AND the delta of any in-flight multipart upload, preventing overshoot when two concurrent multipart uploads both pass the pre-check.

v2.7.0

New
  • Kanban — horizontal swimlanes with 4 modes (None, Notebook, First tag, Pinned). Each lane is collapsible, state persisted in localStorage. Drag-drop intentionally intra-lane only (cross-lane would change the grouping criterion, too implicit for a gesture). Inline title edit (double-click) + per-column "+" button that creates a note pre-assigned to that column and the current notebook.
  • Graph view — detailed side panel on node click: incoming/outgoing/wordcount, resolved tags, last modified, 240-char preview, clickable ↙/↗ neighbors to pivot without leaving the canvas, "Open note" button for the old behavior. Directional arrows on wiki-link edges (SVG markers, reciprocal links merged into a single bidirectional edge).
  • Mind map — per-branch collapse + expand (−/+ chevron on each node with children), per-note state in localStorage (empty entries pruned). "Collapse all" / "Expand all" buttons. Clicking a heading node → the note opens and the editor automatically scrolls to that section (bridge via transient pendingScrollToHeading flag, NoteEditor computes the ProseMirror position in a requestAnimationFrame).
  • Calendar — mounted as a first-class view in the mode bar. Day modal on cell click with scheduled notes + edits + "Create daily note" button that pre-fills title Daily YYYY-MM-DD and scheduledDate. Dedicated scheduledDate field on the note (drop on a cell no longer overwrites createdAt). Configurable agenda range (past + future tunable).
  • Sticky view — per-note resize (bottom-right handle, dimensions stored in viewSizes, MIN/MAX clamped) + scrollable content. "Fit all" button that reframes the canvas to encompass all stickies. Zoom + pan persisted in localStorage, restored on remount.
  • Masonry — dedicated sort (updatedAt/createdAt/title/wordcount) + filter (tag/notebook/pinned) toolbar, persisted in filarr.masonryView.config.v1.
  • Save-state indicator in the editor header — 4 states (synced / saving / pending / error), distinct colors, aria-live="polite" for screen readers. Distinct from the cloud sync badge: local-only users finally have a state signal for their work.
Improved
  • Stable colors in sticky and masonry — derived from note.id (hash) rather than list index, so colors no longer jump on filtering/reorder. Dark-mode palette revisited to stay distinguishable and readable.
  • Database view config persisted (visible columns, order, widths, sort, filters) in localStorage per dataset.
  • Calendar readability on warm themes — chips and sub-view tabs use --color-text-primary with opacity (instead of --color-text-secondary which became invisible). isValidCssColor regex guard added to reject custom colors polluted as "x,y".
  • Disconnected graph clusters now stay closer — d3 force tuning (gravity slightly increased, repulsion reduced between connected components) so orphan subgraphs no longer drift to infinity.
  • Graph localStorage errors surfaced via warning toast instead of silently swallowed (QuotaExceededError, access denied).
  • coverColor → viewPositions['sticky'] migration — the Sticky view was writing "x,y" into coverColor, polluting the cover display in other views. One-shot migrateStickyPositionPollution reducer detects the pattern, parses the coords, clears coverColor.
Fixed
  • "Collapse all" in mind map breaking the view — collectCollapsibleIds was pushing root into the list, so Collapse all collapsed root → empty screen with just a "+". Root is now excluded, and loadCollapsed strips any legacy 'root' from localStorage (self-healing).
  • Timeline preserves createdAt/updatedAt across cloud sync — sync was overwriting timestamps with Date.now() during cloud rehydration, the entire timeline was rewritten on every cycle. Fix in StorageService.addItemToFolder which now propagates the received timestamps.
  • Timeline shows every match under an active filter — a silent 100-entry cap was truncating search results with no indicator.
  • Active note visible in the mode bar across all views (previously: list only).
  • Trashed notes hidden immediately from Kanban columns (n.deletedAt == null filter, no refresh needed).
  • Intra-column drag in Kanban — preserves order via a new kanbanOrder field + reorderKanbanCard reducer. Cross-column drops still update kanbanStatus as before.
  • Clicking a note in non-list views now opens the editor (shared handleOpenNote which switches to list mode + sets the editing note).
  • Calendar currentDate syncs across sub-views — clicking a cell in Month mode now switches to Day mode positioned on that day.
  • Split panel in Notes mode — each pane now has its own viewMode and editingNote, no more state leaks between the two halves.
  • Infinite recursion in handleViewModeChange (an unfortunate replace_all had made the function call itself). Restored dispatch(setNotesViewMode(mode)) in the else branch.

