[!NOTE] If you enjoyed this release, consider showing a token of appreciation by:
- Pressing the “Star” button on GitHub (top-right).
- Considering a one-time or recurrent donation to the lead developer via GitHub Sponsors or PayPal.
This release is the largest in Trilium's history, built around two big themes: security and interoperability. The attack surface has been dramatically reduced across the desktop app, the server, and shared notes — with 16 dedicated security fixes and a few deliberate breaking changes (backend scripting and the SQL console are now disabled by default), so please review the Breaking changes section before upgrading.
Getting notes in and out of Trilium is also much easier: new importers for OneNote, Notion, Google Keep, Anytype and Obsidian join a faster, more memory-efficient import/export pipeline and Spreadsheet now has XLSX and CSV import & export.
On top of that come a redesigned setup and login experience, better AI integration (including being able to use your Claude Code subscription), richer text editing (multi-state TODO lists, collapsible blocks, link previews), dashboard collections, and a huge wave of polish — roughly 86 bugfixes and 68 smaller improvements touching nearly every corner of the app. The sections below have the full details.
💡 Key highlights
- Setup was redesigned from scratch to be more modern (see details below).
- The LLM integration can now use your Claude Code subscription, without the need of an API key or additional cost.
- Text notes: Customizable multi-state TODO lists by @adoriandoran
- Collapsible blocks by @adoriandoran
- Link previews by @stexz01, @eliandoran and @adoriandoran
- Toggle List (aka Accordion) by @adoriandoran
- Text notes: Collapsible bullets
- Spreadsheet gains XLSX and CSV import & export
- A new experimental Dashboard collection.
- Auto theme switching for code blocks and code notes
- Autocompletion (e.g. Intellisense) for Frontend & Backend code notes
- Significant hardening of the desktop and server app by @perfectra1n and @eliandoran.
- A new import mechanism allows importing from multiple applications: OneNote notebooks using the cloud API, Notion, Google Keep, Anytype, Obsidian
- Significant improvements to the import/export process 1. Use a better buffering system so that the memory consumption never increases proportionally to the number of notes exported. 2. Display the progress of import/export. 3. Use a native mechanism on desktop so that the files being imported are not copied in memory. 4. Server now uses the disk to store imported files, reducing memory pressure. 5. Improved compression time by skipping already compressed files. 6. Improved import performance.
- Significant improvements to the LLM UI by @adoriandoran: Quote content, save AI responses as subnote, regenerate responses, delete & rename chats, printing, note-tooltip, scroll-to-bottom & performance tweaks.
🚨 Breaking changes
- Backend scripting is now disabled by default.
- If you make use of these scripts, see the documentation (
config.inichange for server or desktop settings). - The goal of this change is to strengthen Trilium's security posture since backend scripts have dangerously powerful levels of access (e.g. full FS access). Front-end scripts are unaffected.
- If you make use of these scripts, see the documentation (
- SQL console access is disabled by default.
- Similar to backend scripting, it can be reactivated from
config.ini.
- Similar to backend scripting, it can be reactivated from
- The desktop application (based on Electron) has been hardened against potential RCE attacks. You might have to adapt your scripts if you have front-end scripts that depend on Electron remote or the Node.js integration.
- The desktop application now no longer opens its port on the local network by default.
- This can generally affect you only if you are using ETAPI or desktop-to-desktop sync with your desktop client (servers are unaffected).
- This option can be changed in Options → Security.
- OPML v1 export was dropped from this release, v2 which preserves basic formatting has been kept instead. The v1 is still supported for import.
🐞 Bugfixes
This release lands roughly 86 bugfixes, with a strong focus on data integrity: several issues that could overwrite note content, corrupt the database during ZIP import, or leave sync in an inconsistent state have been resolved. The remainder is steady polish across the text editor, spreadsheets, Markdown import/export, canvas notes, sharing, authentication and mobile.
✨ Improvements
Beyond the headline features, 68 smaller improvements round off nearly every corner of the app. Several are worth calling out: pinned tabs and a reworked tab bar, a right sidebar toggle handle with peek mode, and options that now open in a modal by default instead of a new tab — changes you'll notice within minutes of upgrading. Media notes get a proper treatment too, with a new gallery-style image viewer (zoom, keyboard navigation) and an overhauled media player (previous/next, play modes, Media Session API integration), while Include note now renders collections, web views and saved searches interactively, and canvas notes can embed other notes and store images as attachments.
Markdown continues to become a first-class citizen: you can now convert text notes to Markdown and back, with snippets, code-block language autocompletion and cleaner "Copy as Markdown" output. The settings screens follow the setup redesign — the keyboard shortcuts section was rebuilt around a key recorder with conflict detection, and multi-factor authentication moved into Password & auth with QR generation and TOTP validation. The rest is steady polish: the LLM assistant became noticeably smarter and smoother; spreadsheets, the backend log and the import/export dialogs all received meaningful upgrades; and the desktop app gained conveniences like tray hiding and start-on-login.
🌍 Internationalization
- Reach 100% coverage for Romanian.
- Added Indonesian.
📖 Documentation
- Clarify Script API context (
startNote,currentNote,originEntity). - Documented some missing labels and relations.
- Documented
colorattribute. - Some links (to hidden notes or options pages) were broken.
- Documented the note title.
- Documented new features.
🛠️ Technical updates
- Remove unnecessary boxicon assets.
- Cleaned up a few dependencies.
- Complete architectural change to allow for a new deployment mechanism: standalone mode.
- Many dependency updates.
- Opt-in to disable automatic DB migration by @contributor
- Disable background effects while dev tools is attached to the same window
- Improved the loading time of the client by lazy loading libraries and dialogs
- Improved the loading time of the desktop slightly by loading the server at the same time as Electron starts.
🔒️ Security fixes
Security is a central theme of this release: 16 fixes systematically shrink Trilium's attack surface. Content is now sanitized on every path (HTML, SVG, collections, shared notes), injection vectors (SQL, path traversal, SSRF) have been hardened, sessions and cookies tightened, and the Electron desktop app locked down with strict permission, navigation and session-isolation policies. These fixes go hand in hand with the deliberate breaking changes above — together they make the default configuration significantly safer.