✨ Take changelog highlights from the release highlight label (#12154)

* ✨ Take changelog highlights from the release highlight label The 🚀 section was picked by the agent on each run and kept forever, so a regeneration could add highlights product did not choose and nobody could drop one. Make the `release highlight` label the only source, as `breaking change` already is for 💥, and have the report flag 🚀 entries that do not match the label. AI-assisted-by: claude-opus-5-5 * 📚 Update changelog for 2.19.0 Regenerate the 2.19.0 section from the milestone with the update-changelog skill. Add the 79 closed issues that were missing, drop entries labelled `no changelog` and #9263, which is not in the milestone, and take 🚀 from the `release highlight` label. AI-assisted-by: claude-opus-5-5
2026-10-29 14:00:37 +00:00 · 2026-10-07 10:42:54 +02:00 · 2026-10-07 10:42:54 +02:00 · 3f6b7a7959
commit 3f6b7a7959
parent 806a9ee98e
3 changed files with 164 additions and 28 deletions
--- a/.agents/skills/update-changelog/SKILL.md
+++ b/.agents/skills/update-changelog/SKILL.md
@ -99,13 +99,18 @@ query is needed.

 **Breaking changes override everything:** an issue with the `breaking change`
 label goes under `### :boom: Breaking changes & Deprecations`, no matter its
-issue type. This is the only label-based rule — it is an explicit exception
-to the "never by labels" principle above. The `:boom:` subsection goes first
-in the version, before `:rocket:` (matching the existing precedent).
+issue type. This and `release highlight` below are the only label-based
+rules — explicit exceptions to the "never by labels" principle above. The
+`:boom:` subsection goes first in the version, before `:rocket:` (matching
+the existing precedent).

-**Preserve highlighted entries:** if an entry already sits under
-`### :rocket: Epics and highlights`, keep it there when refreshing. Do not
-move it down just because its type would place it under `:sparkles:`.
+**Highlights come from the `release highlight` label:** an issue with that
+label also gets an entry under `### :rocket: Epics and highlights`, on top of
+its regular entry (usually `:sparkles:`). In the section being refreshed,
+`:rocket:` lists exactly the labelled issues: never pick highlights yourself
+and never keep an unlabelled entry there. Product decides the highlights by
+labelling issues on GitHub, so a regeneration cannot undo that choice. Older
+version sections are left as they are.

 **Community attribution:** if the issue or its fix PR has the
 `community contribution` label, add `(by @<github_username>)` on the entry
@ -207,7 +212,10 @@ not trust cached data):
 6. **Issue type changed to `Task`** → remove the entry.
 7. **Breaking change misplaced** (issue has the `breaking change` label but
   sits in another section) → move the entry to `:boom:`.
-8. **Missing valid issues** (closed, non-excluded, unreferenced anywhere) →
+8. **Highlight out of sync** (`:rocket:` entry without the `release
+   highlight` label, or a labelled issue missing from `:rocket:`) → remove
+   the `:rocket:` entry or add it (step 7b). The regular entry stays.
+9. **Missing valid issues** (closed, non-excluded, unreferenced anywhere) →
   add them to the current section per step 5.

 ### 7. Build the description text
@ -225,14 +233,22 @@ behavior:
 Insert the new version section right after the `# CHANGELOG` header with the
 `edit` tool and enough context for a unique match.

-### 7b. Propose and populate `:rocket: Epics and highlights`
+### 7b. Populate `:rocket: Epics and highlights` from the label

-Create the subsection if missing (place it before `### :sparkles:`) and pick
-2–5 of the most impactful/user-visible `:sparkles:` entries: new visible
-features, big capabilities, items that make self-hosted users want to update.
-`frontend/src/app/main/ui/releases/v2_<MINOR>.cljs` slide titles are optional
-hints (they may not exist for every version). Every `:rocket:` entry MUST
-carry issue AND PR references; never remove entries from a prior run.
+List the milestone issues that pass step 2 exclusions and carry the
+`release highlight` label:
+
+```bash
+python3 scripts/gh.py issues "2.16.0" --exclude "release blocker,no changelog" \
+  | python3 -c "import sys,json; [print(i['number'], i['title']) for i in json.load(sys.stdin) if 'release highlight' in i['labels']]"
+```
+
+Create the subsection if missing (place it before `### :sparkles:`) with one
+entry per labelled issue, same text and references as its regular entry.
+Every `:rocket:` entry MUST carry issue AND PR references. If no issue is
+labelled, leave `:rocket:` out and tell the user: the highlights are
+product's call, not the agent's. To change them, add or remove the label on
+GitHub and re-run; never edit `:rocket:` by hand.