v2.6.0

New
  • OS downloads watcher — Filarr can now watch an OS folder (typically Downloads) and automatically import each new file into a Filarr inbox of your choice. Chokidar watcher with awaitWriteFinish 2 s to avoid catching files mid-write, top-level watch only (depth: 0), ignoreInitial: true to avoid re-importing in a loop at startup. Multiple folders supported, profile-scoped config, automatically restarted on profile switch.
  • Defense-in-depth security — hardcoded blocklist of executable extensions (.exe, .msi, .bat, .cmd, .ps1, .vbs, .js, .scr, .lnk, .jar, .app, .dmg…) applied before any user filter. Refusal to watch system paths (C:\Windows, C:\Program Files, /etc, /usr/bin…) — a tampered appConfig cannot make a protected folder be read. deleteSource IPC restricted to paths actually surfaced by the watcher AND under a watched root.
  • Opt-in extension filter — addable/removable chips in Settings (empty = everything is imported except the executables blocklist, never disableable). Strict main-side sanitization: trim, lowercase, strip leading dot, regex [a-z0-9]+ only.
  • "Scan" button — one-shot catch-up scan that enumerates each watched folder and defers each file to the same handleNewFile pipeline (so applies blocklist + extension filter + size limit + dedup). Returns { queued, skipped } for feedback. Disabled until the watcher is active.
  • New automation trigger file_imported_from_os — fires alongside file_created when the watcher imports. Lets you write rules targeted at OS imports only (e.g. "PDF imported from OS → Documents", without touching PDFs added in-app). New os_source_path condition to match on the origin path (with Windows/Unix separator normalization).
  • 3 automation templates using the new trigger: "Route OS downloads", "Sort downloaded PDFs", "Sort downloaded images".
  • Settings UI with runtime feedback — live status badge (Active / Starting… / Error / Inactive) with watched-folder count. "X files imported" counter + last import name, live-updated via the status-changed IPC channel (no polling). Red error banner if state === error, amber banner if some configured folders are missing on disk. Master toggle disabled until config is complete, with inline hint showing what is missing.
Improved
  • Auto-routing for files added in-app — the automation engine had file_created as a trigger for a long time but nothing ever emitted it, so user rules did not run on drag-drop / import button. Fix: addFileToFolder now dispatches processFileEvent('file_created', …) after every successful upload. New "Route imported files" template (no-condition + move_to_folder). Anti-loop guard: move_to_folder / copy_to_folder become silent no-ops if source == target.
  • Honest end-of-sync reporting — Sync complete: X/N uploaded with a separate failed counter, instead of X uploaded which lied about the real outcome.
  • In-memory cache of zombie profiles (profilesFailedToRestore) — a cloud profile that fails to restore (typically because its encryptionKey was wrapped with another OS / DPAPI / Keychain key and is not decryptable here) is no longer retried on every sync cycle. Cleared on profile switch.
Fixed
  • CRITICAL — meta:* uploads unblocked at the Cloudflare worker. The pentest hardening from Apr 25 had restricted FILE_ID_REGEX to [a-zA-Z0-9_-]{1,128}, which silently rejected any fileId carrying the meta: prefix (meta:notes, meta:<id>). Production consequence: newly edited notes no longer synced, the remote manifest was incremented while the underlying R2 blobs were never written. Fix: allow : in the regex (it is the only structural separator we use for <namespace>:<id>). Worker redeployed on 2026-04-29.
  • uploadFile / downloadFile now rethrow after log + enqueue retry — they were swallowing their exceptions, so processQueue’s try/catch reached markSuccess on every retry, ending in a syncQueue Completed log even when R2 had returned 400. Promise.allSettled in batch loops absorb the rejection without breaking the cycle.

