github.com/usememos/memos

Memos 0.30 refreshes how you capture, write, and browse your notes. It introduces the Memos Web Clipper, a rebuilt Markdown editor, richer memo detail views, flexible multi-column feeds, faster rendering, and stronger authentication and sharing boundaries.

Introducing Memos Web Clipper

Save page details, selected text, and images directly to Memos from Chromium-based browsers and Firefox. The clipper converts links, lists, code, and tables to Markdown, uploads images as attachments, and lets you review and edit every clip before saving.

Choose Private, Protected, or Public visibility, customize the output with local templates, or save selected text and images as private memos from the browser context menu. Connect through usememos.com, or connect directly with your Memos instance URL and a personal access token.

Install for Chrome · Install for Firefox · Visit website · GitHub

Writing and browsing

• A new Markdown editor: The editor has been rebuilt as a single CodeMirror 6 decorated-source experience. Your Markdown stays visible and unchanged while headings, formatting, tags, and mentions are styled in place. Tag completion, list indentation, focus mode, improved keyboard shortcuts, and a toggleable formatting toolbar make longer writing sessions smoother. (5a73d7) (e3c231f)
• Richer memo details: The memo detail page now uses a property rail for quick actions, visibility, metadata, attachments, relations, and a scroll-aware outline. When you return to a feed, Memos restores your previous scroll position. (d4b5a16) (e497895)
• Feeds that fit your workflow: Choose one, two, three, or automatically fitted columns, then control compact rendering and link previews. Preferences are saved, multi-column layouts stay balanced as cards resize, and newly created memos remain easy to find above pinned content. (177d65a) (e3e4ae1) (cafa56f)
• Better Markdown and conversations: GFM footnotes now render with navigation, file paste and drag-and-drop behavior is more reliable, task-list expansion is preserved, and comment pagination can load the full conversation. (1020060) (#6076) (ecbe2ab)

Personalization and interface

• More capable filters: Shortcut filters now support string matching, regular expressions, collection predicates, timestamp accessors, set operations, and an untagged-memos recipe. (f0e4a56) (b787bfa)
• Personal tag settings: Tag colors and content-blur rules now belong to each user. Existing instance-level settings are copied to current users during migration. Tags inside links are no longer misidentified, literal tags can be escaped with a backslash, and names support Unicode combining marks. (#6017) (a50ce09) (#6051)
• Clearer settings and access tokens: Settings navigation has been refreshed, while the access-token page now includes practical guidance, a copyable API example, safety notes, and last-used timestamps. New access tokens default to no expiration. (715306e) (cc20327)
• A more consistent interface: Sign-in, sign-up, About, mobile controls, loading states, radio indicators, tooltip arrows, and long location labels have all been refined. The locale picker is now searchable, European language coverage has expanded, and missing Japanese and Simplified Chinese translations have been completed. (564da94) (4183985) (a47d049)

Integrations and self-hosting

• A rebuilt MCP integration: Memos now exposes a curated, OpenAPI-driven MCP toolset that uses the same authentication and authorization as the public API. It covers memos, comments, relations, reactions, shortcuts, identities, and attachments, including uploads, with more reliable resource routing and tool schemas. (777d227) (0e1d821) (390126f)
• Signed, editable webhooks: Webhooks can now use Standard Webhooks HMAC-SHA256 signing secrets. You can edit webhooks, see their signing status, and reveal a generated secret again when needed. Invalid secrets are rejected before saving. (#6013) (#6027)
• File-backed deployment settings: Identity providers and supported instance settings can be supplied as validated JSON files under /etc/secrets. These files act as runtime overrides and keep the corresponding settings read-only in the UI and API until removed. (0038295)
• More flexible S3-compatible storage: Self-hosted deployments using self-signed certificates can opt into insecure_skip_tls_verify. (#6039)

Performance, reliability, and security

• Faster feeds and Explore: Memos now caches fingerprinted assets, defers media and rich renderers until needed, renders feed content near the viewport, and shares user and memo lookups across creators, reactions, comments, mentions, and relations. This reduces startup work, rendering cost, and bandwidth. (88c6ee8) (6c1055f) (249b331)
• Safer authentication and SSO: SSO option loading is more stable, OAuth client authentication can be detected automatically, and first-time SSO provisioning is atomic across SQLite, MySQL, and PostgreSQL. Concurrent first sign-ins no longer leave orphaned users, and valid SSO identifiers are used as local usernames when possible. (6c17e87) (96cb653) (019f4f9)
• Cleaner and more compatible APIs: Legacy UUID-based identifiers remain supported while new resource names follow AIP conventions. User-facing errors no longer expose internal RPC prefixes, bearer-token cross-origin requests work without weakening same-origin cookie protection, and user lists paginate consistently. (84776cc) (b7d5d09) (0bfeb91) (385fa22)
• Deployment polish: The container entrypoint no longer restarts indefinitely when MEMOS_UID=0, and the demo instance now uses representative public and protected memos to showcase tags, references, comments, mentions, reactions, locations, attachments, and rich Markdown. (#6061) (469c995)

Before upgrading

The following changes affect instance configuration, saved filters, shared-memo API clients, or existing MCP clients:

• Public and private instances: Instances without --instance-url or MEMOS_INSTANCE_URL now run in private mode. Anonymous visitors are sent to sign-in, anonymous API access is limited to setup, authentication, and shared-memo routes, and RSS feeds are unavailable. Set the instance URL to keep the previous public behavior. (d1cef7a) (415a3ec)
• Shared memo API: GetMemoByShare and GET /api/v1/shares/{share_id} have been replaced by GetSharedMemo and GET /api/v1/shares/{share_token}/memo. Share-token responses now contain only the shared memo and its attachments, without the surrounding parent, comments, or relation graph. (0d2cbd4) (415a3ec)
• Saved time filters: now() has been replaced by the now timestamp variable, and time fields now use CEL timestamps. Update shortcuts to expressions such as created_ts >= now - duration("24h") or timestamp(<epoch>) instead of comparing time fields with bare epoch values. (26f4b73)
• MCP clients: The MCP server is now a stateless, tools-only endpoint at /mcp with service-prefixed tool names. Prompts, resources, tool-filtering headers, route aliases, and unprefixed names have been removed. Tool errors now use isError with text content instead of structuredContent.error. (#6026) (03e34bd)

