# v0.8.1

**Released:** 2026-07-25

Changes since v0.8.0 (`a1dca20`..merge of #125–#131). A security + robustness batch from @samirhvbr, integrated with additional hardening.

## Security

- **SSRF blocked in the external-image fetch** (PR #130 by @samirhvbr, hardened on integration): The "fetch an image URL → upload to S3" endpoint downloads a client-supplied URL server-side — a classic SSRF sink on a self-hosted box (LAN hosts, `localhost`, cloud metadata at `169.254.169.254`). A new `EgressPolicy` guard validates the scheme, resolves the host, rejects the request unless **every** resolved address is public, and pins the connection to the validated IP (closing the DNS-rebinding window). Integration added a **25 MB streamed size cap** (a hostile public URL could otherwise OOM the server) and **redirect following with per-hop re-validation** (each `Location` is re-checked, and legit CDN redirects work again).
- **Stored XSS blocked in the markdown preview** (PR #131 by @samirhvbr, hardened on integration): The preview rendered note HTML via `innerHTML`, so `<script>`, `onerror`, `javascript:` URLs, etc. executed. Rendered markdown is now sanitized with DOMPurify before injection, with a strict `<iframe>` allowlist that keeps YouTube/Vimeo embeds working. Integration added stripping of interactive form controls (`<form>`/`<input>`/`<button>`/…) so a note can't render a phishing form, plus tests for host-confusion bypasses (userinfo / subdomain / protocol-relative).

## Fixes

- **ImageMagick 7 compatibility** (PR #129 by @samirhvbr): detect and use the `magick` binary alongside the legacy `convert`/`mogrify`.

## Testing / Hygiene

- Stop `I18n.locale` leaking between tests (PR #128 by @samirhvbr).
- Make the base64-rejection specs immune to concurrent writes (PR #127 by @samirhvbr).

## Dependencies

- aws-sdk-s3 1.228.0 -> 1.228.1, simplecov 1.0.1 -> 1.0.2 (#125, #126).

## Test Coverage

- 749 Ruby tests, 1,463 JavaScript tests (2,212 total).