JavaGolangJavaScriptSwiftAndroidRustMiddleware
2 hours ago
penpot
penpot

2.18.0

🚀 Epics and highlights

  • Group toolbar drawing tools into shape and free-draw flyouts #9316 (PR: #9480, #10354)
  • Add dedicated Line and Arrow drawing tools (by @davidv399) #9145 (PR: #9146)
  • Show and manage comments while designing in the workspace #10239 (PR: #10275)

🐛 Bugs fixed

  • Fix MCP integration hanging when the Penpot tab is backgrounded or frozen by the browser #10323 (PR: #10392)
  • Fix synced component copy not reflowing children after spacing token update #9892
  • Fix spacebar activating pan mode while typing a comment (by @Krishcode264) #10285 (PR: #10287)
  • Fix plugin API rejecting negative letterSpacing values (by @filipsajdak) #9780 (PR: #10257)
  • Fix plugin API addTheme calls failing with the signature shown in the high-level overview #10074 (PR: #10359)
  • Fix empty text shape not being deleted on editor exit #10540 (PR: #10541)
  • Fix broken token pills showing wrong default state when not selected #10524 (PR: #10535)
  • Fix Chinese (zh-CN) translation showing wrong label for Intersection in board path menu (by @sawirricardo) #10346 (PR: #10381)
  • Fix invalid formulas being accepted in numeric inputs (by @AKnassa) #9581 (PR: #10659)
  • Fix radial gradient handles blowing up in size when rotated on ellipses (by @AKnassa) #10069 (PR: #10666)
  • Fix plugin API validation errors being too generic to diagnose the failure (by @AKnassa) #10072 (PR: #10667)
  • Fix crash with referential integrity error when deleting a component inside a grid (by @Alotor) #10101 (PR: #10956)
  • Fix component copies not preserving rotation when the main component has changes #10109 (PR: #10574)
  • Fix text width and height staying stale after setting growType in the plugin API #10207 (PR: #9898)
  • Fix padding not painted until expanding the 4-sides padding option #10278 (PR: #10602)
  • Fix files with custom fonts breaking with a referential integrity error when moved between teams (by @filipsajdak) #10496 (PR: #10837)
  • Fix clicking overlapping comment bubbles zooming to 20000% without showing the comments #10526 (PR: #10543)
  • Fix user menu subsections in the dashboard not closing when hovering away from the parent option (by @AKnassa) #10549 (PR: #10639)
  • Fix self-hosted env-generated config.js being cached for 7 days so PENPOT_FLAGS changes did not reach already-cached browsers (by @filipsajdak) #10556 (PR: #11146)
  • Fix color of selected text in light theme #10570 (PR: #10614)
  • Fix margin input order being inconsistent with padding inputs and between collapsed and expanded states #10578 (PR: #10797)
  • Fix uncaught DOMException when writing image/svg+xml content to the clipboard (by @AKnassa) #10596 (PR: #10663)
  • Fix tick icons not aligned in the font selector #10597 (PR: #10774)
  • Fix incorrect padding values when multiple shapes are selected #10598 (PR: #10602)
  • Fix integrity errors related to variants not being repaired #10606 (PR: #10768)
  • Fix changing password showing 'Password should be at least 8 characters' error on the old password field (by @AKnassa) #10626 (PR: #10661)
  • Fix stroke caps disappearing when dragging #10633 (PR: #10634)
  • Fix layout padding being saved as string after invalid input in multi-selection, causing persistence errors (by @niwinz) #10638 (PR: #10758)
  • Fix inconsistent theme handling between Penpot and plugins #10676 (PR: #10677)
  • Fix image stroke (strokeImage) support missing in the plugin API Stroke interface #10682 (PR: #10683)
  • Fix SVG images not working as fill in the WebGL renderer #10705 (PR: #10707)
  • Fix background blur not working on text shapes #10706 (PR: #10712)
  • Fix background blur not applying on strokes #10713 (PR: #10716)
  • Fix text shape with empty content breaking workspace updates #10725 (PR: #10731)
  • Fix missing SVG option in the file filters when adding an image fill (by @LuBoys) #10756 (PR: #10771)
  • Update onboarding image #10779 (PR: #10783)
  • Fix main toolbar overlapping the grid edition bar #10788 (PR: #10789)
  • Fix WASM renderer panic when the WebGL context is restored mid-reload #10810 (PR: #10824)