New Contributors

• @ay5399 made their first contribution in #6016
• @YigesMx made their first contribution in #6013
• @manjieqi made their first contribution in #6033
• @mahirhir made their first contribution in #6048
• @lukas346 made their first contribution in #6050
• @santhoshtr made their first contribution in #6051
• @blackflytech made their first contribution in #6058
• @grandpig made their first contribution in #6060
• @archit-goyal made their first contribution in #6065
• @weifanglab made their first contribution in #6069
• @TowyTowy made their first contribution in #6083
• @WindLX made their first contribution in #6084
• @harpchad made their first contribution in #6108

Full Changelog: v0.29.1...v0.30.0

Summary

Memos 0.30 delivers a major writing and navigation refresh, centered on the new CodeMirror editor, richer memo detail views, configurable multi-column feeds, and faster Explore and feed rendering. It also replaces the MCP integration with a curated OpenAPI-driven tool surface, expands deployment-time configuration, and strengthens authentication, sharing, and private-instance access boundaries.

This stable release includes all changes shipped through 0.30.0-rc.1 and 0.30.0-rc.2, plus the final authentication, SSO, sharing, and MCP fixes listed below.

⚠ BREAKING CHANGES

• Access control: Instances without --instance-url (or MEMOS_INSTANCE_URL) now run in private mode. Anonymous visitors are sent to sign-in, anonymous API access is limited to setup, authentication, and shared-memo routes, and RSS feeds are unavailable. Set the instance URL to retain the previous public behavior. (d1cef7a) (415a3ec)
• Shared memo API: GetMemoByShare and GET /api/v1/shares/{share_id} have been replaced by GetSharedMemo and GET /api/v1/shares/{share_token}/memo. API clients must update the RPC, request type, field name, and REST path. Share-token responses are limited to the shared memo and its attachments and no longer expose the surrounding parent, comments, or relation graph. (0d2cbd4) (415a3ec)
• Filters: now() has been replaced by the now timestamp variable, and time fields now use CEL timestamps. Update saved shortcuts to use expressions such as created_ts >= now - duration("24h") or timestamp(<epoch>) instead of comparing time fields with bare epoch values. (26f4b73)
• MCP: The MCP server is now a stateless, tools-only endpoint generated from the OpenAPI schema. The previous prompts, resources, tool-filtering headers and route aliases, and unprefixed tool names have been removed. Clients must switch to /mcp and the new service-prefixed tool names. Tool errors now use isError and text content rather than a non-standard structuredContent.error payload. (#6026) (03e34bd)

Highlights

• Markdown editor: Rebuilt the editor as a single CodeMirror 6 decorated-source editor. Markdown is preserved verbatim while headings, formatting, tags, and mentions are styled in place. The editor adds tag completion, list indentation, improved keyboard shortcuts, focus mode, and a toggleable formatting toolbar for headings, lists, task lists, code blocks, bold, italic, strikethrough, and inline code. (5a73d7) (e3c231f)
• Memo detail and navigation: Redesigned the memo detail sidebar as a property rail with quick actions, editable visibility, memo metadata, attachments, relations, and a scroll-aware outline. Feed scroll position is restored when navigating back from another page. (d4b5a16) (e497895)
• Memo feeds: Added persisted controls for one, two, three, or automatically fitted columns, compact mode, and link previews. Compact rendering is opt-in in single-column feeds so full memo content is shown by default. Multi-column feeds stay balanced as cards resize, while newly created memos remain easy to find above pinned content. (177d65a) (e3e4ae1) (cafa56f)
• MCP: Replaced the hand-written MCP implementation with a curated OpenAPI-driven tool surface that reuses the public API's authentication and authorization. The final toolset includes memo, comment, relation, reaction, shortcut, identity, and attachment operations, including attachment uploads. Canonical and nested resource names can be passed directly to follow-up tools. (777d227) (0e1d821) (390126f)
• Deployment configuration: Identity providers and supported instance settings can be supplied as validated JSON files under /etc/secrets. File-backed settings act as runtime overrides and cannot be changed through the UI or API until the files are removed. (0038295)
• Webhooks: Added Standard Webhooks HMAC-SHA256 signing secrets, webhook editing, and a signing-status indicator. Secrets are generated server-side, shown after creation, and can be revealed later from the edit dialog; malformed secrets now fail validation. (#6013) (#6027)
• Filters and tag settings: Expanded CEL shortcuts with string matching, regular expressions, collection predicates, timestamp accessors, set operations, and an untagged-memos example. Tag colors and content-blur rules are now per-user, with existing instance tag settings copied during migration. (f0e4a56) (b787bfa) (#6017)
• Settings and access tokens: Refreshed settings navigation and expanded the access-token page with practical guidance, a copyable API example, safety notes, and last-used timestamps. Access tokens now default to no expiration, and the About page and documentation surface the Memos Web Clipper. (715306e) (cc20327) (f946974)
• Internationalization and interface: Added a searchable locale picker, expanded European locale coverage, completed missing Japanese and Simplified Chinese translations, refreshed the sign-in, sign-up, and About pages, and aligned common controls across the app. (4183985) (a47d049) (564da94)
• Markdown and storage: Added GFM footnote rendering and navigation, plus an insecure_skip_tls_verify option for S3-compatible storage with self-signed certificates. (1020060) (#6039)
• Faster feeds and Explore: Reduced initial work and bandwidth by caching fingerprinted assets, deferring media and rich renderers until needed, rendering feed content near the viewport, and sharing user and memo lookups across creators, reactions, comments, mentions, and relations. (88c6ee8) (6c1055f) (249b331)
• Demo experience: Rebuilt the demo data around representative public and protected memos that showcase nested tags, references, comments, mentions, reactions, locations, attachments, and rich Markdown. (469c995)

