chore(release): publish

- @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected].7

.github/workflows/desktop.build.manual.yml

@@ -1,19 +0,0 @@
-name: Desktop Manual Build
-
-on:
-  workflow_dispatch:
-    inputs:
-      platform:
-        description: Platform to build
-        required: true
-        type: choice
-        options:
-          - mac
-          - linux
-          - windows
-
-jobs:
-  build:
-    uses: ./.github/workflows/desktop.build.reuse.yml
-    with:
-      platform: ${{ inputs.platform }}

.github/workflows/desktop.build.reuse.yml

@@ -1,254 +0,0 @@
-name: Desktop Reusable Manual Build Workflow
-
-on:
-  workflow_call:
-    inputs:
-      platform:
-        required: true
-        type: string
-
-jobs:
-  Mac:
-    if: inputs.platform == 'mac'
-    runs-on: macos-latest
-    env:
-      CSC_IDENTITY_AUTO_DISCOVERY: false
-    defaults:
-      run:
-        working-directory: packages/desktop
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          node-version-file: '.nvmrc'
-          cache: 'yarn'
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-      - run: yarn install --immutable
-      - name: Rebuild Electron Native Modules
-        run: yarn workspace @standardnotes/desktop rebuild:home-server
-      - run: yarn build:desktop
-      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
-      - name: Compile Mac
-        run: yarn run webpack --config desktop.webpack.prod.js
-      - name: MacX64
-        run: |
-          yarn run electron-builder --mac --x64 --publish=never --config electron-builder.unsigned.cjs --c.extraMetadata.version=${{ env.APP_VERSION }}
-          node scripts/fixMacZip.js ${{ env.APP_VERSION }}
-      - name: MacArm64
-        run: yarn run electron-builder --mac --arm64 --publish=never --config electron-builder.unsigned.cjs --c.extraMetadata.version=${{ env.APP_VERSION }}
-      - name: Upload
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist-macos
-          retention-days: 7
-          path: |
-            packages/desktop/dist/*.dmg
-            packages/desktop/dist/*.zip
-            packages/desktop/dist/*.blockmap
-            packages/desktop/dist/*.yml
-            packages/desktop/dist/*.yaml
-
-  Linux-AppImage-X64:
-    name: Linux AppImage X64
-    if: inputs.platform == 'linux'
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: packages/desktop
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          node-version-file: '.nvmrc'
-          cache: 'yarn'
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-      - name: Install FPM
-        run: sudo gem install fpm -f
-      - run: yarn install --immutable
-      - name: Rebuild Electron Native Modules
-        run: yarn workspace @standardnotes/desktop rebuild:home-server
-      - run: yarn build:desktop
-      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
-      - name: Compile for AppImage
-        run: yarn run webpack --config desktop.webpack.prod.js
-      - name: AppImageX64
-        run: yarn run electron-builder --linux --x64 -c.linux.target=AppImage --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
-      - name: Upload
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist-linux-appimage-x64
-          retention-days: 7
-          path: |
-            packages/desktop/dist/*.AppImage
-            packages/desktop/dist/*.yml
-            packages/desktop/dist/*.yaml
-
-  Linux-AppImage-ARM64:
-    name: Linux AppImage ARM64
-    if: inputs.platform == 'linux'
-    runs-on: ubuntu-24.04-arm
-    defaults:
-      run:
-        working-directory: packages/desktop
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          node-version-file: '.nvmrc'
-          cache: 'yarn'
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-      - name: Install FPM
-        run: sudo gem install fpm -f
-      - run: yarn install --immutable
-      - name: Rebuild Electron Native Modules
-        run: yarn workspace @standardnotes/desktop rebuild:home-server
-      - run: yarn build:desktop
-      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
-      - name: Compile for AppImage
-        run: yarn run webpack --config desktop.webpack.prod.js
-      - name: AppImageArm64
-        run: yarn run electron-builder --linux --arm64 -c.linux.target=AppImage --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
-      - name: Upload
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist-linux-appimage-arm64
-          retention-days: 7
-          path: |
-            packages/desktop/dist/*.AppImage
-            packages/desktop/dist/*.yml
-            packages/desktop/dist/*.yaml
-
-  Linux-Deb-X64:
-    name: Linux Deb X64
-    if: inputs.platform == 'linux'
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: packages/desktop
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          node-version-file: '.nvmrc'
-          cache: 'yarn'
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-      - name: Install FPM
-        run: sudo gem install fpm -f
-      - run: yarn install --immutable
-      - name: Rebuild Electron Native Modules
-        run: yarn workspace @standardnotes/desktop rebuild:home-server
-      - run: yarn build:desktop
-      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
-      - name: Deb
-        run: |
-          yarn run webpack --config desktop.webpack.prod.js --env deb
-          yarn run electron-builder --linux --x64 -c.linux.target=deb --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
-      - name: Upload
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist-linux-deb-x64
-          retention-days: 7
-          path: |
-            packages/desktop/dist/*.deb
-            packages/desktop/dist/*.yml
-            packages/desktop/dist/*.yaml
-
-  Linux-Deb-ARM64:
-    name: Linux Deb ARM64
-    if: inputs.platform == 'linux'
-    runs-on: ubuntu-24.04-arm
-    defaults:
-      run:
-        working-directory: packages/desktop
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          node-version-file: '.nvmrc'
-          cache: 'yarn'
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-      - name: Install FPM
-        run: sudo gem install fpm -f
-      - run: yarn install --immutable
-      - name: Rebuild Electron Native Modules
-        run: yarn workspace @standardnotes/desktop rebuild:home-server
-      - run: yarn build:desktop
-      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
-      - name: DebArm64
-        env:
-          USE_SYSTEM_FPM: 'true'
-        run: |
-          yarn run webpack --config desktop.webpack.prod.js --env deb
-          yarn run electron-builder --linux --arm64 -c.linux.target=deb --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
-      - name: Upload
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist-linux-deb-arm64
-          retention-days: 7
-          path: |
-            packages/desktop/dist/*.deb
-            packages/desktop/dist/*.yml
-            packages/desktop/dist/*.yaml
-
-  Windows:
-    name: Windows
-    if: inputs.platform == 'windows'
-    runs-on: windows-latest
-    env:
-      NODE_OPTIONS: --max-old-space-size=8192
-      CSC_IDENTITY_AUTO_DISCOVERY: false
-    defaults:
-      run:
-        working-directory: packages/desktop
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          node-version-file: '.nvmrc'
-          cache: 'yarn'
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-      - run: corepack enable
-      - run: yarn install --immutable
-      - run: yarn build:desktop
-      - name: Set app version
-        shell: bash
-        run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
-      - name: Compile
-        run: yarn run webpack --config desktop.webpack.prod.js
-      - name: Build Windows installers
-        shell: bash
-        run: yarn run electron-builder --windows --x64 --ia32 --publish=never --config electron-builder.unsigned.cjs --c.extraMetadata.version=$APP_VERSION
-      - name: Upload
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist-windows
-          retention-days: 7
-          path: |
-            packages/desktop/dist/*.exe
-            packages/desktop/dist/*.yml
-            packages/desktop/dist/*.yaml
-            packages/desktop/dist/*.blockmap