v2.5.0

New
  • Per-note sync badge — 4 distinct states (Synced, Syncing…, Unsynced, Offline) derived from client-side dirty-tracking by crossing note.updatedAt with sync.lastSyncAt + sync.state. Two variants: full (icon + label) in the editor header, compact (8 px colored dot) in each card of the list view. Auto-hidden in local-only mode.
  • "Show notebooks" toggle in graph view — off by default to preserve the current philosophy, persisted in localStorage. When enabled: purple diamond node per notebook (only those with a note in the graph), discreet dashed edges notebook → notes (~22% opacity) that do not compete with wiki-links. Click on a notebook = filter by notebook + switch to list view.
Improved
  • Typing in a long note ~300× to ~9.5M× faster — the hot-path onUpdate → Redux was doing a JSON.stringify of the whole document on every debounced keystroke. lastSyncedContentRef caches the last emitted string, turning the comparison into an O(1) identity-compare on internal round-trips. On a 5.9 MB note, the old path burned 30 ms of main-thread per second of typing, the new one consumes 4 ns.
  • Opening a long note: INP 743 ms → 230 ms (~70% reduction) — removed key={editingNote.id} on NoteEditor that was unmounting/remounting TipTap (30+ extensions, ProseMirror schema, child panels) on every click. Three safeguards added to prevent state leaks between notes: reset effect on note.id, prevOnUpdateRef snapshot, synchronous flush in onBlur.
  • Double JSON.parse eliminated on open — the sync ref is seeded with note.content at initialization, the effect sees equality on first pass and skips.
  • Side panels deferred with useDeferredValue — BacklinksPanel was doing three synchronous O(N) to O(N·M) scans on note-switch. React now slices: urgent commit to make the editor interactive, then recompute at low priority.
  • 17 unit tests added (8 syncEditorContent + 9 getNoteSyncState) + reproducible microbenchmark scripts/bench-note-editor-sync.mjs to validate any future refactor of the hot-path.
Fixed
  • Icon pollution by Kanban — the Kanban view was writing the column id (inbox, in-progress, review, done…) directly into the icon field, overwriting the chosen emoji on every drag-drop. New dedicated kanbanStatus field + idempotent one-shot migrateKanbanIconPollution reducer that heals the existing fleet (kebab-case heuristic).

v2.4.2

Improved
  • Auto-healing of the storage counter — syncService calls POST /sync/recalculate/:profileId once per session per profile after a successful sync, to reconcile the counter from R2 truth without waiting for user action.
  • One-shot admin endpoints — POST /sync/admin/reconcile-all (full bucket scan, aggregates by profile, overwrites storage_used_bytes — ran in prod: 78 objects, 5 profiles corrected, total down to 102.7 MB) and POST /sync/admin/list-keys/:userId/:profileId (R2 inspection with manifest / file-chunk categorization + top files, useful to identify orphans).
Fixed
  • Cloud storage counter was massively over-counting — every re-upload of an R2 chunk was incrementing storage_used_bytes by the full size of the new body without subtracting the existing object size. After ~26 cumulative re-uploads, the counter diverged by a factor of ×26 (D1: 2.5 GB reported vs R2: 104 MB actual, observed in prod). Fix: R2 HEAD before put + delta update with MAX(0, …) to harden against a negative counter.
  • Symmetric quota presign — the quota check in POST /sync/presign/upload compared used + newSize > limit without accounting for the size of the already-stored chunk. A user near their limit could no longer re-upload an existing chunk. Now: used − previous + new > limit.

