v0.4.2

0.4.2 - 2026-09-05

Highlights: Private API sync now fails instead of reporting success when Granola data cannot be fetched, alongside safer snapshot imports and bounded API responses and retry waits.

• Preserve archived note bodies and fail sync when private API document batch hydration fails, instead of reporting a successful list-only archive. Thanks @SebTardif.
• Report private API transcript and panel fetch failures instead of recording incomplete syncs as successful; retain earlier writes for a later retry. Thanks @SebTardif.
• Reject absolute and parent-traversing snapshot shard paths through CrawlKit v0.14.9. Thanks @SebTardif.
• Cap private API response bodies at 64 MiB to prevent oversized responses from exhausting memory. Thanks @SebTardif.
• Cap public API rate-limit waits at 60 seconds, including oversized numeric and HTTP-date Retry-After headers, without overflowing the delay. Thanks @SebTardif.
• Bound release-check HTTP requests to 30 seconds so an unresponsive server cannot hang update checks indefinitely.
• Update Go to 1.27.1, SQLite to 3.53.4 through modernc.org/sqlite v1.58.0, terminal/runtime dependencies, GoReleaser, vulnerability/dead-code tooling, and TruffleHog secret scanning.