Fixes and polish

• Authentication and SSO: Stabilized SSO option loading, added OAuth client-auth auto-detection, distinguished fresh instances from populated instances without an admin, and made first-time SSO provisioning atomic across SQLite, MySQL, and PostgreSQL. Valid, non-reserved SSO identifiers are used as local usernames with UUID fallback, and concurrent first sign-ins no longer leave orphaned users. (6c17e87) (96cb653) (019f4f9)
• API compatibility and errors: Aligned new resource IDs and annotations with AIP conventions while preserving legacy UUID-based identifiers, corrected canonical user-stat resource names, removed internal RPC prefixes from user-facing errors, and consistently enforced private-instance access policy across Connect, REST Gateway, files, and RSS. (84776cc) (b7d5d09) (0bfeb91) (415a3ec)
• MCP reliability: Fixed round-tripping canonical resource names, nested resource routing, success-schema validation for tool errors, partial-update request schemas, path-bound request bodies, destructive-operation annotations, and oversized request handling. (03e34bd) (390126f)
• Editor: Improved formatting toggles and keyboard shortcuts, file paste and drop handling, focus-mode layout, caret behavior in empty space, and CodeMirror spacing. (c349c15) (#6076) (#6093)
• Memos and comments: Preserved expanded task-list state, added pagination so every comment page can be loaded, included the parent memo relation in comment webhook payloads, and limited share tokens to the selected memo rather than its conversation and relation graph. (ecbe2ab) (#6083) (415a3ec)
• Tags: Tags inside links are no longer parsed as memo tags, literal tags can be escaped with a backslash, and tag names support Unicode combining marks. (a50ce09) (#6051)
• API and security: Cross-origin API requests now work with bearer tokens while cookie authentication remains same-origin, and ListUsers returns consistent paginated results. (385fa22) (4bc3928)
• Interface: Replaced mismatched memo skeletons with a delayed spinner, improved mobile control spacing, truncated long location labels without hiding the full address, corrected radio-group indicator alignment, and positioned tooltip arrows outside their content panels. (#6047) (3b601b8) (#6097) (2d01420) (#6095) (773e56e)
• Container: Prevented the entrypoint from restarting indefinitely when MEMOS_UID=0. (#6061)

Introducing Memos Web Clipper

Save pages, selected text, and images as Markdown directly to your Memos instance. Review and edit every clip before saving, choose its visibility, and customize the Markdown format to fit your workflow.

Install for Chrome · Install for Firefox · Learn more

Highlights

• Memo detail and navigation: Redesigned the memo detail sidebar as a property rail with quick actions, editable visibility, memo metadata, attachments, relations, and a scroll-aware outline. Feed scroll position is now restored when navigating back from another page. (d4b5a16) (e497895)
• Settings and access tokens: Refreshed settings navigation and expanded the access-token page with practical guidance, a copyable API example, safety notes, and last-used timestamps. The About page and project documentation now surface the Memos Web Clipper. (715306e) (06ecef3) (f946974)
• Faster feeds and Explore: Reduced initial work and bandwidth by caching fingerprinted assets, deferring media and rich renderers until needed, rendering feed content near the viewport, and sharing user and memo lookups across creators, reactions, comments, mentions, and relations. (88c6ee8) (6c1055f) (249b331)
• Demo experience: Rebuilt the demo data around representative public and protected memos that showcase nested tags, references, comments, mentions, reactions, locations, attachments, and rich Markdown. (469c995)

Fixes and polish

• API compatibility and errors: Aligned new resource IDs and annotations with AIP conventions while preserving legacy UUID-based identifiers, corrected canonical user-stat resource names, and removed internal RPC prefixes from user-facing error messages. (84776cc) (b7d5d09) (0bfeb91)
• Interface: Corrected radio-group indicator alignment and positioned tooltip arrows outside their content panels. (#6097) (2d01420) (#6095) (773e56e)

Highlights

• Memo detail and navigation: Redesigned the memo detail sidebar as a property rail with quick actions, editable visibility, memo metadata, attachments, relations, and a scroll-aware outline. Feed scroll position is now restored when navigating back from another page. (d4b5a16) (e497895)
• Settings and access tokens: Refreshed settings navigation and expanded the access-token page with practical guidance, a copyable API example, safety notes, and last-used timestamps. The About page and project documentation now surface the Memos Web Clipper. (715306e) (06ecef3) (f946974)
• Faster feeds and Explore: Reduced initial work and bandwidth by caching fingerprinted assets, deferring media and rich renderers until needed, rendering feed content near the viewport, and sharing user and memo lookups across creators, reactions, comments, mentions, and relations. (88c6ee8) (6c1055f) (249b331)
• Demo experience: Rebuilt the demo data around representative public and protected memos that showcase nested tags, references, comments, mentions, reactions, locations, attachments, and rich Markdown. (469c995)

Fixes and polish

• API compatibility and errors: Aligned new resource IDs and annotations with AIP conventions while preserving legacy UUID-based identifiers, corrected canonical user-stat resource names, and removed internal RPC prefixes from user-facing error messages. (84776cc) (b7d5d09) (0bfeb91)
• Interface: Corrected radio-group indicator alignment and positioned tooltip arrows outside their content panels. (#6097) (2d01420) (#6095) (773e56e)

⚠ BREAKING CHANGES

• Access control: Instances without --instance-url (or MEMOS_INSTANCE_URL) now run in private mode. Anonymous visitors are sent to sign-in and anonymous API access is limited to setup, authentication, and shared-memo routes. Set the instance URL to retain the previous public behavior. (d1cef7a)
• Filters: now() has been replaced by the now timestamp variable, and time fields now use CEL timestamps. Update saved shortcuts to use expressions such as created_ts >= now - duration("24h") or timestamp(<epoch>) instead of comparing time fields with bare epoch values. (26f4b73)
• MCP: The MCP server is now a stateless, tools-only endpoint generated from the OpenAPI schema. The previous prompts, resources, tool-filtering headers and route aliases, and unprefixed tool names have been removed. Clients that used them must switch to /mcp and the new service-prefixed tool names. (#6026)

