Plainpad 1.2.0-beta.1 — Feature Set Locked

Sep 7, 2026

Plainpad 1.2.0-beta.1 is available for testing. Nothing new was added since 1.2.0-alpha.1 — the feature set for 1.2.0 is now locked, and the remaining work before a stable release is testing and bug fixing.

This is a beta release. It’s more stable than the alpha, but still not meant for production instances. Back up your database before trying it.

What Changed Since the Alpha

Pinned notes go first in quick search

Quick search sorted pinned notes to the bottom of the result list, which is the opposite of what pinning is for. Pinned notes now appear at the top of the results, with the rest sorted by last modified.

Dependency updates

Client and server dependencies were refreshed, including league/commonmark, guzzlehttp/guzzle, browserslist, fast-uri, nanoid and postcss-selector-parser.

Recap of the 1.2.0 Feature Set

If you skipped the alpha, this is what 1.2.0 brings:

• Quick search — press Ctrl + K (or Cmd + K on macOS) anywhere in the app to get a spotlight overlay. Type to filter your notes, and if nothing matches, Plainpad offers to create a note from your keyword.
• Menus remember their state — the sidebar and aside menu keep their open or closed state between sessions.
• Demo data seeder — a DemoSeeder fills the database with realistic notes for evaluation, development and demo instances.
• Security fixes — login rate limiting on POST /v1/sessions, password reset expiry and lockout fixes, setup.php blocked after install, and TLS verification enforced in the auto update service.
• Development stack — the Docker stack starts the CRA dev server automatically and skips installs when dependencies are already present. The nginx client_max_body_size limit was raised.

The alpha announcement covers all of these in detail.

Trying It Out

Grab the beta from GitHub:

• Plainpad 1.2.0-beta.1 release notes

Install it on a test instance rather than upgrading a live one — see the Installation guide for the steps. If something breaks, please open an issue with your PHP version and how to reproduce it. Suspected security issues should go through the channels on the Support page instead of a public issue.

Bug reports on this beta are what decide how quickly 1.2.0 ships as stable. Thanks to everyone testing it.