.github/workflows/mobile.release.closed-beta.yml

@@ -23,6 +23,9 @@ jobs:
         with:
           distribution: 'zulu'
           java-version: '17'
+      - name: Setup Android SDK
+        run: |
+          echo "y" | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "platforms;android-36" "build-tools;36.0.0"
       - name: Export version for closed beta
         run: |
           BASE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)

.github/workflows/mobile.release.prod.yml

@@ -21,6 +21,9 @@ jobs:
         with:
           distribution: 'zulu'
           java-version: '17'
+      - name: Setup Android SDK
+        run: |
+          echo "y" | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "platforms;android-36" "build-tools;36.0.0"
       - name: Export version from package.json
         run:
           echo "PACKAGE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)" >> $GITHUB_ENV

.github/workflows/snjs.pr.yml

@@ -79,7 +79,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run E2E test suite
-        uses: convictional/trigger-workflow-and-wait@master
+        uses: convictional/trigger-workflow-and-wait@224756e4cc7fa0b711a281193496319f816cd880 # master
         with:
           owner: standardnotes
           repo: server
@@ -97,7 +97,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run E2E vaults test suite
-        uses: convictional/trigger-workflow-and-wait@master
+        uses: convictional/trigger-workflow-and-wait@224756e4cc7fa0b711a281193496319f816cd880 # master
         with:
           owner: standardnotes
           repo: server