 ### 8. Cross-reference milestone PRs against the changelog

@ -264,6 +280,8 @@ pairing is misleading and a human must judge intent):
 3. `:boom:` entry whose issue lacks the `breaking change` label. These stay
   listed in the report **and** in the changelog: either label the issue or
   move the entry to its regular section.
+4. `:rocket:` out of sync with the `release highlight` label. Step 6
+   pre-flight should have fixed it: if it shows up, re-run the workflow.

 **Highlight gaps are warnings, not anomalies:** missing `:rocket:` on a
 released X.Y.0 (patches never carry highlights); `:rocket:` entry without
@ -277,7 +295,7 @@ pre-flight. If one shows up in the report, re-run the workflow.
 - **Issue = changelog unit**, PR = implementation detail inline.
 - **Latest version first**, below the `# CHANGELOG` header.
 - **Issue Type decides the section — exclusively**, except `breaking change`
-  label → `:boom:` first.
+  label → `:boom:` first, and `release highlight` label → also `:rocket:`.
 - **User-facing descriptions** in imperative mood.
 - **Community attribution** uses the PR author, placed before the issue link.
 - **Only closed issues**; **Rejected** project status excludes.
--- a/CHANGES.md
+++ b/CHANGES.md
@ -6,12 +6,12 @@

 - Add configurable keyboard shortcuts [#9924](https://github.com/penpot/penpot/issues/9924) (PR: [#10237](https://github.com/penpot/penpot/pull/10237))
 - Improve path operations and edition in the path editor [#10889](https://github.com/penpot/penpot/issues/10889) (PR: [#10807](https://github.com/penpot/penpot/pull/10807))
- Add auto-linking of libraries during import based on slugified name [#9263](https://github.com/penpot/penpot/issues/9263) (PR: [#9958](https://github.com/penpot/penpot/pull/9958))
+- Add individual stroke widths per side (top, right, bottom, left) [#9854](https://github.com/penpot/penpot/issues/9854) (PR: [#10648](https://github.com/penpot/penpot/pull/10648))
+- Add support for internal libraries and file sync for Design Tokens [#9334](https://github.com/penpot/penpot/issues/9334) (PR: [#10293](https://github.com/penpot/penpot/pull/10293))

