Penpot Files

:rocket: Epics and highlights

• Group toolbar drawing tools into shape and free-draw flyouts #9316 (PR: #9480, #10354)
• Add dedicated Line and Arrow drawing tools (by @davidv399) #9145 (PR: #9146)
• Show and manage comments while designing in the workspace #10239 (PR: #10275)

:bug: Bugs fixed

• Fix MCP integration hanging when the Penpot tab is backgrounded or frozen by the browser #10323 (PR: #10392)
• Fix synced component copy not reflowing children after spacing token update #9892
• Fix spacebar activating pan mode while typing a comment (by @Krishcode264) #10285 (PR: #10287)
• Fix plugin API rejecting negative letterSpacing values (by @filipsajdak) #9780 (PR: #10257)
• Fix plugin API addTheme calls failing with the signature shown in the high-level overview #10074 (PR: #10359)
• Fix empty text shape not being deleted on editor exit #10540 (PR: #10541)
• Fix broken token pills showing wrong default state when not selected #10524 (PR: #10535)
• Fix Chinese (zh-CN) translation showing wrong label for Intersection in board path menu (by @sawirricardo) #10346 (PR: #10381)
• Fix invalid formulas being accepted in numeric inputs (by @AKnassa) #9581 (PR: #10659)
• Fix radial gradient handles blowing up in size when rotated on ellipses (by @AKnassa) #10069 (PR: #10666)
• Fix plugin API validation errors being too generic to diagnose the failure (by @AKnassa) #10072 (PR: #10667)
• Fix crash with referential integrity error when deleting a component inside a grid (by @Alotor) #10101 (PR: #10956)
• Fix component copies not preserving rotation when the main component has changes #10109 (PR: #10574)
• Fix text width and height staying stale after setting growType in the plugin API #10207 (PR: #9898)
• Fix padding not painted until expanding the 4-sides padding option #10278 (PR: #10602)
• Fix files with custom fonts breaking with a referential integrity error when moved between teams (by @filipsajdak) #10496 (PR: #10837)
• Fix clicking overlapping comment bubbles zooming to 20000% without showing the comments #10526 (PR: #10543)
• Fix user menu subsections in the dashboard not closing when hovering away from the parent option (by @AKnassa) #10549 (PR: #10639)
• Fix self-hosted env-generated config.js being cached for 7 days so PENPOT_FLAGS changes did not reach already-cached browsers (by @filipsajdak) #10556 (PR: #11146)
• Fix color of selected text in light theme #10570 (PR: #10614)
• Fix margin input order being inconsistent with padding inputs and between collapsed and expanded states #10578 (PR: #10797)
• Fix uncaught DOMException when writing image/svg+xml content to the clipboard (by @AKnassa) #10596 (PR: #10663)
• Fix tick icons not aligned in the font selector #10597 (PR: #10774)
• Fix incorrect padding values when multiple shapes are selected #10598 (PR: #10602)
• Fix integrity errors related to variants not being repaired #10606 (PR: #10768)
• Fix changing password showing 'Password should be at least 8 characters' error on the old password field (by @AKnassa) #10626 (PR: #10661)
• Fix stroke caps disappearing when dragging #10633 (PR: #10634)
• Fix layout padding being saved as string after invalid input in multi-selection, causing persistence errors (by @niwinz) #10638 (PR: #10758)
• Fix inconsistent theme handling between Penpot and plugins #10676 (PR: #10677)
• Fix image stroke (strokeImage) support missing in the plugin API Stroke interface #10682 (PR: #10683)
• Fix SVG images not working as fill in the WebGL renderer #10705 (PR: #10707)
• Fix background blur not working on text shapes #10706 (PR: #10712)
• Fix background blur not applying on strokes #10713 (PR: #10716)
• Fix text shape with empty content breaking workspace updates #10725 (PR: #10731)
• Fix missing SVG option in the file filters when adding an image fill (by @LuBoys) #10756 (PR: #10771)
• Update onboarding image #10779 (PR: #10783)
• Fix main toolbar overlapping the grid edition bar #10788 (PR: #10789)
• Fix WASM renderer panic when the WebGL context is restored mid-reload #10810 (PR: #10824)
• Fix nginx frontend forwarding the client Host header to backend/exporter, breaking Istio strict mTLS routing (by @yamila-moreno) #10835 (PR: #11233)
• Fix tutorial templates with components causing errors #10839
• Fix plugin 'Try out' flow crashing when projects have not loaded yet #10858 (PR: #10859)
• Fix collapsed Fill color section on the design panel for new texts #10860 (PR: #10972)
• Fix grid item date tooltip in the project view showing 'Will be deleted' instead of creation date (by @0xTHAC0) #10873 (PR: #11161)
• Merge stop and start measurement shortcut to match current behavior #10884 (PR: #10906)
• Fix shape size badge displayed twice when a user with Viewer permissions selects a shape #10893 (PR: #10985)
• Fix main menu being covered by the toolbar #10902 (PR: #10926)
• Fix font family typography asset persisting across files in newly created text layers #10925 (PR: #11134)
• Fix error raised when editing justified text #10944 (PR: #10945)
• Fix MCP WebSocket proxy failing after penpot-mcp container restarts due to stale nginx DNS resolution (by @780Farva) #10946 (PR: #10947)
• Fix verification email address being unreadable due to low-contrast text on the register success page #10950 (PR: #10965)
• Fix image swatches displaying a wrong format in the color picker list view #10951 (PR: #10975)
• Fix text editor crashing when dropping dragged text after selecting all content #10954 (PR: #10959)
• Fix MCP tokens being usable as API access tokens #10960 (PR: #10962)
• Add size limit and rate limiting to the send-user-feedback endpoint #10979 (PR: #10990)
• Fix main menu not keeping alignment when the left sidebar is expanded #10981 (PR: #10986)
• Fix update-profile-props RPC method accepting undocumented keys #10991 (PR: #10992)
• Fix import-binfile RPC method schema accepting a file-id parameter #10993 (PR: #10994)
• Fix assemble-chunks session lookup ignoring the profile-id scope #11011 (PR: #11012)
• Validate font-id team ownership in create-font-variant #11013 (PR: #11014)