Highlights

• Markdown editor: Rebuilt the editor as a single CodeMirror 6 decorated-source editor. Markdown is preserved verbatim while headings, formatting, tags, and mentions are styled in place. The editor also adds tag completion, list indentation, and a toggleable formatting toolbar with headings, lists, task lists, code blocks, bold, italic, strikethrough, and inline code. (5a73d7d) (e3c231f)
• MCP: Replaced the hand-written MCP implementation with a curated OpenAPI-driven tool surface that reuses the public API's authentication and authorization. The final toolset includes memo, comment, relation, reaction, shortcut, identity, and attachment operations, including attachment uploads. (777d227) (0e1d821)
• Deployment configuration: Identity providers and supported instance settings can be supplied as validated JSON files under /etc/secrets. File-backed settings act as runtime overrides and cannot be changed through the UI or API until the files are removed. (0038295)
• Memo feeds: Added persisted controls for one, two, three, or automatically fitted columns; compact mode; and link previews. Multi-column feeds stay balanced as cards resize, while newly created memos remain easy to find above pinned content. (177d65a) (e3e4ae1)
• Webhooks: Added Standard Webhooks HMAC-SHA256 signing secrets, webhook editing, and a signing-status indicator. Secrets are generated server-side, shown after creation, and can be revealed later from the edit dialog; malformed secrets now fail validation. (#6013) (#6027)
• Filters: Expanded CEL shortcuts with string matching, regular expressions, collection predicates, timestamp accessors, set operations, and an untagged-memos example. (f0e4a56) (b787bfa)
• Tag settings: Tag colors and content-blur rules are now per-user. Existing instance tag settings are copied to current users during migration. (#6017)
• Internationalization: Added a searchable locale picker, expanded European locale coverage, and completed missing Japanese and Simplified Chinese translations. (4183985) (a47d049)
• Interface: Refreshed the sign-in, sign-up, and About pages and aligned common controls across the app. Compact rendering is now opt-in in single-column feeds, so full memo content is shown by default. (564da94) (cafa56f)
• Markdown and storage: Added GFM footnote rendering and navigation, plus an insecure_skip_tls_verify option for S3-compatible storage with self-signed certificates. (1020060) (#6039)

Fixes and polish

• Authentication and setup: Stabilized SSO option loading, added OAuth client-auth auto-detection, and distinguished fresh instances from populated instances that no longer have an admin. (6c17e87) (96cb653)
• Editor: Improved formatting toggles and keyboard shortcuts, file paste and drop handling, focus-mode layout, caret behavior in empty space, and CodeMirror spacing. (c349c15) (#6076) (#6093)
• Memos and comments: Preserved expanded task-list state, loaded every comment page, and included the parent memo relation in comment webhook payloads. (ecbe2ab) (#6083)
• Tags: Tags inside links are no longer parsed as memo tags, literal tags can be escaped with a backslash, and tag names support Unicode combining marks. (a50ce09) (#6051)
• API and security: Cross-origin API requests now work with bearer tokens while cookie authentication remains same-origin, and ListUsers now returns consistent paginated results. (385fa22) (4bc3928)
• Interface: Replaced mismatched memo skeletons with a delayed spinner, improved mobile control spacing, and truncated long location labels without hiding the full address. (#6047) (3b601b8)
• Container: Prevented the entrypoint from restarting indefinitely when MEMOS_UID=0. (#6061)

⚠ BREAKING CHANGES

• Access control: Instances without --instance-url (or MEMOS_INSTANCE_URL) now run in private mode. Anonymous visitors are sent to sign-in and anonymous API access is limited to setup, authentication, and shared-memo routes. Set the instance URL to retain the previous public behavior. (d1cef7a)
• Filters: now() has been replaced by the now timestamp variable, and time fields now use CEL timestamps. Update saved shortcuts to use expressions such as created_ts >= now - duration("24h") or timestamp(<epoch>) instead of comparing time fields with bare epoch values. (26f4b73)
• MCP: The MCP server is now a stateless, tools-only endpoint generated from the OpenAPI schema. The previous prompts, resources, tool-filtering headers and route aliases, and unprefixed tool names have been removed. Clients that used them must switch to /mcp and the new service-prefixed tool names. (#6026)

Highlights

• Markdown editor: Rebuilt the editor as a single CodeMirror 6 decorated-source editor. Markdown is preserved verbatim while headings, formatting, tags, and mentions are styled in place. The editor also adds tag completion, list indentation, and a toggleable formatting toolbar with headings, lists, task lists, code blocks, bold, italic, strikethrough, and inline code. (5a73d7d) (e3c231f)
• MCP: Replaced the hand-written MCP implementation with a curated OpenAPI-driven tool surface that reuses the public API's authentication and authorization. The final toolset includes memo, comment, relation, reaction, shortcut, identity, and attachment operations, including attachment uploads. (777d227) (0e1d821)
• Deployment configuration: Identity providers and supported instance settings can be supplied as validated JSON files under /etc/secrets. File-backed settings act as runtime overrides and cannot be changed through the UI or API until the files are removed. (0038295)
• Memo feeds: Added persisted controls for one, two, three, or automatically fitted columns; compact mode; and link previews. Multi-column feeds stay balanced as cards resize, while newly created memos remain easy to find above pinned content. (177d65a) (e3e4ae1)
• Webhooks: Added Standard Webhooks HMAC-SHA256 signing secrets, webhook editing, and a signing-status indicator. Secrets are generated server-side, shown after creation, and can be revealed later from the edit dialog; malformed secrets now fail validation. (#6013) (#6027)
• Filters: Expanded CEL shortcuts with string matching, regular expressions, collection predicates, timestamp accessors, set operations, and an untagged-memos example. (f0e4a56) (b787bfa)
• Tag settings: Tag colors and content-blur rules are now per-user. Existing instance tag settings are copied to current users during migration. (#6017)
• Internationalization: Added a searchable locale picker, expanded European locale coverage, and completed missing Japanese and Simplified Chinese translations. (4183985) (a47d049)
• Interface: Refreshed the sign-in, sign-up, and About pages and aligned common controls across the app. Compact rendering is now opt-in in single-column feeds, so full memo content is shown by default. (564da94) (cafa56f)
• Markdown and storage: Added GFM footnote rendering and navigation, plus an insecure_skip_tls_verify option for S3-compatible storage with self-signed certificates. (1020060) (#6039)

