Blog · 23 October 2026

Opensidian 0.8.0 is out

Opensidian 0.8.0 is out: download it here, and verify your download against the signed SHA256SUMS. It covers everything since 0.6.2 (0.7.0 was never published).

New: community plugins

• Plugin browser: Settings → Community plugins → Browse shows the community list, download stats and the latest releases. Install, update, enable and uninstall from there. Every installed file is pinned by sha256.
• Restricted mode by default: a vault starts in restricted mode and runs no plugin code, and a vault cannot turn its own plugins on. The trust switch is stored outside the vault, in ~/.opensidian.json.
• Trusted vaults get the desktop surface plugins expect from Obsidian: Node fs, child_process, network listeners, request/requestUrl and the system opener. Turning trust off unloads plugin code and closes all of it again.
• The top 10 community plugins work end to end: Templater, Dataview, Tasks, Excalidraw, Git, Calendar, Style Settings, Kanban, Advanced Tables and Copilot each install through the browser and pass a run through their main features in the UI. In a wider test run, 44 of 50 popular plugins load.
• Canvas core plugin: a .canvas view, built clean-room from the open JSON Canvas spec. Excalidraw embeds through it.
• Plugin API rebuilt clean-room against the public obsidian.d.ts: workspace, vault, metadata cache, editor, settings, suggests, embeds, views, hotkeys, custom CSS, protocol handlers, and pinned PDF.js, MathJax, Prism and moment for plugins that ask for them.

New: app

• Editor on CodeMirror 6: the note editor, Live Preview, undo/redo, scroll, outline and find now run on CodeMirror 6. Plugins that extend the editor get the editor's own CodeMirror instances; older plugins still find a CodeMirror 5 shim.
• Settings › Keychain: list, add, edit and delete this vault's secrets in the OS keyring (Secret Service). Plugins store secrets there too (app.secretStorage). There is no plaintext fallback, and values never reach the page or the logs.
• Settings › General shows the Opensidian and Plugin API version (1.14.4). Check for updates asks GitHub releases and verifies the release signature against a pinned ed25519 key. Automatic updates are off. Help opens opensidian.org.

Faster

• Opening a note (warm, worst of 5 runs): 40 ms, down from 103 ms. Styles are applied once and the font cache warms when idle.
• Graph: unchanged; it moves and settles as in 0.6.2.

Fixed

• Caret colour follows the theme, so it is no longer black on dark themes.
• Typing before a click: a key typed just before clicking lands at the caret, not at the click point.
• Reading view returns to your place again when an image above it loads late.
• Quick switcher: a note opened from it takes the keyboard, like Obsidian.
• Sidebar plugin views stay within the sidebar height instead of growing without end.

Security

• Plugin file access in trusted vaults is confined to the vault and refuses symlinks; a restricted vault exposes no file system access to plugins at all.
• Turning trust off drops unsafe-eval from the page's content security policy.
• Hardened HTML sanitizing and HTML-to-Markdown tag stripping (CodeQL findings).

Full changelog: GitHub release v0.8.0.