v2.4.0

New
  • Note version history — automatic encrypted snapshots on every save (hash-based dedup, 2-min throttle, 50-version or 30-day retention), 3 interchangeable UI modes: side list, fullscreen scrapbook with collapsed diff, or Figma-style horizontal timeline scrubber with floating date bubble. Safe restore that creates a fresh snapshot automatically.
  • Cover overhaul — 40 presets in 6 categories (Colors, Pastels, Dark, Tropical, Minimal, Mesh) + personal image upload with automatic JPEG compression (1.2 MB cap after compression). Three sliders to zoom (30-300%, including zoom-out) and reposition the image horizontally and vertically live.
  • Hybrid icon picker with 3 tabs — 280 curated emojis across 8 categories with keyword search and 18 persisted recents, 145 Lucide SVG icons across 17 categories, or upload a small personal image (project logo).
Improved
  • Full TipTap extension set in the version viewer (callouts, math, toggle, wiki-links, file embeds, lowlight code blocks, tables) — no note renders blank in history regardless of complexity.
  • Defensive fallback when a snapshot has a desynced content/plainText: yellow banner "Render unavailable" + plain-text fallback rendering so users never face a blank panel.
Fixed
  • Version restore not applying in the editor (NoteEditor was only resyncing TipTap with Redux on note.id change, not note.content).
  • History modal closing on every cloud sync (loadNotesFromDisk.fulfilled was unconditionally nulling editing pointers, unmounting NoteEditor).
  • Duplicate history entries after restart (empty memory cache treated first save as "first seen") — lazy disk warm-up before dedup decision.
  • Clicks passing through behind the title bar in Timeline mode (native window controls at z-index 99999) — top padding added on the wrapper.
  • Version previews rendering blank: combined cause, TipTap instance recreation without repaint + missing extensions dropping custom nodes. Fix: imperative setContent + forced remount + complete extension list.
  • Range slider track invisible on light themes (accent-color only colored the thumb) — explicit styling of webkit/moz pseudo-elements.

v2.3.3

New
  • PIN sync across devices — the PIN hash now travels inside the FEK-encrypted manifest. Configuring a PIN on one device automatically propagates it to the others (last-write-wins on timestamp). Sync is triggered immediately on PIN change instead of waiting for the next periodic cycle.
Improved
  • Lock screen now routes to the PIN lock as soon as a PIN is received from another device (instead of falling back to the vault password).

v2.3.2

Improved
  • Reactive FEK indicator — new disk check (4 candidate paths cloud/local × dev/prod) instead of a renderer memory variable that was always inactive in cloud mode.
  • Sync-side log throttling — "not-authenticated / offline / no-fek" skips now only log on state transitions, removing the every-15-20s spam.
  • Vault Password screen: Filarr logo + real profile name (via fallback chain profile → localProfile → email local-part), i18n keys added (FR/EN).
Fixed
  • CRITICAL — Note loss via premature auto-save: on profile open, saveNotesToDisk could run with empty state before loadNotesFromDisk finished, overwriting up to 30 KB of notes. Two-pronged guard: renderer-side (auto-save blocked until a load has completed) + main-side (refuses writing < 200 bytes over an existing file > 200 bytes).
  • Enhanced Lock (before-quit handler): the async handler let Electron quit before .fek_safe was deleted. Replaced with event.preventDefault() + explicit quit after completion — .fek_safe is now guaranteed to be deleted before the quit.
  • Enhanced Lock (launch enforcement): handleProfileSelected was not setting isLocked=true when Enhanced Lock was enabled but .fek_safe was missing. The app skipped straight to the main screen. Pre-check added.
  • Post-unlock reload: after unlock, folders and notes are reloaded from disk (Enhanced Lock skips these loads at startup, they need to be replayed).
  • Graph view: edges visible on light themes — edge stroke was almost invisible at low density.

v2.3.1

Improved
  • Maintenance release — minor UI fixes for the Pomodoro widget introduced in v2.2.0 (progress ring, settings toggles).
Fixed
  • Pomodoro ring: time and label now stacked vertically instead of overlapping.
  • Pomodoro settings checkboxes replaced with proper visible switches.
  • Mode tabs contrast improved (white text on accent instead of white on white).

