chore: bump github.com/usememos/memos from 0.27.1 to 0.29.0

[dependabot]

Bumps github.com/usememos/memos from 0.27.1 to 0.29.0.

Release notes

Sourced from github.com/usememos/memos's releases.

v0.29.0

This release adds richer link previews, notification email settings, shortcut and memo workflow improvements, and a set of security, media, and editor fixes. It also adds new instance statistics APIs and performance improvements for the initial screen.

New Features

Link Previews and Metadata

• Link metadata APIs - Memos now includes endpoints for fetching and batching metadata for links attached to memos.
• Rendered link cards - The web app can render metadata cards for shared links, making memo references easier to scan.
• DNS rebinding protection - Link metadata fetching now rejects DNS rebinding attempts.

Notification and Transcription Settings

• SMTP email settings - Instance notification settings now include SMTP email configuration.
• Email test endpoint - Admins can test notification email settings through the instance API.
• Explicit speech-to-text settings - Transcription settings now expose provider, model, and prompt configuration.

Memo and Workspace Improvements

• Task list quick actions - Memos with task lists now support faster task interactions.
• Calendar-aware memo creation - Creating a memo from the calendar uses the selected calendar date.
• Dedicated shortcuts page - Shortcut management is available from a dedicated page.
• About page and placeholder refresh - The app includes a refreshed about page and new placeholder states.

Administration and Statistics

• Instance resource statistics - Admin instance stats now include resource statistics.
• Filtered all-user stats - All-user statistics can be filtered for more focused administration views.
• Configurable log level - The server now accepts a --log-level flag.

Bug Fixes

• Attachment ownership enforcement - Memo updates now enforce attachment ownership.
• Comment visibility - Comments now respect parent memo visibility.
• User response privacy - User list responses omit internal settings.
• Memo creation events - Creating memos with attachments no longer emits an extra update event.
• Avatar sync - Profile avatar changes sync immediately after update.
• Release media handling - HDR image metadata is preserved in thumbnails, and motion media payloads are preserved through S3 presigned uploads.
• Editor and markdown polish - URL paste wrapping and task-list alignment are improved.
• Static cache and sitemap paths - Frontend static cache headers and public memo sitemap paths are corrected.
• SSE refresh behavior - Initial SSE responses stream correctly and refresh tokens are handled.

Performance Improvements

• Initial screen loading - Heavy first-screen dependencies are lazy loaded.

New Contributors

• @​Moustafaa91 made their first contribution in usememos/memos#5902
• @​wally-an made their first contribution in usememos/memos#5903

... (truncated)

Changelog

Sourced from github.com/usememos/memos's changelog.

0.29.0 (2026-05-27)

Features

• about: add about page with bird sprites (411ba7b)
• activity-calendar: aggregate by ViewContext.timeBasis (8daef1d)
• add <Placeholder> component with ASCII bird states (#5949) (8c16ffa)
• add configurable --log-level flag (#5934) (f1e2a06)
• add dedicated shortcuts page (#5942) (1df6479)
• add link metadata endpoints (9c5c604)
• frontend: add pixel bird tilemaps (cf55f11)
• memo: add task list quick actions (#5983) (648b3bd)
• memo: create memos on the selected calendar date (#5925) (ef55013)
• notification: add smtp email settings (cd4f28a)
• placeholder: add woodpecker tilemap (638e4f3)
• render link metadata cards (0bc5669)
• stats: admin instance resource statistics (ea0625d)
• stats: support filtered all-user stats (88ac3ec)
• transcription: explicit STT settings with provider, model, prompt (#5926) (238f27d)

Bug Fixes

• avoid update event on memo create attachments (#5961) (3c3382a)
• delete user cleanup (#5981) (e53b7d9)
• editor: wrap selected text when pasting URL (e0bb3a2)
• fileserver: preserve HDR image metadata in thumbnails (c724232)
• frontend: correct static cache headers (084f40b)
• frontend: use correct url path for memos in sitemap.xml (#5921) (603781f)
• httpgetter: prevent DNS rebinding in link metadata fetch (078488c)
• markdown: align list items with checkboxes (e008b1a)
• memo: enforce parent visibility for comments (4a1e401)
• s3presign: preserve motion media payload (7f1f53f)
• security: enforce attachment ownership on memo updates (35bf761)
• sse: stream initial response and refresh tokens (21303e8)
• user: omit internal settings from list responses (#5917) (1df3fe7)
• web: sync avatar changes immediately after profile update (#5903) (328396a)

Performance Improvements

• lazy load heavy first-screen dependencies (#5947) (a6024ee)

0.28.0 (2026-04-27)

Features

• auth: add SSO user identity linkage (#5883) (d688914)

... (truncated)

Commits

• f22c4bd chore(main): release 0.29.0 (#5909)
• e0bb3a2 fix(editor): wrap selected text when pasting URL
• 648b3bd feat(memo): add task list quick actions (#5983)
• e564c1a chore: update about page
• e53b7d9 fix: delete user cleanup (#5981)
• d1208a6 chore: update sponsors
• 3c3382a fix: avoid update event on memo create attachments (#5961)
• 858f741 chore(seed): tweak seed data
• 63d6431 chore: update images in README for dark mode
• ddcaf5f chore: fix coderabbit logo for light and dark theme (#5954)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #202.