  • Fix nginx frontend forwarding the client Host header to backend/exporter, breaking Istio strict mTLS routing (by @yamila-moreno) #10835 (PR: #11233)
  • Fix tutorial templates with components causing errors #10839
  • Fix plugin 'Try out' flow crashing when projects have not loaded yet #10858 (PR: #10859)
  • Fix collapsed Fill color section on the design panel for new texts #10860 (PR: #10972)
  • Fix grid item date tooltip in the project view showing 'Will be deleted' instead of creation date (by @0xTHAC0) #10873 (PR: #11161)
  • Merge stop and start measurement shortcut to match current behavior #10884 (PR: #10906)
  • Fix shape size badge displayed twice when a user with Viewer permissions selects a shape #10893 (PR: #10985)
  • Fix main menu being covered by the toolbar #10902 (PR: #10926)
  • Fix font family typography asset persisting across files in newly created text layers #10925 (PR: #11134)
  • Fix error raised when editing justified text #10944 (PR: #10945)
  • Fix MCP WebSocket proxy failing after penpot-mcp container restarts due to stale nginx DNS resolution (by @780Farva) #10946 (PR: #10947)
  • Fix verification email address being unreadable due to low-contrast text on the register success page #10950 (PR: #10965)
  • Fix image swatches displaying a wrong format in the color picker list view #10951 (PR: #10975)
  • Fix text editor crashing when dropping dragged text after selecting all content #10954 (PR: #10959)
  • Fix MCP tokens being usable as API access tokens #10960 (PR: #10962)
  • Add size limit and rate limiting to the send-user-feedback endpoint #10979 (PR: #10990)
  • Fix main menu not keeping alignment when the left sidebar is expanded #10981 (PR: #10986)
  • Fix update-profile-props RPC method accepting undocumented keys #10991 (PR: #10992)
  • Fix import-binfile RPC method schema accepting a file-id parameter #10993 (PR: #10994)
  • Fix assemble-chunks session lookup ignoring the profile-id scope #11011 (PR: #11012)
  • Validate font-id team ownership in create-font-variant #11013 (PR: #11014)
  • Validate team ownership on file library link endpoints #11015 (PR: #11016)
  • Limit object size allocation in the V1 binfile parser #11017 (PR: #11018)
  • Limit recursion depth in the Fressian reader #11019 (PR: #11020)
  • Limit concurrent imports in the import-binfile RPC method #11023 (PR: #11024)
  • Validate content-type on management upload endpoints #11025 (PR: #11026)
  • Fix webhook endpoints allowing unauthorized access via creator-id fallback #11028 (PR: #11029)
  • Escape markdown in user-controlled fields of Mattermost error notifications #11033 (PR: #11034)
  • Enforce file read permission check on asset endpoints #11035 (PR: #11036)
  • Add accumulated storage byte quota for media uploads #11037 (PR: #11038)
  • Add bounding box dimension limit to exports #11041 (PR: #11042)
  • Sanitize embedded scripts in SVG uploads #11043 (PR: #11044)
  • Fix duplicate file ID returning inconsistent error responses #11045 (PR: #11050)
  • Enforce permission checks in WebSocket subscription handlers #11052 (PR: #11054)
  • Fix 'something went wrong' popup when using incremental numerical input interaction #11053 (PR: #10794)
  • Enforce password complexity validation on the backend #11055 (PR: #11059)
  • Normalize string inputs before processing #11060 (PR: #11061)
  • Add cooldown to avoid sending duplicate invitation emails #11062 (PR: #11063)
  • Enable SSRF protection for organization SSO validation #11064 (PR: #11065)
  • Fix LDAP authentication storing client-supplied email instead of directory email and not escaping filter special characters #11084 (PR: #11085)
  • Fix clone-file-media-object allowing to clone media objects from files without read access #11087 (PR: #11090)
  • Fix 404 error page logo not visible in dark mode #11091 (PR: #11167)
  • Fix incorrect permission handling when creating an invitation #11098 (PR: #11099)
  • Reject zero or negative total-chunks values in upload sessions #11103 (PR: #11104)
  • Fix import-binfile accepting unsupported version values without validation #11105 (PR: #11107)