v2.3.0

Improved
  • Electron 39.2.1 → 41.2.1 — fixes 18 CVEs accumulated in the Electron 39 line: context isolation bypass, AppleScript injection, header injection, multiple use-after-free bugs, path injection in setAsDefaultProtocolClient (Windows), USB device spoofing, and more.
  • electron-builder 24.13.3 → 26.8.1 — aligned with Electron 41.
  • npm audit: 55 → 47 vulns, 0 critical, 0 direct high runtime. Only react-scripts remains (build-only, not exposed in production).
  • Runtime smoke test passed: authentication, cloud sync, manifest merge, upload/download, no regression on Electron APIs in use (BrowserWindow, webContents, session, Tray, autoUpdater, safeStorage, dialog, shell.openExternal, contextBridge).

v2.2.2

Improved
  • Full Electron fuses — 8 explicit fuses with strictlyRequireAllFuses: RunAsNode, EnableCookieEncryption (cookies encrypted via DPAPI/Keychain/libsecret), EnableNodeOptionsEnvironmentVariable, EnableNodeCliInspectArguments, EnableEmbeddedAsarIntegrityValidation, OnlyLoadAppFromAsar, LoadBrowserProcessSpecificV8Snapshot, GrantFileProtocolExtraPrivileges. A future Electron version cannot silently introduce a fuse with an insecure default.
  • HKDF-SHA-256 on the ECDH shared secret for multi-device pairing — the raw 256 bits are now expanded via HKDF using the pairing code as salt and a domain separator "filarr.pairing.wrap.v1" as info label. More aligned with AES-GCM security assumptions, and isolates the wrap key from any other future use of the shared secret.
Fixed
  • Missing i18n keys (i18next::translator missingKey warnings in console at launch): commandPalette.commands.focusTimer/focusTimerDesc, settings.font/fontDesc, settings.importVaultModalDesc, settings.importSelectFile.

v2.2.1

Improved
  • Full security audit post-v2.2.0 — 24 findings verified directly in the code, 8 patches shipped immediately, remaining ones deferred and documented.
Fixed
  • CRITICAL — Path traversal via import:readFile / import:readDirectory: an XSS in the renderer could exfiltrate ~/.ssh/id_rsa, .aws/credentials, git history, etc. Handlers now require a whitelist of paths approved via dialog.showOpenDialog + symlink rejection + 20,000-entry walk cap.
  • CRITICAL — ZIP bomb in vault:importZip: no decompression limit. Caps added: 500 MB total, 50 MB per entry, 10,000 entries max. Absolute paths or entries containing ".." rejected before extraction.
  • HIGH — Predictable UUIDs: generateUUID / generateUniqueId used Math.random() (non-cryptographic). Switched to crypto.randomUUID() / crypto.getRandomValues() (OS source).
  • HIGH — Service Worker disabled: a SW in Electron could serve stale JS after an update (the user would keep running vulnerable code after patch). Replaced with unregister() + Cache Storage purge at startup.
  • HIGH — Timing attack on hash comparison: filePasswordService compared legacy SHA-256 and PBKDF2 hashes with "===". Replaced with constant-time comparison (XOR over full length).
  • MEDIUM — URL protocol check: shell.openExternal was guarded by a naive startsWith("https://"). Replaced with strict new URL() parsing rejecting anything but http/https, ASCII control chars, and URLs > 8 KB. Also applied to billing URLs (defence-in-depth against compromised backend).
  • MEDIUM — DOMPurify FORBID_TAGS widened: MarkdownPreview now blocks svg, math, foreignObject, annotation-xml, object, embed, base, meta, link, and srcdoc/formaction/ping attributes (historically used to bypass the sanitizer).
  • MEDIUM — safeStorage fail-closed: hybrid:storeFEK silently returned false if safeStorage was unavailable. An inattentive caller could proceed without encrypted persistence. Now throws an explicit error.