.github/workflows/web.release.prod.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Deploy static site to S3 bucket
         run: aws s3 sync packages/web/dist/ s3://app.standardnotes.com --delete
       - name: Invalidate CloudFront Cache
-        uses: chetan/invalidate-cloudfront-action@master
+        uses: chetan/invalidate-cloudfront-action@fce6f6f546fae2e9fe55f3bd1411063a908f2557 # master
         env:
           DISTRIBUTION: ${{ secrets.WEBAPP_CLOUDFRONT_COM_DISTRIBUTION_ID }}
           PATHS: '/*'
@@ -46,6 +46,6 @@ jobs:
 
     steps:
     - name: Run Discord Webhook
-      uses: johnnyhuy/actions-discord-git-webhook@main
+      uses: johnnyhuy/actions-discord-git-webhook@59b728b6b5cd1c18e4b462f4876d3a0d8e26f23a # main
       with:
         webhook_url: ${{ secrets.DISCORD_WEBHOOK_URL }}

packages/clipper/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.1.602](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-17)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
+## [1.1.601](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-16)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
+## [1.1.600](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-15)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
+## [1.1.599](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-07)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
+## [1.1.598](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-04)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
 ## [1.1.597](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-03)
 
 **Note:** Version bump only for package @standardnotes/clipper

packages/clipper/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@standardnotes/clipper",
   "description": "Web clipper browser extension for Standard Notes",
-  "version": "1.1.597",
+  "version": "1.1.602",
   "private": true,
   "scripts": {
     "build-mv2": "yarn clean && webpack --config ./webpack.config.prod.js",

packages/desktop/.eslintrc.js

@@ -5,7 +5,7 @@ module.exports = {
     project: './tsconfig.json',
     tsconfigRootDir: __dirname,
   },
-  ignorePatterns: ['**/*.spec.ts', '@types', 'node_modules', 'dist', 'electron-builder.unsigned.cjs'],
+  ignorePatterns: ['**/*.spec.ts', '@types', 'node_modules', 'dist'],
   rules: {
     'no-console': ['warn', { allow: ['warn', 'error'] }],
     '@typescript-eslint/no-var-requires': 'off',

packages/desktop/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.110.207](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-17)
+
+**Note:** Version bump only for package @standardnotes/desktop
+
+## [3.110.206](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-16)
+
+**Note:** Version bump only for package @standardnotes/desktop
+
+## [3.110.205](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-15)
+
+### Bug Fixes
+
+* Fixes potential tag path transversal in plaintext backups ([#3048](https://github.com/standardnotes/app/issues/3048)) ([cd90a59](https://github.com/standardnotes/app/commit/cd90a59559d8257065d0e022f7afc02fc78beb41))
+
+## [3.110.204](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-07)
+
+**Note:** Version bump only for package @standardnotes/desktop
+
+## [3.110.203](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-04)
+
+**Note:** Version bump only for package @standardnotes/desktop
+
 ## [3.110.202](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-03)
 
 **Note:** Version bump only for package @standardnotes/desktop

packages/desktop/app/javascripts/Main/FileBackups/FileBackupsManager.ts

@@ -319,7 +319,12 @@ export class FilesBackupManager implements FileBackupsDevice {
       const relativePath = forTag ?? ''
       const filenameWithSlashesEscaped = filename.replace(/\//g, '\u2215')
       const sanitizedFilename = sanitizeFileName(filenameWithSlashesEscaped)
-      const fileAbsolutePath = path.join(absolutePath, relativePath, sanitizedFilename)
+      const fileAbsolutePath = path.resolve(absolutePath, relativePath, sanitizedFilename)
+
+      if (!this.filesManager.isChildOfDir(path.resolve(absolutePath), fileAbsolutePath)) {
+        throw new Error(`Plaintext backup path escapes backup directory: ${forTag}`)
+      }
+
       await this.filesManager.writeFile(fileAbsolutePath, data)
 
       const existingRecord = findMappingRecord(forTag)

packages/desktop/electron-builder.unsigned.cjs

@@ -1,13 +0,0 @@
-const packageJson = require('./package.json')
-
-module.exports = {
-  ...packageJson.build,
-  afterSign: null,
-  win: {
-    ...packageJson.build.win,
-    certificateSubjectName: null,
-    publisherName: null,
-    sign: null,
-    signDlls: false,
-  },
-}