  • Fix sessions remaining active on other devices after account deletion #11114 (PR: #11115)
  • Use random UUIDs for share link IDs instead of a predictable scheme #11116 (PR: #11117)
  • Fix plugin manifest fetch hanging indefinitely without timeout #11119 (PR: #11120)
  • Use constant-time comparison for shared key authentication #11121 (PR: #11122)
  • Fix ESC key not closing the comment input box after posting a comment in the workspace #11128 (PR: #11131)
  • Fix token edit modal crashing when resolving tokens with group nodes #11143 (PR: #11144)
  • Fix text editor crashing when pasting into an empty text shape #11149 (PR: #11150)
  • Fix comment avatars appearing on top of rulers when scrolling the canvas (by @filipsajdak) #11163 (PR: #11168)
  • Fix infinite loop of get-teams and get-team-members calls when granting team access from an email link #11215 (PR: #11223)
  • Fix RPC requests bypassing rate limiting with fractional bucket refill intervals #11253 (PR: #11254)
  • Fix tempfile bucket serving objects to any authenticated user instead of only the uploader #11269 (PR: #11270)
  • Fix increasing a value by clicking and dragging in a numeric input #11274 (PR: #11334)
  • Fix notification pill rendering unescaped HTML in the detail section when importing tokens #11276 (PR: #11275)
  • Fix share-link holders reading pages outside the authorized scope via the get-page RPC command #11281 (PR: #11284)
  • Fix incorrect permission handling when managing share links on a file #11289 (PR: #11290)
  • Fix backend session remaining valid after logout when the auth-token cookie is replayed #11316 (PR: #11317)
  • Fix get-team-invitation-token requiring only read permissions #11358 (PR: #11359)
  • Fix missing text in legacy SVG board thumbnails #10182 (PR: #11552)
  • Fix workspace crash when applying transform modifiers in the WASM renderer #10894 (PR: #10896)
  • Fix double-click on text bounding box entering edit mode instead of applying auto-width/auto-height with the WebGL renderer #10934 (PR: #11068)
  • Limit ZIP entry count and object size on V3 binfile import #11021 (PR: #11022)
  • Block plugin UI iframe URLs targeting the Penpot domain #11271 (PR: #11273)
  • Restrict the MCP REPL code execution endpoint to development environments #11283 (PR: #11282)
  • Filter share-link tokens from the get-view-only-bundle response #11285 (PR: #11286)
  • Fix HTTP error responses disclosing internal database and filesystem paths to API clients #11287 (PR: #11288)
  • Disable MCP developer tools in multi-user mode #11291 (PR: #11310)
  • Fix Hide comments setting being ignored after opening the Comments section #11308 (PR: #11492)
  • Block NAT64/6to4/Teredo IPv6 transition addresses in the SSRF guard #11319 (PR: #11320)
  • Prevent team admins from removing the team owner #11367 (PR: #11368)
  • Enforce share-link comment permissions and page scope #11370 (PR: #11371)
  • Clean up orphaned teams, projects and files on profile deletion #11394 (PR: #11395)
  • Use constant-time comparison for Management API shared key authentication #11426 (PR: #11534)
  • Fix crash when pressing Ctrl+D with no shape selected #11448 (PR: #11491)
  • Fix text layout not updating when auto-width is set by double-clicking the bounding box #11480 (PR: #11541)
  • Fix workspace crash with index out of bounds when removing multiple interactions rapidly #11546 (PR: #11621)
  • Fix workspace crash with 'too much recursion' error when editing grid layout #11562 (PR: #11563)
  • Fix plugin API error when removing interactions #11618 (PR: #11621)
  • Fix MCP REPL server starting in multi-user mode and inheriting the main server bind address #11631 (PR: #11632)
  • Fix chunked upload storing duplicate objects when the same chunk index is sent twice #11634 (PR: #11635)
  • Fix access token expiration select always showing Never after picking another option (by @chulgil) #11663 (PR: #11664)
  • Fix workspace dropping unsaved changes when read-only blocks persistence #11672 (PR: #11699)
  • Fix Plugin API failing silently when writing to an interaction the shape no longer has #11780 (PR: #11781)