Fixes and polish

• Authentication and setup: Stabilized SSO option loading, added OAuth client-auth auto-detection, and distinguished fresh instances from populated instances that no longer have an admin. (6c17e87) (96cb653)
• Editor: Improved formatting toggles and keyboard shortcuts, file paste and drop handling, focus-mode layout, caret behavior in empty space, and CodeMirror spacing. (c349c15) (#6076) (#6093)
• Memos and comments: Preserved expanded task-list state, added pagination so every comment page can be loaded, and included the parent memo relation in comment webhook payloads. (ecbe2ab) (#6083)
• Tags: Tags inside links are no longer parsed as memo tags, literal tags can be escaped with a backslash, and tag names support Unicode combining marks. (a50ce09) (#6051)
• API and security: Cross-origin API requests now work with bearer tokens while cookie authentication remains same-origin, and ListUsers now returns consistent paginated results. (385fa22) (4bc3928)
• Interface: Replaced mismatched memo skeletons with a delayed spinner, improved mobile control spacing, and truncated long location labels without hiding the full address. (#6047) (3b601b8)
• Container: Prevented the entrypoint from restarting indefinitely when MEMOS_UID=0. (#6061)

Bug Fixes

• Task list layout - Task item content now stays in one grid column, so multi-line task items keep their text aligned with the task body.
• Link preview descriptions - Link previews now support standard <meta name="description"> tags, improving metadata cards for sites without Open Graph descriptions.
• Mobile video posters - Video attachments now render poster thumbnails on mobile attachment views.

New Contributors

• @goingforstudying-ctrl made their first contribution in #6000

Full Changelog: v0.29.0...v0.29.1

Bug Fixes

• markdown: keep task item content in one grid column (7c3bff4)
• support <meta name=description> in link previews (#6000) (e8d32e8)
• web: render video attachment posters on mobile (0e2a9a9)

This release adds richer link previews, notification email settings, shortcut and memo workflow improvements, and a set of security, media, and editor fixes. It also adds new instance statistics APIs and performance improvements for the initial screen.

New Features

Link Previews and Metadata

• Link metadata APIs - Memos now includes endpoints for fetching and batching metadata for links attached to memos.
• Rendered link cards - The web app can render metadata cards for shared links, making memo references easier to scan.
• DNS rebinding protection - Link metadata fetching now rejects DNS rebinding attempts.

Notification and Transcription Settings

• SMTP email settings - Instance notification settings now include SMTP email configuration.
• Email test endpoint - Admins can test notification email settings through the instance API.
• Explicit speech-to-text settings - Transcription settings now expose provider, model, and prompt configuration.

Memo and Workspace Improvements

• Task list quick actions - Memos with task lists now support faster task interactions.
• Calendar-aware memo creation - Creating a memo from the calendar uses the selected calendar date.
• Dedicated shortcuts page - Shortcut management is available from a dedicated page.
• About page and placeholder refresh - The app includes a refreshed about page and new placeholder states.

Administration and Statistics

• Instance resource statistics - Admin instance stats now include resource statistics.
• Filtered all-user stats - All-user statistics can be filtered for more focused administration views.
• Configurable log level - The server now accepts a --log-level flag.

Bug Fixes

• Attachment ownership enforcement - Memo updates now enforce attachment ownership.
• Comment visibility - Comments now respect parent memo visibility.
• User response privacy - User list responses omit internal settings.
• Memo creation events - Creating memos with attachments no longer emits an extra update event.
• Avatar sync - Profile avatar changes sync immediately after update.
• Release media handling - HDR image metadata is preserved in thumbnails, and motion media payloads are preserved through S3 presigned uploads.
• Editor and markdown polish - URL paste wrapping and task-list alignment are improved.
• Static cache and sitemap paths - Frontend static cache headers and public memo sitemap paths are corrected.
• SSE refresh behavior - Initial SSE responses stream correctly and refresh tokens are handled.

Performance Improvements

• Initial screen loading - Heavy first-screen dependencies are lazy loaded.

New Contributors

• @Moustafaa91 made their first contribution in #5902
• @wally-an made their first contribution in #5903
• @tokenicrat made their first contribution in #5921
• @mayanksaini18 made their first contribution in #5934
• @santoshyadavdev made their first contribution in #5954

Full Changelog: v0.28.0...v0.29.0

Features

• about: add about page with bird sprites (411ba7b)
• activity-calendar: aggregate by ViewContext.timeBasis (8daef1d)
• add <Placeholder> component with ASCII bird states (#5949) (8c16ffa)
• add configurable --log-level flag (#5934) (f1e2a06)
• add dedicated shortcuts page (#5942) (1df6479)
• add link metadata endpoints (9c5c604)
• frontend: add pixel bird tilemaps (cf55f11)
• memo: add task list quick actions (#5983) (648b3bd)
• memo: create memos on the selected calendar date (#5925) (ef55013)
• notification: add smtp email settings (cd4f28a)
• placeholder: add woodpecker tilemap (638e4f3)
• render link metadata cards (0bc5669)
• stats: admin instance resource statistics (ea0625d)
• stats: support filtered all-user stats (88ac3ec)
• transcription: explicit STT settings with provider, model, prompt (#5926) (238f27d)