v2.2.0

New
  • Focus / Pomodoro timer — persistent floating widget with 3 modes (focus 25 min, short break 5 min, long break 15 min — all configurable). Automatic focus → break cycling. Two states: minimized pill (clock + play/pause) and expanded card with progress ring, mode tabs, daily counter and settings panel. 90-day daily stats. System notifications. Accessible via header button or command palette.
  • Forest theme — deep pine-green dark theme with amber fireflies and green light rays through the canopy. Designed for long writing sessions.
  • Atkinson Hyperlegible font — designed by the Braille Institute to maximize readability (distinctive letterforms reduce b/d and 0/O confusion). Useful for low-vision users and everyone else.
Improved
  • Dependency audit — 59 vulnerabilities (1 critical) down to 55 (0 critical). Upgraded jspdf 4.2.0 → 4.2.1 (fixes critical XSS GHSA-wfv2-pwc8-crg5, CVSS 9.6), axios 1.7.7 → 1.15.0 (DoS via __proto__, SSRF NO_PROXY, header injection), dompurify 3.3.1 → 3.4.0 (5 sanitizer bypasses).

v2.1.0

New
  • Import from Obsidian — 4-step wizard (source → file → options → progress). Parses YAML frontmatter, wiki-links [[]], #tags, callouts > [!note]. Auto-maps top-level folders to Filarr notebooks.
  • Sakura theme — light cherry-blossom theme, soft pink on warm cream.
  • Crépuscule theme — dark twilight theme, amber and purple on deep brown.
  • Space Grotesk font — new typographic option in Appearance.
  • Atmospheric halos — subtle gradient overlay on effect themes (Space, Aurora, Sakura, Crépuscule).
Improved
  • Canvas2D graph — replaced SVG rendering with Canvas2D (10-50x faster). d3-force simulation with Barnes-Hut, frustum culling, HiDPI, zoom to cursor.
  • Organic graph — link strength formula 1/√max(degree), sub-structures emerge naturally instead of forming a ball.
  • Node size proportional to √connections (6-40px), hubs are visually prominent.
  • Interactive drag — moving a node restarts the simulation, neighbors react. Node stays pinned where dropped.
  • Smart labels — visible based on zoom level and node importance (hubs shown first).
  • Node limit raised from 500 to 2,000.
  • Virtualized NotesList — react-virtuoso reduces ~99% of DOM nodes for smooth scrolling with thousands of notes.
  • Clickable wiki-links — imported [[note]] are kept as plain text for Filarr decoration plugin.
  • External links — Ctrl+Click opens http(s):// URLs in the browser.
  • Wiki-suggestions capped at 20 results (perf with 6,000+ notes).
  • Inline parser — support for ==highlight==, [[wiki-link|alias]], and HTML→Markdown conversion.
Fixed
  • Billing webhook — fallback +30 days if Stripe doesn't return current_period_end.
  • NoteEditor — adapted background and text colors per theme.
  • Obsidian preprocessor — cleanup of %% comments, HTML buttons, shields.io badges.

v2.0.0

New
  • Zero-knowledge cloud sync — client-side AES-256-GCM encryption, Cloudflare R2 storage
  • Secure multi-device pairing — ECDH P-256 key exchange via 6-digit code
  • Subscription plans — Free (1 GB, 1 device), Solo (10 GB, 3 devices, €4/mo), Pro (50 GB, unlimited, €8/mo)
  • Stripe integration — checkout, customer portal, webhooks, automatic plan change detection
  • Profile sync between devices — name, avatar, folder structure
  • Auto-lock — configurable (5/15/30/60 min), clears FEK from memory
  • Enhanced lock mode — deletes .fek_safe on exit, vault password required on every launch
  • Exportable recovery key — JSON file encrypted with PBKDF2 + AES-GCM, 2-step restore
  • Cloud-only indicator — gray badge on files only available online
  • filarr.com/account page — manage devices, subscription and delete account from browser
  • Multi-device onboarding — automatic primary vs secondary device detection
Improved
  • Cloud manifest encrypted with FEK (not local key) — multi-device compatible
  • Device deduplication — device ID persisted locally, upsert on login
  • Auto-login after email verification in cloud onboarding
  • Storage quota recalculation from R2 (POST /sync/recalculate)
  • Resilient token refresh — no longer logs out on Windows file lock (EPERM)
  • Notes deleted with parent folder (soft delete, no more orphans)
  • Password change synced with cloud account
Fixed
  • Storage quota desynchronized after local deletions
  • Pairing shown on first device (false positive device count)
  • FEK not found after StorageService reinitialization (multi-path search)
  • metadata.json unreadable on Device B (encryption key not shared)
  • .fek_safe not found after active profile change
  • Sync did not start automatically after onboarding
  • Next button visible during pairing step
  • Onboarding flag not persisted to disk for secondary device flow

