v1.1.0-alpha.3

Third public-review release. Builds on v1.1.0-alpha.2 with security hardening, a browser end-to-end test suite, and a deep static-analysis / tech-debt pass. No user-facing feature changes since alpha.2.

• Security hardening
  • Etherpad API key stored as sensitive app config (masked in occ/diagnostics instead of clear text).
  • External-pad framing now requires an explicit trusted-origin allowlist (no implicit CSP frame-src).
  • Snapshot HTML sanitised client-side with DOMPurify before rendering.
• Internal changes — Etherpad HTTP via Nextcloud's IClientService; shared pad-sync frontend module; MIME registration removed from the per-request Application constructor; legacy RetryPendingDeleteJob shim retired in favour of the tiered Hot/Warm/Cold jobs; dead-code removal.
• Tests & tooling — Playwright end-to-end suite (23 browser tests against live Nextcloud + Etherpad); Psalm static analysis enabled in CI with the baseline burned down to zero real type issues plus findUnusedCode; CI guards for stale js/ assets and version metadata consistency.

See CHANGELOG.md for the complete list of changes.

---

Not for production yet. This is a pre-release for testing and review.

v1.1.0-alpha.2

Second public-review release. Builds on v1.1.0-alpha.1 with cleaner translations, embed-create host signalling, and proper CI.

• Localisation rework — DE/ES/FR catalogs cleaned up and consistent (132/132 each, no orphans, alphabetically sorted). Renamed several English source strings for clarity (Test Etherpad connection instead of Health check, .pad file … instead of Pad file …, etc.). de_DE mirror and legacy *.php catalogs dropped — only *.json + *.js per locale now.

  Translation quality: DE has been reviewed end-to-end by a native speaker. ES and FR are first-pass translations (AI + school grammar) — usable baseline, but expected to get native-speaker polish via translatewiki once the project is onboarded.

• Embed-create result events — /embed/create-by-parent now postMessages epnc:create-succeeded / epnc:create-failed to its parent host so embedders can react to create outcomes.

• CI in place — PHPUnit on PHP 8.2/8.3/8.4, npm-build + vitest, info.xml schema lint. Dependabot configured for npm / composer / actions.

• Release tarball builder scripts/build-release-tarball.sh.

• App icon for the Apps page in NC settings (img/etherpad_nextcloud.svg).

See CHANGELOG.md for the complete list of changes.

---

Not for production yet. This is a pre-release for testing and review.

v1.1.0-alpha.1 — first reviewer-facing alpha

First reviewer-facing cut after the March 1.0.0 tag. Not for production yet — install on dev/staging only.

How to install

1. Download etherpad_nextcloud-1.1.0-alpha.1.tar.gz (asset below).
2. Extract into <nextcloud-root>/apps/ so the path is <nextcloud-root>/apps/etherpad_nextcloud/.
3. php occ app:enable etherpad_nextcloud
4. If .pad icons or actions don't show up: php occ maintenance:mimetype:update-js && php occ maintenance:mimetype:update-db
5. Open admin settings → Etherpad integration → set host + API key.

What's worth testing

• Create: + → New pad (with and without templates), edit, close. Check the file syncs back.
• Open: existing .pad files; protected and public access modes.
• Templates: drop a .pad in /Templates, pick it from + → New pad. Try the {{date}} / {{user}} placeholders.
• Public share: share a .pad via public link, open in an incognito tab.
• Trash / restore: trash a .pad, restore from NC's "Deleted files".
• Legacy Ownpad migration: drop an [InternetShortcut] .pad into your files, open it — should silently migrate. (See docs/legacy-ownpad-migration.md.)
• Embed integration: if you embed NC content from another origin, try /embed/by-id/{fileId} after configuring trusted_embed_origins.

Known cosmetic issues

• Two transient errors in the browser console on the very first + → New pad per session (one /core/preview 400 with fileId=-1, one Tiptap unmount warning). Both originate from NC's Files-app placeholder-rendering phase, not from this app. Tracked as a follow-up (#72).

Reporting issues

Please file a GitHub issue with:

• NC version + PHP version + Etherpad version
• What action triggered the issue
• Browser console output (if frontend) or nextcloud.log lines (if backend)

What's in 1.1.0-alpha.1

See the CHANGELOG entry for the full list. Highlights since 1.0.0:

• Pad templates with placeholder substitution
• Legacy Ownpad lazy auto-migration
• Trusted embed integration
• External integration APIs (from-template, from-url, create-by-parent, meta-by-id)
• Architecture cleanup (split PadController, extracted ExternalPadExportFetcher, etc.)
• Faster protected-pad open + closer-flush ack protocol