Bug Fixes

• avoid update event on memo create attachments (#5961) (3c3382a)
• delete user cleanup (#5981) (e53b7d9)
• editor: wrap selected text when pasting URL (e0bb3a2)
• fileserver: preserve HDR image metadata in thumbnails (c724232)
• frontend: correct static cache headers (084f40b)
• frontend: use correct url path for memos in sitemap.xml (#5921) (603781f)
• httpgetter: prevent DNS rebinding in link metadata fetch (078488c)
• markdown: align list items with checkboxes (e008b1a)
• memo: enforce parent visibility for comments (4a1e401)
• s3presign: preserve motion media payload (7f1f53f)
• security: enforce attachment ownership on memo updates (35bf761)
• sse: stream initial response and refresh tokens (21303e8)
• user: omit internal settings from list responses (#5917) (1df3fe7)
• web: sync avatar changes immediately after profile update (#5903) (328396a)

Performance Improvements

• lazy load heavy first-screen dependencies (#5947) (a6024ee)

0.28.0 (2026-04-27)

This release improves SSO account handling by linking external provider identities to local Memos users instead of treating provider identifiers as local usernames. It also refreshes account and SSO management, adds memo time display controls, and includes several authentication and editor fixes.

Breaking Change

• Existing SSO users must link their identity again - If you previously signed in through SSO, sign in once with your username and password after upgrading, then go to Account Settings to link your SSO identity. After the identity is linked, future SSO sign-ins will resolve to your existing Memos account.

Features

• auth: add SSO user identity linkage (#5883) (d688914)
• memos: choose created or updated time for memos (#5894) (c268551)
• redesign account and SSO management (#5886) (ee17998)

Bug Fixes

• auth: harden authorization and username validation (#5890) (0fb83a7)
• disable modal prop on DropdownMenu to prevent scroll disappearing (#5861) (d98f665)
• fix legacy username auth flows (#5885) (30c0611)
• markdown: split mixed task and bullet lists (e2c6084)
• reduce list memo query overhead (#5880) (5063804)
• web: preserve task checkbox state (#5867) (b5863d7)

Features

• auth: add SSO user identity linkage (#5883) (d688914)
• memos: choose created or updated time for memos (#5894) (c268551)
• redesign account and SSO management (#5886) (ee17998)

Bug Fixes

• auth: harden authorization and username validation (#5890) (0fb83a7)
• disable modal prop on DropdownMenu to prevent scroll disappearing (#5861) (d98f665)
• fix legacy username auth flows (#5885) (30c0611)
• markdown: split mixed task and bullet lists (e2c6084)
• reduce list memo query overhead (#5880) (5063804)
• web: preserve task checkbox state (#5867) (b5863d7)

0.27.1 (2026-04-19)

Bug Fixes

• mixed-case user resource names (#5853) (01be01f)
• release: inject build version into artifacts (f8a304b)
• user resource names can be uuidv4 from idp sub claim (#5856) (bbded58)

Bug Fixes

• mixed-case user resource names (#5853) (01be01f)
• release: inject build version into artifacts (f8a304b)
• user resource names can be uuidv4 from idp sub claim (#5856) (bbded58)

0.27.0 (2026-04-18)

Features

• add --allow-private-webhooks flag to bypass SSRF protection (#5694) (cd5816c)
• add blur_content attribute to tag metadata settings (#5767) (45b2153)
• add Gemini transcription provider (#5830) (d87539a)
• add GitHub release installer and release workflow (1ed542c)
• add live refresh via Server-Sent Events (SSE) with visual indicator (#5638) (ea0892a)
• add MCP server with PAT authentication (47d9414)
• add outline navigation to memo detail sidebar (#5771) (6b30579)
• ai: add BYOK audio transcription (#5832) (101704c)
• ai: add instance AI providers and transcription (#5829) (83ed32f)
• attachments: add Live Photo and Motion Photo support (#5810) (4b4e719)
• cli: add version subcommand (#5731) (0ba4c0f)
• editor: add voice note recording to the memo composer (#5801) (c0d5854)
• extract title from first H1 heading into memo property (#5726) (1e688b2)
• i18n: update sse connect label in Chinese (#5732) (89c6902)
• instance: add canonical tag metadata setting (#5736) (65d14fb)
• instance: add notification transport setting (#5737) (a249d06)
• mcp: enhance MCP server with full capabilities and new tools (#5720) (b8e9ee2)
• mcp: harden tool exposure and side effects (#5850) (583c3d2)
• mcp: refactor MCP server to standard protocol structure (803d488)
• memo-editor: add compact live waveform recorder panel (#5817) (e51985a)
• memo-preview: support comment metadata in previews (#5768) (e176b28)
• memo: add image sharing in detail view (38fc22b)
• memo: add share links for private memos (#5742) (3f3133d)
• mentions: add memo mention parsing, notifications, and rendering (#5811) (24fc8ab)
• replace auto-increment ID with UID for identity provider resource names (#5687) (92d937b)
• show inline comment preview in list view (3a5d3c8)
• store: change default storage type to local filesystem (78efa68)
• treat tag setting keys as anchored regex patterns (#5759) (9e04049)
• ui: allow navigating between images with arrows in preview dialog (#5669) (104d2ec)
• user: add per-user tag metadata settings (#5735) (330291d)
• web: add demo mode banner (#5836) (35504cc)
• webhook: dispatch webhook on memo comment creation (7c1defb)