• Validate team ownership on file library link endpoints #11015 (PR: #11016)
• Limit object size allocation in the V1 binfile parser #11017 (PR: #11018)
• Limit recursion depth in the Fressian reader #11019 (PR: #11020)
• Limit concurrent imports in the import-binfile RPC method #11023 (PR: #11024)
• Validate content-type on management upload endpoints #11025 (PR: #11026)
• Fix webhook endpoints allowing unauthorized access via creator-id fallback #11028 (PR: #11029)
• Escape markdown in user-controlled fields of Mattermost error notifications #11033 (PR: #11034)
• Enforce file read permission check on asset endpoints #11035 (PR: #11036)
• Add accumulated storage byte quota for media uploads #11037 (PR: #11038)
• Add bounding box dimension limit to exports #11041 (PR: #11042)
• Sanitize embedded scripts in SVG uploads #11043 (PR: #11044)
• Fix duplicate file ID returning inconsistent error responses #11045 (PR: #11050)
• Enforce permission checks in WebSocket subscription handlers #11052 (PR: #11054)
• Fix 'something went wrong' popup when using incremental numerical input interaction #11053 (PR: #10794)
• Enforce password complexity validation on the backend #11055 (PR: #11059)
• Normalize string inputs before processing #11060 (PR: #11061)
• Add cooldown to avoid sending duplicate invitation emails #11062 (PR: #11063)
• Enable SSRF protection for organization SSO validation #11064 (PR: #11065)
• Fix LDAP authentication storing client-supplied email instead of directory email and not escaping filter special characters #11084 (PR: #11085)
• Fix clone-file-media-object allowing to clone media objects from files without read access #11087 (PR: #11090)
• Fix 404 error page logo not visible in dark mode #11091 (PR: #11167)
• Fix incorrect permission handling when creating an invitation #11098 (PR: #11099)
• Reject zero or negative total-chunks values in upload sessions #11103 (PR: #11104)
• Fix import-binfile accepting unsupported version values without validation #11105 (PR: #11107)
• Fix sessions remaining active on other devices after account deletion #11114 (PR: #11115)
• Use random UUIDs for share link IDs instead of a predictable scheme #11116 (PR: #11117)
• Fix plugin manifest fetch hanging indefinitely without timeout #11119 (PR: #11120)
• Use constant-time comparison for shared key authentication #11121 (PR: #11122)
• Fix ESC key not closing the comment input box after posting a comment in the workspace #11128 (PR: #11131)
• Fix token edit modal crashing when resolving tokens with group nodes #11143 (PR: #11144)
• Fix text editor crashing when pasting into an empty text shape #11149 (PR: #11150)
• Fix comment avatars appearing on top of rulers when scrolling the canvas (by @filipsajdak) #11163 (PR: #11168)
• Fix infinite loop of get-teams and get-team-members calls when granting team access from an email link #11215 (PR: #11223)
• Fix RPC requests bypassing rate limiting with fractional bucket refill intervals #11253 (PR: #11254)
• Fix tempfile bucket serving objects to any authenticated user instead of only the uploader #11269 (PR: #11270)
• Fix increasing a value by clicking and dragging in a numeric input #11274 (PR: #11334)
• Fix notification pill rendering unescaped HTML in the detail section when importing tokens #11276 (PR: #11275)
• Fix share-link holders reading pages outside the authorized scope via the get-page RPC command #11281 (PR: #11284)
• Fix incorrect permission handling when managing share links on a file #11289 (PR: #11290)
• Fix backend session remaining valid after logout when the auth-token cookie is replayed #11316 (PR: #11317)
• Fix get-team-invitation-token requiring only read permissions #11358 (PR: #11359)
• Fix missing text in legacy SVG board thumbnails #10182 (PR: #11552)
• Fix workspace crash when applying transform modifiers in the WASM renderer #10894 (PR: #10896)
• Fix double-click on text bounding box entering edit mode instead of applying auto-width/auto-height with the WebGL renderer #10934 (PR: #11068)
• Limit ZIP entry count and object size on V3 binfile import #11021 (PR: #11022)
• Block plugin UI iframe URLs targeting the Penpot domain #11271 (PR: #11273)
• Restrict the MCP REPL code execution endpoint to development environments #11283 (PR: #11282)
• Filter share-link tokens from the get-view-only-bundle response #11285 (PR: #11286)
• Fix HTTP error responses disclosing internal database and filesystem paths to API clients #11287 (PR: #11288)
• Disable MCP developer tools in multi-user mode #11291 (PR: #11310)
• Fix Hide comments setting being ignored after opening the Comments section #11308 (PR: #11492)
• Block NAT64/6to4/Teredo IPv6 transition addresses in the SSRF guard #11319 (PR: #11320)
• Prevent team admins from removing the team owner #11367 (PR: #11368)
• Enforce share-link comment permissions and page scope #11370 (PR: #11371)
• Clean up orphaned teams, projects and files on profile deletion #11394 (PR: #11395)
• Use constant-time comparison for Management API shared key authentication #11426 (PR: #11534)
• Fix crash when pressing Ctrl+D with no shape selected #11448 (PR: #11491)
• Fix text layout not updating when auto-width is set by double-clicking the bounding box #11480 (PR: #11541)
• Fix workspace crash with index out of bounds when removing multiple interactions rapidly #11546 (PR: #11621)
• Fix workspace crash with 'too much recursion' error when editing grid layout #11562 (PR: #11563)
• Fix plugin API error when removing interactions #11618 (PR: #11621)
• Fix MCP REPL server starting in multi-user mode and inheriting the main server bind address #11631 (PR: #11632)
• Fix chunked upload storing duplicate objects when the same chunk index is sent twice #11634 (PR: #11635)
• Fix access token expiration select always showing Never after picking another option (by @chulgil) #11663 (PR: #11664)
• Fix workspace dropping unsaved changes when read-only blocks persistence #11672 (PR: #11699)
• Fix Plugin API failing silently when writing to an interaction the shape no longer has #11780 (PR: #11781)