packages/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@standardnotes/desktop",
   "main": "./app/dist/index.js",
-  "version": "3.110.202",
+  "version": "3.110.207",
   "license": "AGPL-3.0",
   "author": "Standard Notes.",
   "private": true,
@@ -69,7 +69,7 @@
     "ava": "^5.1.0",
     "babel-loader": "^9.1.0",
     "copy-webpack-plugin": "^11.0.0",
-    "electron-builder": "^24.9.1",
+    "electron-builder": "^26.15.7",
     "eslint": "*",
     "eslint-config-prettier": "^8.9.0",
     "eslint-plugin-import": "^2.26.0",
@@ -123,21 +123,14 @@
         "zip"
       ]
     },
-    "win": {
-      "certificateSubjectName": "Standard Notes Ltd.",
-      "publisherName": "Standard Notes Ltd.",
-      "signDlls": true,
-      "sign": "./scripts/windowsSign.js"
-    },
-    "nsis": {
-      "deleteAppDataOnUninstall": true
-    },
     "linux": {
       "category": "Office",
       "icon": "build/icon/",
       "executableName": "standard-notes",
       "desktop": {
-        "StartupWMClass": "standard notes"
+        "entry": {
+          "StartupWMClass": "standard notes"
+        }
       },
       "target": [
         "AppImage",

packages/encryption/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.21.118](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-15)
+
+### Bug Fixes
+
+* Ensures minimum encryption version when decrypting payload ([#3045](https://github.com/standardnotes/app/issues/3045)) ([e4e0f6f](https://github.com/standardnotes/app/commit/e4e0f6fd08e4edfdbbf996ad82e8bf65205f5c25))
+
 ## [1.21.117](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-03)
 
 **Note:** Version bump only for package @standardnotes/encryption

packages/encryption/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/encryption",
-  "version": "1.21.117",
+  "version": "1.21.118",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/encryption/src/Domain/Operator/OperatorWrapper.spec.ts

