Plainpad 1.2.0 Released - Quick Search, Safer Sync and Signed Updates

Oct 21, 2026

Plainpad 1.2.0 is out. It’s the stable release of everything tested in 1.2.0-alpha.1 and 1.2.0-beta.1, plus a long list of fixes that came out of testing the beta. Every administrator is encouraged to update - several of the fixes are security issues.

New in 1.2.0

• Quick search - press Ctrl + K (or Cmd + K on macOS) anywhere in the app to open a spotlight overlay. Type to filter your notes, pinned notes are listed first, and if nothing matches Plainpad offers to create a note from your keyword.
• Menus remember their state - the sidebar and aside menu keep their open or closed state between sessions.
• Demo data seeder - a DemoSeeder fills the database with realistic notes for evaluation, development and demo instances.

Signed Releases and Safer Auto Updates

Release archives are now signed with Ed25519. Starting with 1.2.0, the auto update service:

• refuses archives without a valid <archive>.sig signature (a backup key is accepted as well),
• refuses archives that are not the version the update server offers them as, which blocks rollbacks to older releases,
• rejects archives with entries outside the install directory,
• enforces TLS verification and trusted origins.

Failed updates now report as failed instead of success, interrupted updates stay retryable, and browsers no longer cache a stale index.html after an update. Update checks time out after a few seconds and are cached for an hour, so an unreachable update server no longer makes the app hang for admins.

Security Fixes

Login and sessions

• Login attempts on POST /v1/sessions are rate limited per account and per address, so one attacker can’t lock the account owner out (GHSA-qg7c-2q9c-v7hg).
• Login takes the same time for known and unknown emails.
• Existing sessions are revoked on a password change (except the current one) and on a password reset (GHSA-fx8g-533q-jp2w).
• Changing your own email or password requires the current password, and passwords must be at least 8 characters.
• The browser never stores the plain password and no longer re-sends it on every profile update.

Password reset

• Requesting a new reset token invalidates the previous one (GHSA-wgcw-8jm6-f847).
• Reset expiry and an account lockout through the token-based reset flow are fixed.
• The recovery email is sent after the response and mail errors are hidden, so neither reveals which emails are registered.

Setup

• setup.php is blocked after install, and the values it writes to .env are quoted and validated.
• Setup refuses to install into a database that already contains tables (it used to drop them all).
• A random application key is generated during setup instead of one derived from the install time.
• The application URL is built from the request host instead of the Origin header, and migrations run in process instead of through an HTTP request built from the Host header.

Headers and proxies

• The app sends headers that stop other sites from framing it (clickjacking).
• A new TRUSTED_PROXIES setting lets Plainpad see real client addresses behind a reverse proxy.

Admin

• The last admin can no longer be demoted, and two admins can’t remove each other at the same time.

Sync and Data Fixes

• Notes pinned or unpinned before their first sync are no longer deleted on the next sync.
• Logging in as another user in the same tab no longer shows the previous user’s notes. Local notes are removed on logout once they’re synced.
• One failing change no longer stops the rest from syncing, notes with empty content are allowed, and sync retries after repeated failures instead of stopping until a reload.
• The first sync fetches all notes in one request, so instances with a few hundred notes no longer hit the API rate limit.
• Editing an encrypted user from the users screen no longer makes their notes unreadable, and the encryption toggle runs in a transaction so a failure can’t leave notes partly encrypted.
• Fresh installs on an empty database no longer fail.

Smaller Fixes and Improvements

• Every API error is answered with JSON - invalid input returns a 422, a failed login says why, and another user’s note returns 404 instead of logging you out.
• A wrong password shows the login error instead of reloading the page.
• The note search accepts special characters like ( and [.
• Locale, view, line, sort and theme values are validated, so an invalid locale can no longer break every request of that user.
• Switching between notes scrolls back to the top.
• Profile saves, the note list and sorting are faster, with new database indexes for sessions and users.
• Missing password reset messages were added to the de-DE, fr-FR, sv-SE and zh-CN translations.
• The Docker dev stack starts the CRA dev server automatically, and the nginx client_max_body_size limit was raised.

How to Update

Grab the release from GitHub:

• Download Plainpad 1.2.0
• Plainpad 1.2.0 release notes

Back up your database first, then follow the Updating guide. If you run Plainpad with Docker, see the Docker documentation.

If something breaks, please open an issue with your PHP version and how to reproduce it. Suspected security issues should go through the channels on the Support page instead of a public issue.

Thanks to everyone who tested the alpha and beta - the bugs you reported shaped this release.