:sparkles: New features & Enhancements

• Group toolbar drawing tools into shape and free-draw flyouts #9316 (PR: #9480, #10354)
• Add outline stroke to Paths #9961 (PR: #8677)
• Add dedicated Line and Arrow drawing tools (by @davidv399) #9145 (PR: #9146)
• Refactor wasm rulers and UI state #10116 (PR: #10461)
• Improve team invitations modal in the dashboard #10484 (PR: #10459)
• Highlight the first matching font in the font list when searching (by @ai-mountain) #3204 (PR: #9512, #10450)
• Preserve token references when copying and pasting properties instead of resolving them to values (by @AKnassa) #9582 (PR: #10665)
• Add waitForLayoutUpdate method to the plugin API #10136 (PR: #9898)
• Show and manage comments while designing in the workspace #10239 (PR: #10275)
• Simplify MCP server configuration for common MCP clients #10355 (PR: #10604)
• Remove misleading MCP client JSON snippet from the key-generated modal (by @Shlok1729) #10399 (PR: #10415)
• Preview font families in the font selector #10403 (PR: #10411)
• Remember expanded/collapsed state of token sets in the color tokens picker (session scope) #10551 (PR: #10864)
• Show token sets in reverse order by default in the color tokens picker (by @rhinocap) #10552 (PR: #10658)
• Add multi-selection and bulk delete support to pages in the workspace sitemap #10580 (PR: #10581)
• Add a grid/list view toggle for files in the dashboard #10691 (PR: #10692)
• Migrate Docker images to Docker Hardened Images (DHI) #10720 (PR: #10732, #10733, #10734)
• Adopt React Aria #10802 (PR: #10675)
• Add plugin API function for awaiting component updates beyond waitForLayoutUpdate #10927 (PR: #10964)
• Emit open-workspace-file audit event with file statistics on workspace load #11106 (PR: #11138)
• Restrict optional ids to v4, v7 and v8 UUIDs in creation RPC endpoints #11778 (PR: #11777)