Bug Fixes

• access token refresh on web app (#5681) (3010f10)
• add unix socket file permission setting (755 -> 660) (#5849) (0fc1dab)
• api: appease image size lint (ff6389a)
• api: improve SSE hub design and fix double-broadcast on comments (c53677f)
• api: make credentials write-only and restrict sensitive settings to admins (9d3a74b)
• api: reduce memory pressure in backend paths (c456637)
• api: remove public activity service (#5734) (04f239a)
• api: restrict user email exposure to self and admins (#5784) (a24d420)
• api: switch user resource names to usernames (#5779) (acddef1)
• api: tolerate missing related users in memo conversions (#5809) (25feef3)
• auth: recover session via refresh cookie when localStorage is empty (#5748) (551ee1d)
• backend tests action (065e817)
• clear content search filter when selecting shortcut (#5499) (2c3f9e3)
• correct typos in comments, error messages, and identifiers (#5704) (8f43e80)
• detect legacy installations with empty schema version (9628d3d)
• editor: show newly linked memos when editing a memo with attachments (026ea92)
• ensure comment divs span full width in MemoDetail (ce44164)
• fileserver: render SVG attachment previews (40fd700)
• filter: enforce CEL syntax semantics (0e89407)
• frontend: restore sitemap and robots routes (fee7fcd)
• handle chunk load errors after redeployment with auto-reload (#5703) (bdd3554)
• harden memo content iframe and HTML sanitization (7e21b72)
• hide transcribe button without AI provider (ab53329)
• improve image preview dialog and live photo trigger (aafcc21)
• improve installer compatibility and docs (f90d9a4)
• improve KaTeX and Mermaid error handling and overflow (6b37fcc)
• include plain URLs and tags in memo snippet generation (#5688) (3d4f793)
• lint: correct goimports struct literal alignment after removing write-only credential fields (#5794) (9610ed8)
• map: align dark mode map styling (7ac9989)
• map: refine Leaflet controls and memo map styling (894b3eb)
• markdown: support height/width attributes on img elements (737acbb)
• memo-editor: scope Cmd+Enter save to the active editor (#5745) (05810e7)
• mysql: handle CreateMemo custom timestamps with FROM_UNIXTIME (#5673) (09d73e8)
• normalize attachment MIME types before validation (c3e7e2c)
• preserve draft content when tab is suspended or editor remounts (9ca7122)
• prevent local attachment uploads from overwriting files (4add9b0)
• prevent stale comment drafts from being restored (e520b63)
• remove duplicate Japanese locale keys (efeb28c)
• render audio attachments as inline players (#5699) (2ccb98a)
• restrict archived memo access to creator only (#5707) (f4154d0)
• routing: redirect unauthenticated users to /explore when public visibility is allowed (98859eb)
• server: close SSE clients during shutdown (a5ddd5a)
• sync html lang attribute with active locale (#5753) (be00abe)
• tag parsing truncates emojis with variation selectors (#5496) (3ea6ea3)
• tags: allow blur-only tag metadata (#5800) (1921b57)
• toggle focus mode do not reset editor height (#5504) (0729779)
• ui: show comment editor above the comment list (#5662) (6b0736b)
• ui: unify metadata component styles across MemoView and MemoEditor (664b8c5)
• unify live photo previews around LIVE badge playback (6b0487d)
• webhooks: trigger memo updates for attachment and relation changes (#5795) (acbc914)
• web: prevent MemoContent prop leaks (22519b5)
• web: refine attachment media layout (a0d83e1)
• web: refresh memo detail cache after editor save (333c9df)
• web: use BroadcastChannel to sync token refreshes across tabs (bbdc998)

Performance Improvements

• batch load memo relations when listing memos (#5692) (1e82714)

Features

• add --allow-private-webhooks flag to bypass SSRF protection (#5694) (cd5816c)
• add blur_content attribute to tag metadata settings (#5767) (45b2153)
• add Gemini transcription provider (#5830) (d87539a)
• add GitHub release installer and release workflow (1ed542c)
• add live refresh via Server-Sent Events (SSE) with visual indicator (#5638) (ea0892a)
• add MCP server with PAT authentication (47d9414)
• add outline navigation to memo detail sidebar (#5771) (6b30579)
• ai: add BYOK audio transcription (#5832) (101704c)
• ai: add instance AI providers and transcription (#5829) (83ed32f)
• attachments: add Live Photo and Motion Photo support (#5810) (4b4e719)
• cli: add version subcommand (#5731) (0ba4c0f)
• editor: add voice note recording to the memo composer (#5801) (c0d5854)
• extract title from first H1 heading into memo property (#5726) (1e688b2)
• i18n: update sse connect label in Chinese (#5732) (89c6902)
• instance: add canonical tag metadata setting (#5736) (65d14fb)
• instance: add notification transport setting (#5737) (a249d06)
• mcp: enhance MCP server with full capabilities and new tools (#5720) (b8e9ee2)
• mcp: harden tool exposure and side effects (#5850) (583c3d2)
• mcp: refactor MCP server to standard protocol structure (803d488)
• memo-editor: add compact live waveform recorder panel (#5817) (e51985a)
• memo-preview: support comment metadata in previews (#5768) (e176b28)
• memo: add image sharing in detail view (38fc22b)
• memo: add share links for private memos (#5742) (3f3133d)
• mentions: add memo mention parsing, notifications, and rendering (#5811) (24fc8ab)
• replace auto-increment ID with UID for identity provider resource names (#5687) (92d937b)
• show inline comment preview in list view (3a5d3c8)
• store: change default storage type to local filesystem (78efa68)
• treat tag setting keys as anchored regex patterns (#5759) (9e04049)
• ui: allow navigating between images with arrows in preview dialog (#5669) (104d2ec)
• user: add per-user tag metadata settings (#5735) (330291d)
• web: add demo mode banner (#5836) (35504cc)
• webhook: dispatch webhook on memo comment creation (7c1defb)