 ### :bug: Bugs fixed

 - Fix copying text from Penpot to the clipboard not working on MS Windows [#11303](https://github.com/penpot/penpot/issues/11303) (PR: [#11305](https://github.com/penpot/penpot/pull/11305))
- Fix performance issue with WebGL render [#11240](https://github.com/penpot/penpot/issues/11240) (PR: [#11259](https://github.com/penpot/penpot/pull/11259))
 - Fix comment bubbles rendering on top of workspace dropdown menus [#10283](https://github.com/penpot/penpot/issues/10283) (PR: [#11201](https://github.com/penpot/penpot/pull/11201))
 - Fix inconsistent Mixed label in blur options and numeric inputs across 24 locales (by @filipsajdak) [#11148](https://github.com/penpot/penpot/issues/11148) (PR: [#11151](https://github.com/penpot/penpot/pull/11151))
 - Fix overlay shifting left when shown with top-center alignment in viewer prototype (by @filipsajdak) [#9048](https://github.com/penpot/penpot/issues/9048) (PR: [#10454](https://github.com/penpot/penpot/pull/10454))
@ -21,31 +21,105 @@
 - Fix plugin postMessage channel broadcasting messages to all plugins without origin validation [#10968](https://github.com/penpot/penpot/issues/10968) (PR: [#10970](https://github.com/penpot/penpot/pull/10970))
 - Fix MCP plugin page navigation while connected crashing the workspace (by @makesomethingshit) [#11001](https://github.com/penpot/penpot/issues/11001) (PR: [#11521](https://github.com/penpot/penpot/pull/11521))
 - Fix shortcut search never matching on key combination, only on action label [#11003](https://github.com/penpot/penpot/issues/11003) (PR: [#11081](https://github.com/penpot/penpot/pull/11081))
- Fix Shift + special character key shortcut capturing the shifted character instead of the physical key [#11004](https://github.com/penpot/penpot/issues/11004) (PR: [#11081](https://github.com/penpot/penpot/pull/11081))
+- Fix Shift + special character key shortcut capturing the shifted character instead of the physical key [#11004](https://github.com/penpot/penpot/issues/11004) (PR: [#11081](https://github.com/penpot/penpot/pull/11081), [#11669](https://github.com/penpot/penpot/pull/11669))
 - Fix reassigning the "Paste" shortcut not updating the UI or taking effect in the workspace [#11005](https://github.com/penpot/penpot/issues/11005) (PR: [#11081](https://github.com/penpot/penpot/pull/11081))
 - Fix font-size dropdown clipping multi-digit values in Firefox (by @0xTHAC0) [#11008](https://github.com/penpot/penpot/issues/11008) (PR: [#11162](https://github.com/penpot/penpot/pull/11162), [#11500](https://github.com/penpot/penpot/pull/11500))
 - Fix exporting shortcuts producing an invalid "toggle-fullscreen" entry that breaks re-import [#11032](https://github.com/penpot/penpot/issues/11032) (PR: [#11081](https://github.com/penpot/penpot/pull/11081))
 - Fix plugin API missing permission checks in tokens, shapes, variants, flows, layouts, and user identity [#11137](https://github.com/penpot/penpot/issues/11137) (PR: [#11139](https://github.com/penpot/penpot/pull/11139))
 - Fix library summary Redis cache keys omitting the tenant [#11407](https://github.com/penpot/penpot/issues/11407) (PR: [#11408](https://github.com/penpot/penpot/pull/11408))
 - Fix active theme name in the inspect tab displaying an id instead of the name [#11437](https://github.com/penpot/penpot/issues/11437) (PR: [#11439](https://github.com/penpot/penpot/pull/11439))
- Fix triple-click not selecting the full line in text editor v3 [#11483](https://github.com/penpot/penpot/issues/11483) (PR: [#11493](https://github.com/penpot/penpot/pull/11493))
- Fix pasted text losing formatting on last lines after resizing and adding new lines from the top [#11501](https://github.com/penpot/penpot/issues/11501) (PR: [#11503](https://github.com/penpot/penpot/pull/11503))
 - Fix variant property dropdown appearing empty and throwing an internal error when the component has no sibling variants [#11524](https://github.com/penpot/penpot/issues/11524) (PR: [#11499](https://github.com/penpot/penpot/pull/11499))
+- Fix invitation links not allowing registration when `disable-registration` is enabled [#5178](https://github.com/penpot/penpot/issues/5178) (PR: [#11912](https://github.com/penpot/penpot/pull/11912))
+- Fix Windows build failures caused by path resolution and start command conflicts (by @0xTHAC0) [#8637](https://github.com/penpot/penpot/issues/8637) (PR: [#11197](https://github.com/penpot/penpot/pull/11197))
