25.02.4

ankitects/anki25.02.4Apr 24, 2025by dae

AI Summary

A security-focused update addressing insufficient protections for shared decks and collection size limits during sync.

Key Highlights

  • Security: Strips JavaScript references from field content
  • Improved add-on compatibility
  • Collection size limit warnings during sync
  • Alternative approach for securing the editor

Breaking Changes

  • Add-ons such as Syntax Highlighting and Anki IPA are reported as incompatible

Full Release Notes

This is a security-focused update. If you use any shared decks, updating is strongly recommended.

25.02.1:

- The review screen had protections in place to prevent shared decks from accessing other data on your computer, but these proved to be insufficient. A big thank you to Michael Lappas for the report.
- JavaScript references such as onclick handlers are now stripped from field content when editing it. Most users are unlikely to see a change here, but it may result in breakages if you're using a shared deck that placed such content into individual fields against our recommendations.
- If your collection size is over the AnkiWeb limit, you'll now receive a message at the start of the sync, instead of the sync failing later.

25.02.4:

- Use an alternative approach for securing the editor, which should be less disruptive, and causes no permanent changes.
- Improve add-on compatibility (thanks in part to @glutanimate and @iamllama).
- Don't check collection size when syncing with a custom sync server.

The following add-ons have been reported as currently incompatible:

- Syntax Highlighting
- Anki IPA

If you run into issues with other add-ons, please let us know on the forums.