Bug Fixes

• access token refresh on web app (#5681) (3010f10)
• add unix socket file permission setting (755 -> 660) (#5849) (0fc1dab)
• api: appease image size lint (ff6389a)
• api: improve SSE hub design and fix double-broadcast on comments (c53677f)
• api: make credentials write-only and restrict sensitive settings to admins (9d3a74b)
• api: reduce memory pressure in backend paths (c456637)
• api: remove public activity service (#5734) (04f239a)
• api: restrict user email exposure to self and admins (#5784) (a24d420)
• api: switch user resource names to usernames (#5779) (acddef1)
• api: tolerate missing related users in memo conversions (#5809) (25feef3)
• auth: recover session via refresh cookie when localStorage is empty (#5748) (551ee1d)
• backend tests action (065e817)
• clear content search filter when selecting shortcut (#5499) (2c3f9e3)
• correct typos in comments, error messages, and identifiers (#5704) (8f43e80)
• detect legacy installations with empty schema version (9628d3d)
• editor: show newly linked memos when editing a memo with attachments (026ea92)
• ensure comment divs span full width in MemoDetail (ce44164)
• fileserver: render SVG attachment previews (40fd700)
• filter: enforce CEL syntax semantics (0e89407)
• frontend: restore sitemap and robots routes (fee7fcd)
• handle chunk load errors after redeployment with auto-reload (#5703) (bdd3554)
• harden memo content iframe and HTML sanitization (7e21b72)
• hide transcribe button without AI provider (ab53329)
• improve image preview dialog and live photo trigger (aafcc21)
• improve installer compatibility and docs (f90d9a4)
• improve KaTeX and Mermaid error handling and overflow (6b37fcc)
• include plain URLs and tags in memo snippet generation (#5688) (3d4f793)
• lint: correct goimports struct literal alignment after removing write-only credential fields (#5794) (9610ed8)
• map: align dark mode map styling (7ac9989)
• map: refine Leaflet controls and memo map styling (894b3eb)
• markdown: support height/width attributes on img elements (737acbb)
• memo-editor: scope Cmd+Enter save to the active editor (#5745) (05810e7)
• mysql: handle CreateMemo custom timestamps with FROM_UNIXTIME (#5673) (09d73e8)
• normalize attachment MIME types before validation (c3e7e2c)
• preserve draft content when tab is suspended or editor remounts (9ca7122)
• prevent local attachment uploads from overwriting files (4add9b0)
• prevent stale comment drafts from being restored (e520b63)
• remove duplicate Japanese locale keys (efeb28c)
• render audio attachments as inline players (#5699) (2ccb98a)
• restrict archived memo access to creator only (#5707) (f4154d0)
• routing: redirect unauthenticated users to /explore when public visibility is allowed (98859eb)
• server: close SSE clients during shutdown (a5ddd5a)
• sync html lang attribute with active locale (#5753) (be00abe)
• tag parsing truncates emojis with variation selectors (#5496) (3ea6ea3)
• tags: allow blur-only tag metadata (#5800) (1921b57)
• toggle focus mode do not reset editor height (#5504) (0729779)
• ui: show comment editor above the comment list (#5662) (6b0736b)
• ui: unify metadata component styles across MemoView and MemoEditor (664b8c5)
• unify live photo previews around LIVE badge playback (6b0487d)
• webhooks: trigger memo updates for attachment and relation changes (#5795) (acbc914)
• web: prevent MemoContent prop leaks (22519b5)
• web: refine attachment media layout (a0d83e1)
• web: refresh memo detail cache after editor save (333c9df)
• web: use BroadcastChannel to sync token refreshes across tabs (bbdc998)

Performance Improvements

• batch load memo relations when listing memos (#5692) (1e82714)

What's Changed

• Memo mentions @username are now supported.

• Voice recording is now supported.

• Live Photo and Motion Photo attachments are supported.

New Contributors

• @onwp made their first contribution in #5802

Full Changelog: v0.27.0-rc.1...v0.27.0-rc.2

What's Changed

• Embedded MCP server for AI clients.
  Memos now exposes an in-process MCP endpoint at /mcp using Streamable HTTP. It accepts PATs and exposes memo CRUD, comments, attachments, relations, reactions, tag listing, prompts, and memo resources for MCP-compatible clients.

• Live updates via Server-Sent Events.
  The web app now connects to /api/v1/sse, shows connection status in the user menu, and refreshes active memo views when memo, comment, and reaction events arrive. Follow-up fixes ensure comment creation no longer double-broadcasts and that attachment and relation changes emit memo.updated.

• Share links for memos, including protected and private use cases.
  Users can create and revoke memo share links from the memo detail sidebar, optionally with expiration. Shared memo access is handled through the memo detail route's share-token mode, and direct attachments on the shared memo can be fetched with that share token. Invalid, expired, or archived shares resolve as not found.

• Tag metadata became substantially more expressive.
  Instance-level tag metadata now supports background colors and blur_content, and the frontend resolves tag keys as anchored regex patterns. A single rule can now style or blur a family of tags instead of only exact matches.

• Auth, privacy, and admin-safety hardening.
  Session handling is more resilient through cross-tab token refresh synchronization and refresh-cookie recovery when local token state is empty. Protected memo access redirects to sign in, archived memos are creator-only, user emails are hidden from other regular users, and SMTP, S3, and OAuth credentials are now write-only with sensitive instance settings restricted to admins.

• Attachments, media, and frontend resilience improved.
  Local attachment uploads no longer overwrite existing files, audio attachments render inline, image previews support arrow-key navigation, markdown image height and width attributes are preserved, and chunk-load failures after redeploys trigger an automatic reload path.

• The public ActivityService was removed.
  Consumers should migrate to the user notification APIs instead of depending on the old public activity endpoints.

• User resource names now use usernames.
  API clients and scripts that assumed the old numeric-style user resource naming should be updated to use username-based names such as users/alice.

• Identity provider resource names now use stable UIDs.
  Integrations that persisted the previous identifier format should be reviewed before upgrading.

• The disallow_public_visibility setting was removed.

• New installs default attachment storage to local filesystem.
  Existing instances keep prior behavior through migration and should not silently change storage backend.

New Contributors

• @ztm0929 made their first contribution in #5663
• @mostapko made their first contribution in #5669
• @biplavbarua made their first contribution in #5468
• @bad-ash made their first contribution in #5496
• @thefatcode made their first contribution in #5499
• @lilonghe made their first contribution in #5504
• @memoclaw made their first contribution in #5683
• @peteretelej made their first contribution in #5681
• @google-labs-jules[bot] made their first contribution in #5747
• @fiatcode-gh made their first contribution in #5748
• @darkestni made their first contribution in #5738

Full Changelog: v0.26.2...v0.27.0-rc.1