✨ New features & Enhancements

  • Group toolbar drawing tools into shape and free-draw flyouts #9316 (PR: #9480, #10354)
  • Add outline stroke to Paths #9961 (PR: #8677)
  • Add dedicated Line and Arrow drawing tools (by @davidv399) #9145 (PR: #9146)
  • Refactor wasm rulers and UI state #10116 (PR: #10461)
  • Improve team invitations modal in the dashboard #10484 (PR: #10459)
  • Highlight the first matching font in the font list when searching (by @ai-mountain) #3204 (PR: #9512, #10450)
  • Preserve token references when copying and pasting properties instead of resolving them to values (by @AKnassa) #9582 (PR: #10665)
  • Add waitForLayoutUpdate method to the plugin API #10136 (PR: #9898)
  • Show and manage comments while designing in the workspace #10239 (PR: #10275)
  • Simplify MCP server configuration for common MCP clients #10355 (PR: #10604)
  • Remove misleading MCP client JSON snippet from the key-generated modal (by @Shlok1729) #10399 (PR: #10415)
  • Preview font families in the font selector #10403 (PR: #10411)
  • Remember expanded/collapsed state of token sets in the color tokens picker (session scope) #10551 (PR: #10864)
  • Show token sets in reverse order by default in the color tokens picker (by @rhinocap) #10552 (PR: #10658)
  • Add multi-selection and bulk delete support to pages in the workspace sitemap #10580 (PR: #10581)
  • Add a grid/list view toggle for files in the dashboard #10691 (PR: #10692)
  • Migrate Docker images to Docker Hardened Images (DHI) #10720 (PR: #10732, #10733, #10734)
  • Adopt React Aria #10802 (PR: #10675)
  • Add plugin API function for awaiting component updates beyond waitForLayoutUpdate #10927 (PR: #10964)
  • Emit open-workspace-file audit event with file statistics on workspace load #11106 (PR: #11138)
  • Restrict optional ids to v4, v7 and v8 UUIDs in creation RPC endpoints #11778 (PR: #11777)
6 hours ago
electron
electron

electron v44.4.5

Release Notes for v44.4.5

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. #54222
6 hours ago
electron
electron

electron v42.11.8

Release Notes for v42.11.8

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. #54223
6 hours ago
electron
electron

electron v43.7.5

Release Notes for v43.7.5

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. #54221
7 hours ago
electron
electron

electron v45.0.0-alpha.11

Note: This is an alpha release. Please file new issues for any bugs you find in it.

This release is published to npm under the alpha tag and can be installed via npm install electron@alpha, or npm install electron@45.0.0-alpha.11.

Release Notes for v45.0.0-alpha.11

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #54220
9 hours ago
rspack
web-infra-dev

v2.2.7

Highlights

Smaller bundles with improved code splitting

The new optimization.splitChunks.dedupDepth option lets Rspack spend more build time finding shared code and reducing duplication, giving you more control over the balance between bundle size and build time. In one application with many routes, this option reduced total output size by 9.9%.

It defaults to 1 in production and 0 in development. #15497

Build performance improvements

This release reduces repeated work and allocations during chunk graph construction and CSS Modules class name generation. JavaScript loaders also avoid copying their input content on each invocation, further reducing processing overhead.

  • Optimize chunk graph construction: #15278, #15805.
  • Reuse metadata and template values when generating CSS Modules class names: #15783, #15804.
  • Avoid cloning JavaScript loader content: #15817.