@@ -0,0 +1,129 @@
+import { ContentType } from '@standardnotes/domain-core'
+import { EncryptedPayloadInterface, ItemsKeyInterface, ProtocolVersion } from '@standardnotes/models'
+import { EncryptionOperatorsInterface } from './EncryptionOperatorsInterface'
+import { decryptPayload } from './OperatorWrapper'
+
+describe('decryptPayload', () => {
+  const createPayload = (version: ProtocolVersion): EncryptedPayloadInterface =>
+    ({
+      uuid: 'item-1',
+      version,
+      content: 'encrypted',
+      content_type: ContentType.TYPES.Note,
+      enc_item_key: 'enc-item-key',
+    }) as EncryptedPayloadInterface
+
+  const createKey = (keyVersion: ProtocolVersion): ItemsKeyInterface =>
+    ({
+      keyVersion,
+      itemsKey: 'key',
+    }) as ItemsKeyInterface
+
+  describe('version guard', () => {
+    it('rejects payloads claiming a protocol version below the items key version', async () => {
+      const payload = createPayload(ProtocolVersion.V001)
+      const key = createKey(ProtocolVersion.V004)
+
+      const operatorManager = {
+        operatorForVersion: jest.fn(),
+      } as unknown as EncryptionOperatorsInterface
+
+      const result = await decryptPayload(payload, key, operatorManager)
+
+      expect(result).toEqual({ uuid: 'item-1', errorDecrypting: true })
+      expect(operatorManager.operatorForVersion).not.toHaveBeenCalled()
+    })
+
+    it('proceeds when payload version equals items key version', async () => {
+      const payload = createPayload(ProtocolVersion.V004)
+      const key = createKey(ProtocolVersion.V004)
+      const syncOperator = {
+        generateDecryptedParameters: jest.fn().mockReturnValue({ uuid: 'item-1', content: {} }),
+      }
+      const operatorManager = {
+        operatorForVersion: jest.fn().mockReturnValue(syncOperator),
+      } as unknown as EncryptionOperatorsInterface
+
+      await decryptPayload(payload, key, operatorManager)
+
+      expect(operatorManager.operatorForVersion).toHaveBeenCalledWith(ProtocolVersion.V004)
+    })
+
+    it('proceeds when payload version is above items key version', async () => {
+      const payload = createPayload(ProtocolVersion.V004)
+      const key = createKey(ProtocolVersion.V003)
+      const syncOperator = {
+        generateDecryptedParameters: jest.fn().mockReturnValue({ uuid: 'item-1', content: {} }),
+      }
+      const operatorManager = {
+        operatorForVersion: jest.fn().mockReturnValue(syncOperator),
+      } as unknown as EncryptionOperatorsInterface
+
+      await decryptPayload(payload, key, operatorManager)
+
+      expect(operatorManager.operatorForVersion).toHaveBeenCalledWith(ProtocolVersion.V004)
+    })
+  })
+
+  describe('operator delegation', () => {
+    it('uses sync operator when operator is not async', async () => {
+      const payload = createPayload(ProtocolVersion.V004)
+      const key = createKey(ProtocolVersion.V004)
+      const decrypted = { uuid: 'item-1', content: { text: 'hello' } }
+      const syncOperator = {
+        generateDecryptedParameters: jest.fn().mockReturnValue(decrypted),
+      }
+      const operatorManager = {
+        operatorForVersion: jest.fn().mockReturnValue(syncOperator),
+      } as unknown as EncryptionOperatorsInterface
+
+      const result = await decryptPayload(payload, key, operatorManager)
+
+      expect(result).toEqual(decrypted)
+      expect(syncOperator.generateDecryptedParameters).toHaveBeenCalledWith(
+        expect.objectContaining({ uuid: 'item-1', version: ProtocolVersion.V004 }),
+        key,
+      )
+    })
+
+    it('uses async operator when operator is async', async () => {
+      const payload = createPayload(ProtocolVersion.V004)
+      const key = createKey(ProtocolVersion.V004)
+      const decrypted = { uuid: 'item-1', content: { text: 'hello' } }
+      const asyncOperator = {
+        generateEncryptedParametersAsync: jest.fn(),
+        generateDecryptedParametersAsync: jest.fn().mockResolvedValue(decrypted),
+      }
+      const operatorManager = {
+        operatorForVersion: jest.fn().mockReturnValue(asyncOperator),
+      } as unknown as EncryptionOperatorsInterface
+
+      const result = await decryptPayload(payload, key, operatorManager)
+
+      expect(result).toEqual(decrypted)
+      expect(asyncOperator.generateDecryptedParametersAsync).toHaveBeenCalledWith(
+        expect.objectContaining({ uuid: 'item-1', version: ProtocolVersion.V004 }),
+        key,
+      )
+    })
+
+    it('returns error when operator throws', async () => {
+      const payload = createPayload(ProtocolVersion.V004)
+      const key = createKey(ProtocolVersion.V004)
+      const syncOperator = {
+        generateDecryptedParameters: jest.fn().mockImplementation(() => {
+          throw new Error('decryption failed')
+        }),
+      }
+      const operatorManager = {
+        operatorForVersion: jest.fn().mockReturnValue(syncOperator),
+      } as unknown as EncryptionOperatorsInterface
+      const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
+
+      const result = await decryptPayload(payload, key, operatorManager)
+
+      expect(result).toEqual({ uuid: 'item-1', errorDecrypting: true })
+      consoleErrorSpy.mockRestore()
+    })
+  })
+})

packages/encryption/src/Domain/Operator/OperatorWrapper.ts

@@ -1,4 +1,5 @@
 import {
+  compareVersions,
   DecryptedPayloadInterface,
   ItemsKeyInterface,
   RootKeyInterface,
@@ -44,6 +45,13 @@ export async function decryptPayload<C extends ItemContent = ItemContent>(
   key: ItemsKeyInterface | KeySystemItemsKeyInterface | KeySystemRootKeyInterface | RootKeyInterface,
   operatorManager: EncryptionOperatorsInterface,
 ): Promise<DecryptedParameters<C> | ErrorDecryptingParameters> {
+  if (compareVersions(payload.version, key.keyVersion) < 0) {
+    return {
+      uuid: payload.uuid,
+      errorDecrypting: true,
+    }
+  }
+
   const operator = operatorManager.operatorForVersion(payload.version)
 
   try {

packages/filepicker/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.28.139](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-15)
+
+**Note:** Version bump only for package @standardnotes/filepicker
+
 ## [1.28.138](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-03)
 
 **Note:** Version bump only for package @standardnotes/filepicker

packages/filepicker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/filepicker",
-  "version": "1.28.138",
+  "version": "1.28.139",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/files/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.20.22](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-15)
+
+**Note:** Version bump only for package @standardnotes/files
+
 ## [1.20.21](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2026-09-03)
 
 **Note:** Version bump only for package @standardnotes/files