v1.7.1

New
  • Tab / Shift+Tab indentation in lists (checkboxes, bullets, numbered)
  • Collapse chevron on checkboxes — fold/unfold nested content
  • Automatic OS language detection at onboarding
  • Language selector on welcome page (🇫🇷/🇬🇧)
  • Single instance lock — prevents multiple launches, reactivates existing window
Improved
  • Theme applied in real-time during onboarding
  • Silent update — NSIS installer runs in background, like VS Code and Obsidian
  • Auto-install on close when an update is ready
  • Theme persistence on disk via IPC (survives updates)
  • Theme pre-applied on load — no more white flash in dark mode
  • Reduced heading margins (aligned with Notion/Obsidian)
  • Interactive release pipeline — choose which platforms to build
  • Conditional CI workflow — separate jobs per platform
  • Windows artifact name with dashes (fixes auto-updater 404)
  • Telemetry reconnected — Cloudflare KV stats resume
Fixed
  • setupAutoUpdater() called twice, doubling event listeners
  • Space, Lofi, Sky themes were not restored on restart
  • Multiple instances could launch simultaneously
  • release.js script lost JSON quotes in tag message

v1.6.3

New
  • Encryption password at onboarding — KEK derivation and FEK initialization on profile creation
  • Recovery phrase (12 words, MetaMask-style) to restore the encryption password
  • PIN reset via encryption password or recovery phrase
  • 3 new themes: Space (starfield), Lofi (warm earth tones), Sky (airy blues)
  • Enhanced code blocks — language selector (24), copy, line count, fold/collapse
  • Full vault import (ZIP) — notes, folders, tags, settings, supports plain and encrypted
  • Enriched export — TipTap JSON content, extended metadata, templates, flashcards, automations
  • New Filarr SVG logo (theme-adaptive component) + all assets updated
  • Collapsible Notes side panel (Ctrl+B)
  • 30+ accent colors and 36 avatar colors for profiles
Improved
  • Graph view — instant centering on first frame, adaptive repulsion and springs
  • Flashcards — fixed TipTap parsing, more permissive Q:/A: pattern
  • Wiki-links — detection via TipTap raw text instead of plainText (fixes undetected links)
  • Link hover preview — popover above link, 400ms delay, click navigates
  • Dual tab / Split view — each panel manages its own noteId independently
  • Window persistence — position, size, and maximized state saved
  • Theme selector — dynamic grid with thumbnail preview
  • Onboarding — scrollable container, increased width
Fixed
  • Wiki-links inserted via [[ did not appear in linkedNoteIds
  • Link popover and "Link a note" button overlapped on hover
  • Flashcards found no Q/R pairs due to TipTap double line breaks
  • In split mode, clicking a note in one panel also changed the other panel

v1.6.2

New
  • Note import (.md, .html, .txt, .filarr, .json) with automatic TipTap JSON conversion
  • Enhanced global search — finds notes (title + content with context excerpt) and settings sections
  • Editor dark mode themes — automatic dark variants for Default, Writer and Developer presets
Improved
  • Complete note export — preserves headings, lists, code blocks, tables, task lists, callouts, math formulas, Mermaid and inline formatting
  • Obsidian-style graph view — infinite space force simulation, Coulomb repulsion, Hooke springs, auto-fit viewport
  • Dark mode on Masonry, Sticky Notes, Dataview views and theme selector
  • Redesigned SearchResults with type-specific icons and direct navigation
  • DashboardStats: dark mode compatibility for SVG donut chart
  • FolderView: thumbnails hidden for locked protected files
  • ManageProfilesModal: full reset with onboarding flag persisted to disk via IPC
Fixed
  • Dark mode CSS fixes: BacklinksPanel, CalendarWidget, NoteEditor, NotesList, PeriodicNotes, TasksAggregator

