🐛 Bugs fixed Fix workspace freezing with a stack overflow when opening the context menu on a shape that isn't on the current page #11882 (PR: #11891) Fix workspace showing repeated error toasts when a third-party script injected into the page throws #11813 (PR: #11816) Fix register flow from workspace URL not working #11753 (PR: #11756) Fix empty response when exporting bin using API (by @filipsaj…
Merge remote-tracking branch 'origin/develop' into staging
Merge remote-tracking branch 'origin/main' into staging
🚀 Epics and highlights Group toolbar drawing tools into shape and free-draw flyouts #9316 (PR: #9480, #10354) Add dedicated Line and Arrow drawing tools (by @davidv399) #9145 (PR: #9146) Show and manage comments while designing in the workspace #10239 (PR: #10275) 🐛 Bugs fixed Fix MCP integration hanging when the Penpot tab is backgrounded or frozen by the browser #10323 (PR: #10392) Fix synced co…
Review assumed int? was 32-bit; it covers Long/Integer/Short/Byte. Note it in mem:clojure/idioms so the mistake is not repeated. AI-assisted-by: muse-spark-1.3-contributor
Merge remote-tracking branch 'origin/main' into staging
Rewrite sql:file-comment-users to join comment with comment_thread and union the requesting profile id, then join the resulting small id set against profile. The previous "id IN (subquery) OR id = ?" forced a sequential scan over the whole profile table with a hashed subplan filter, taking ~1.9s on large instances. The semi-join lets the planner use profile_pkey, dropping the query to sub-millisec…
💄 Adjust release notes 2.18 titles (#11608)
Added a new section for Penpot Enterprise detailing its features and benefits for organizations. Signed-off-by: Elenzakaleidos elena.scilinguo@kaleidos.net
During reload-renderer!, reloading? keeps initialized?/ready? false while set-objects runs (especially the sync path for small files). Text content used that guard and was skipped; geometry already used live?. Gate use-shape, has-shape, and set-shape-text-content on wasm/live? so text is restored with the rest of the shapes.
🐛 Bugs fixed Fix linear gradients in SVG text exports being emitted as radial gradients #5972 (PR: #11272) Fix typography token becoming detached when editing text content #11362 (PR: #11366) Fix command injection in SVG exporter via legacy fill-color (https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86)
🎉 Add repair functions for variant validation errors (#10768) (#…
🐛 Use gradient type instead of export type in SVG renderer data->gradient-def was comparing the render type parameter (:svg, :png, :pdf) against "linear" to decide between linearGradient and radialGradient elements. Since the export type is never "linear", the comparison always fell through to radialGradient, causing all linear gradients to be exported as radial in SVG output. Read the gradient ty…
🐛 Bugs fixed Fix overrides lost after switching component variant #10588 (PR: #10619) Fix malformed get-font-variants request when team-id is missing from dashboard URL #10644 (PR: #10645) Fix malformed get-profiles-for-file-comments request when file-id is missing from workspace URL #10652 (PR: #10655) Fix internal error when dragging inner layout with Boolean operations #10647 (PR: #10778) Fix f…
Merge remote-tracking branch 'origin/develop' into staging
Merge remote-tracking branch 'origin/staging'
🐛 Fix audit event validation for error reports with string profil…
🐛 Fix area selection aborted by select-shapes interrupt Only emit :interrupt from select-shapes when edition mode is active. Unconditional :interrupt (from #10798) made drag-stopper cancel the marquee mid-drag. 🔧 Fix text editor v2 fill e2e test on develop
Merge remote-tracking branch 'origin/staging'
Merge remote-tracking branch 'origin/staging'
🚀 Epics and highlights Render prototype viewer with WASM (Skia) engine instead of SVG #10037 (PR: #10038) ✨ New features & Enhancements Expose variants retrieval on LibraryComponent via isVariant() type guard in plugin API (by @opcode81) #9185 (PR: #9302) Add search bar to prototype interaction destination dropdown (by @EvaMarco) #8618 (PR: #9769) Add dashed stroke customization with dash and gap…
Merge remote-tracking branch 'origin/staging'
The webhook creation form used a hardcoded AWS instance metadata endpoint (http://169.254.169.254/...) as the default :uri value for new webhooks. This leaked an internal cloud credential endpoint into the UI defaults and could expose it to users. Remove the default :uri so new webhooks start with an empty URI instead of a sensitive hardcoded value.
Merge remote-tracking branch 'origin/staging'
Merge remote-tracking branch 'origin/main' into staging
Merge remote-tracking branch 'origin/staging'
🐛 Bugs fixed Fix error 500 when submitting the contact form #10178 (PR: #10419) Fix text editor modifying content and detaching applied typography tokens #10389 (PR: #10402)
If the smtp-default-from is something like "Penpot no-reply@penpot.app", the schema validation fails because it expects a simple email without < >
✨ New features & Enhancements Batch multiple thumbnail deletions into a single RPC call #9944 (PR: #9943) Add WebSocket proxy configuration for MCP in Nginx example (by @lancatlin) #10153 (PR: #10152) Add tenant prefix to MCP Redis channel names for multi-environment isolation #10277 (PR: #10276) Show MCP key on Integrations page and remove non-recoverable warning from modal #10290 (PR: #10298) Ad…
🔧 Add more tests for all cases and fix text token application in tests