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

Document 📖

Other Changes

Full Changelog: https://github.com/web-infra-dev/rspack/compare/v2.2.6...v2.2.7

11 hours ago
next.js
vercel

v16.4.0-canary.39

Misc Changes

  • [PPF] Scaffold unstable_ensureStatic segment config: #98190
  • [agent-feedback] Respect CI and telemetry opt-out: #99062
  • Fix prefetch loop when a predicted route redirects: #98998
  • Fix dev overlay header layout on small screens: #99049
  • [PPF] Separate tracking of runtime data accesses for shells and prefetches: #98129
  • Harden next/og SVG serialization: #99061
  • test: clarify dev-only intent of duplicate Sass warning test: #98917
  • test: enable upward distDir deployment coverage: #98886
  • test: remove redundant deployment skips from mode-guarded suites: #98908
  • Turbopack: trace static project files referenced by packages: #98712
  • Durable use cache: fix next/image pulling in NEXT_DEPLOYMENT_ID: #98739
  • Unify hydration error tree details: #99008
  • Turbopack: forward module graph, entrypoint write, and emit spans to the JS trace: #98408
  • Fix startTime and shutdown delivery of forwarded Turbopack trace spans: #98426
  • Turbopack: loader change invalidation: #95732
  • perf: optimize CSS graph cycle removal: #98860
  • Use AGENTS.md for managed agent instructions: #99043
  • Turbopack: analyze mode tracing imports only: #98825
  • Turbopack: compact re-export registration: #98617
  • test: Add test for ESM and CJS exports of next/* APIs: #98882

Credits

Huge thanks to @lubieowoce, @aurorascharff, @acdlite, @eps1lon, @jamiboym, @sokra, and @mischnic for helping!

13 hours ago
vuetify
vuetifyjs

v3.13.5

🔧 Bug Fixes

  • correct focus resolution in Shadow DOM (d0c2129)

🧪 Labs

15 hours ago
react-three-fiber
pmndrs

v9.8.0

The headline feature is that R3F is now compatible with React 19.3.0. We don't fully support all of the new APIs, but it will not longer conflict to run the latest and greatest React.

In addition we fixed some long standing bugs:

  • React roots are configured synchronously and then gated on the renderer if it need async, for example with WebGPURenderer. This means that you won't get awkward out of sync issues.
  • Strict Mode no longer causes problems for our canvas. This was related to the async support added a while ago as well.

Have fun!

What's Changed

New Contributors

Full Changelog: https://github.com/pmndrs/react-three-fiber/compare/v9.7.0...v9.8.0

15 hours ago
astro
withastro

astro@7.3.4

Patch Changes

  • #18063 40896ac Thanks @adamchal! - Fixes incremental builds repeatedly rendering unchanged pages when modules or compiled CSS reference bundled assets.

  • #18053 cf5d72f Thanks @Princesseuh! - Improves the astro check error shown for TypeScript 7. The command now explains that TypeScript 7 is not currently supported and provides instructions for experimentally type-checking Astro files with TypeScript 7.1 and @astrojs/ts-content-mapper.

  • #18086 795a7e4 Thanks @ump45nose! - Fix double-escaped ampersands in Markdown image alt and title attributes. The __ASTRO_IMAGE_ round-trip now decodes the numeric (&) and named (&) character references the Markdown processors emit, so an & in an alt or title is escaped exactly once in the final HTML instead of twice.

  • #18074 0429805 Thanks @SurefireStudios! - Fix three error names that did not match their documented reference. MissingLocale, MissingIndexForInternationalization and NoManifestAvailable reported names ending in Error in the dev overlay, while their error reference pages are published under the unsuffixed names, so the name shown to users could not be found in the docs.

  • #18007 2245837 Thanks @L4XB! - Fixes the dev server re-evaluating the whole server module graph on every request. The astro:head-metadata plugin invalidated its component metadata virtual module from its own transform hook, so each evaluation of that module scheduled the next one. Adapters that run requests outside Vite's module runner, such as @astrojs/cloudflare, paid for a full re-evaluation of the server graph on every request for the lifetime of the process.

  • #18096 43657c4 Thanks @matthewp! - Fixes domain-based i18n routing to respect security.allowedDomains when selecting a locale from request host headers

  • #18043 8a53a8b Thanks @astro-factory! - Fixes image.responsiveStyles emitting invalid object-position CSS values for same-axis keyword pairs (top bottom, left right, etc.)

  • #18029 c08252d Thanks @matthewp! - Runs astro dev and astro preview in the foreground when an AI agent is detected on Windows, allowing the agent to manage the process lifetime. Pass --background explicitly to request an Astro-managed background process. Agent-inferred backgrounding remains enabled on other platforms.

  • Updated dependencies [3fd16ee, 8358d59]:

    • @astrojs/markdown-satteri@0.4.2