v1.6.1

Improved
  • Update toast in bottom-right corner with progress bar and "Restart" button
  • Available version and download percentage now transmitted to renderer
Fixed
  • Update banner did not transmit the available version

v1.6.0

Improved
  • Instant launch — backend services initialize in parallel with UI rendering
  • Migration to HashRouter for Electron production compatibility
  • Auto-update via releases.filarr.com (no more GH_TOKEN needed)
  • Automatic update check every 4 hours
  • Upload .yml manifests and .blockmap (delta updates) to R2
  • Fixed icon paths in packaged mode

v1.5.3

New
  • Built-in wiki translated EN/FR (170+ keys): guides, shortcuts, editor, views, graph, templates
  • Bug report and suggestion form in settings
Improved
  • Redesigned built-in wiki: category navigation, Markdown rendering, search

v1.5.2

New
  • Associate notes with a parent folder (NoteFolderPicker)
  • Persistent flags system on disk (survives localStorage resets)
  • SSRF protection: block requests to private networks and cloud metadata endpoints
  • Path validation and sanitization to prevent path traversal
Improved
  • Strengthened PBKDF2: 600,000 iterations (×6) + SHA-512 for exports
  • Random salt per installation instead of fixed derived salt
  • Restricted file permissions (0o600) for keys and exports
  • PIN lockout after 3 failed attempts instead of 5
  • Complete onboarding redesign (820+ lines)

v1.5.1

New
  • Frameless window VS Code / Obsidian style with native overlay controls
  • Drag zone in title bar (WebkitAppRegion)
Improved
  • Starter templates redesign (1200+ lines)
  • Side panel in NotesView with backlinks and parent folder
  • Global CSS updated for frameless mode (342 lines)

v1.5.0

Fixed
  • Fixed basename quoting in CI workflow
  • Improved multi-OS release workflow

v1.4.6

New
  • Ko-fi and Stripe donation links in settings
Improved
  • Dev/prod detection via app.isPackaged
  • Dynamic icon resolution (dev vs packaged)
Fixed
  • Fixed ProfileMetadata type (avatarImage field)
  • Fixed window renderer error

v1.4.0

New
  • Custom profile avatar images
  • Full UI Tour with automatic sidebar opening
  • Automated release script
Improved
  • Extended color palette for profiles
  • PIN lock screen with image support

v1.3.0

New
  • Multi-profile system with PIN lock and data isolation
  • Local KEK/FEK encryption: FEK derived from password, transparent encryption
  • Rich note editor with wiki-links [[]], multiple views (kanban, masonry, canvas, mind map...)
  • Full EN/FR internationalization
  • Electron security: fuses, rate limiting, IPC allowlist, CSP
Improved
  • Full codebase overhaul (394 files)
  • TypeScript migration (99.26% test coverage)
  • Scroll optimization: lazy thumbnails, content-visibility, memo
Fixed
  • FEK pipeline for hybrid encryption
  • 17 critical production issues resolved
  • 7 backend TypeScript errors fixed

↓ 18 months of solo development — complete rewrite of encryption engine, note editor, graph view, multi-profile.

v1.2.6

Improved
  • Updated encryption system
Fixed
  • Various bug fixes
  • Fixed auto-update bug

v1.2.0

Improved
  • Production deployment with environment variables

v1.1.0

New
  • Initial software skeleton
  • Local storage with AES encryption
  • File and folder customization (colors, icons)
  • Multi-select with batch actions
  • Reminder system with desktop notifications
  • Auto-update (electron-updater)
Fixed
  • File synchronization
  • Rename error
  • Deletion in subfolders
  • Copy/paste
  • Reminder notifications after completion