2.18.6
🐛 Bugs fixed Fix upload endpoints storing server files when the path points outside the temp dir #12771 (PR: #12772)
🐛 Bugs fixed Fix upload endpoints storing server files when the path points outside the temp dir #12771 (PR: #12772)
Rewrite sql:restore-storage-objects so referenced storage ids are collected as UUIDs first and then joined by primary key. The previous form cast storage_object.id to text and OR-ed that with id IN, which forced a scan of deleted storage rows and made restore-deleted-team- files time out in production. Closes #12727
🐛 Fix bad characters allowed on variants properties (#12688)
Merge remote-tracking branch 'origin/main' into staging
🐛 Update canvas and keep local sets when switching tokens source …
No changes for 2.18.5 according to CHANGES.md
The backport of docker/ from develop (2df5f41) also brought the subpath support from #12358 and its fix (95bc48a). It needs the Admin Console from 2.20, so with the current one every Admin Console URL fails. Restore the previous nginx configuration and docker-compose.yaml. AI-assisted-by: Claude Signed-off-by: David Barragán Merino david.barragan@kaleidos.net
🐛 Bugs fixed Fix storage GC deleting nothing when one pending object is still referenced #12276 (PR: #12269) Fix objects GC stopping file deletion when one file still has a child row #12277 (PR: #12269) Fix file restore leaving its storage objects marked for deletion #12278 (PR: #12269) Fix backend workers staying parked forever when nested calls take the same concurrency limits #12279 (PR: #12269…
⏪ Backport .github and docker/ changes from develop
Drop the legacy TOAST STORAGE EXTERNAL overrides set when PostgreSQL ran on ZFS with transparent compression. Migration 0156 restores the type default (SET STORAGE DEFAULT) on 62 columns across 21 tables; existing TOAST data keeps its strategy until rewritten. Raise the documented PostgreSQL floor to >=16, required by the new SET STORAGE DEFAULT syntax. AI-assisted-by: muse-spark-1.3-contributor
📎 Disable temporary the storage gc job from cron
✨ Count the application logs as a metric, by logger and leve…
📚 Update changelog
🐛 Bugs fixed Fix binfile import storing unsanitized SVG and missing obfuscated SVG content-types #12104 (PR: #12105) Fix removed team members keeping file access after leaving the team #12106 (PR: #12097)
🐛 Bugs fixed Fix workspace showing an internal error when syncing components or dragging in the color picker #11933 (PR: #11941) Fix SVG sanitizer keeping namespace-prefixed script elements when uploading SVG files #12071 (PR: #12073)
🐛 Bugs fixed Fix workspace freezing with a stack overflow when opening the context menu on a shape that isn't on the current page #11882 (PR: #11891) Fix workspace showing repeated error toasts when a third-party script injected into the page throws #11813 (PR: #11816) Fix register flow from workspace URL not working #11753 (PR: #11756) Fix empty response when exporting bin using API (by @filipsaj…
Merge remote-tracking branch 'origin/develop' into staging
Merge remote-tracking branch 'origin/main' into staging
🚀 Epics and highlights Group toolbar drawing tools into shape and free-draw flyouts #9316 (PR: #9480, #10354) Add dedicated Line and Arrow drawing tools (by @davidv399) #9145 (PR: #9146) Show and manage comments while designing in the workspace #10239 (PR: #10275) 🐛 Bugs fixed Fix MCP integration hanging when the Penpot tab is backgrounded or frozen by the browser #10323 (PR: #10392) Fix synced co…
Review assumed int? was 32-bit; it covers Long/Integer/Short/Byte. Note it in mem:clojure/idioms so the mistake is not repeated. AI-assisted-by: muse-spark-1.3-contributor
Merge remote-tracking branch 'origin/main' into staging
Rewrite sql:file-comment-users to join comment with comment_thread and union the requesting profile id, then join the resulting small id set against profile. The previous "id IN (subquery) OR id = ?" forced a sequential scan over the whole profile table with a hashed subplan filter, taking ~1.9s on large instances. The semi-join lets the planner use profile_pkey, dropping the query to sub-millisec…
💄 Adjust release notes 2.18 titles (#11608)
Added a new section for Penpot Enterprise detailing its features and benefits for organizations. Signed-off-by: Elenzakaleidos elena.scilinguo@kaleidos.net
During reload-renderer!, reloading? keeps initialized?/ready? false while set-objects runs (especially the sync path for small files). Text content used that guard and was skipped; geometry already used live?. Gate use-shape, has-shape, and set-shape-text-content on wasm/live? so text is restored with the rest of the shapes.
🐛 Bugs fixed Fix linear gradients in SVG text exports being emitted as radial gradients #5972 (PR: #11272) Fix typography token becoming detached when editing text content #11362 (PR: #11366) Fix command injection in SVG exporter via legacy fill-color (https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86)
🎉 Add repair functions for variant validation errors (#10768) (#…
🐛 Use gradient type instead of export type in SVG renderer data->gradient-def was comparing the render type parameter (:svg, :png, :pdf) against "linear" to decide between linearGradient and radialGradient elements. Since the export type is never "linear", the comparison always fell through to radialGradient, causing all linear gradients to be exported as radial in SVG output. Read the gradient ty…
🐛 Bugs fixed Fix overrides lost after switching component variant #10588 (PR: #10619) Fix malformed get-font-variants request when team-id is missing from dashboard URL #10644 (PR: #10645) Fix malformed get-profiles-for-file-comments request when file-id is missing from workspace URL #10652 (PR: #10655) Fix internal error when dragging inner layout with Boolean operations #10647 (PR: #10778) Fix f…
Merge remote-tracking branch 'origin/develop' into staging