+- Fix editing a path on an image, rectangle or ellipse corrupting the shape and failing backend validation [#10621](https://github.com/penpot/penpot/issues/10621) (PR: [#10807](https://github.com/penpot/penpot/pull/10807))
+- Fix board content disappearing when dragging a board near another board [#10689](https://github.com/penpot/penpot/issues/10689) (PR: [#11620](https://github.com/penpot/penpot/pull/11620))
+- Fix dashboard context menu being cut off for long lists, hiding the bottom options [#10724](https://github.com/penpot/penpot/issues/10724) (PR: [#11511](https://github.com/penpot/penpot/pull/11511))
+- Fix moving an element changing its size [#10751](https://github.com/penpot/penpot/issues/10751) (PR: [#11560](https://github.com/penpot/penpot/pull/11560))
+- Fix remote MCP websocket connecting but never receiving live browser commands [#10753](https://github.com/penpot/penpot/issues/10753)
+- Fix stroke to path not working with path ends (by @ShreyashAgare26) [#10825](https://github.com/penpot/penpot/issues/10825) (PR: [#11614](https://github.com/penpot/penpot/pull/11614))
+- Fix border style not working with stroke per side [#10841](https://github.com/penpot/penpot/issues/10841) (PR: [#11883](https://github.com/penpot/penpot/pull/11883))
+- Fix multiple selection not showing stroke per side when all shapes share the same per side values [#10844](https://github.com/penpot/penpot/issues/10844) (PR: [#10913](https://github.com/penpot/penpot/pull/10913))
+- Fix stroke width tokens not overriding stroke per side values [#10850](https://github.com/penpot/penpot/issues/10850) (PR: [#10913](https://github.com/penpot/penpot/pull/10913))
+- Fix internal error when applying a dimension token to stroke width [#10918](https://github.com/penpot/penpot/issues/10918) (PR: [#10913](https://github.com/penpot/penpot/pull/10913))
+- Fix stroke per side button detaching the applied token [#10920](https://github.com/penpot/penpot/issues/10920) (PR: [#10913](https://github.com/penpot/penpot/pull/10913))
+- Fix WebSocket subscription handlers missing authorization checks [#11067](https://github.com/penpot/penpot/issues/11067) (PR: [#11069](https://github.com/penpot/penpot/pull/11069))
+- Fix project title being truncated in the dashboard despite available space [#11306](https://github.com/penpot/penpot/issues/11306) (PR: [#11564](https://github.com/penpot/penpot/pull/11564), [#11675](https://github.com/penpot/penpot/pull/11675))
+- Fix `rect` attribute NaN length error in the console when panning a file [#11327](https://github.com/penpot/penpot/issues/11327) (PR: [#11856](https://github.com/penpot/penpot/pull/11856))
+- Fix unclipped and rotated shapes being cut on render tiles [#11401](https://github.com/penpot/penpot/issues/11401) (PR: [#11423](https://github.com/penpot/penpot/pull/11423))
+- Fix Plugin API rejecting the documented `fontFamilies` applyToken property (by @makesomethingshit) [#11405](https://github.com/penpot/penpot/issues/11405) (PR: [#11566](https://github.com/penpot/penpot/pull/11566))
+- Fix flattening text ignoring non-zero letter spacing [#11462](https://github.com/penpot/penpot/issues/11462) (PR: [#11555](https://github.com/penpot/penpot/pull/11555))
+- Fix boolean results serialized as unordered subpaths, deforming them in the WebGL render and the exporter [#11482](https://github.com/penpot/penpot/issues/11482) (PR: [#11551](https://github.com/penpot/penpot/pull/11551))
+- Fix MCP reconnecting endlessly in inactive tabs and eventually freezing the browser (by @breken-ai) [#11510](https://github.com/penpot/penpot/issues/11510) (PR: [#11520](https://github.com/penpot/penpot/pull/11520), [#11906](https://github.com/penpot/penpot/pull/11906))
+- Fix dashed strokes losing their properties when changing color (by @Shlok1729) [#11549](https://github.com/penpot/penpot/issues/11549) (PR: [#11557](https://github.com/penpot/penpot/pull/11557))
+- Fix text decoration not applying per text span in the WebGL render [#11582](https://github.com/penpot/penpot/issues/11582) (PR: [#11583](https://github.com/penpot/penpot/pull/11583))
+- Fix binfile import exhausting backend memory when a ZIP JSON entry decompresses without limit [#11606](https://github.com/penpot/penpot/issues/11606) (PR: [#11607](https://github.com/penpot/penpot/pull/11607))
+- Fix modal not closing when going to the plans page via "See my current plan" (by @makesomethingshit) [#11611](https://github.com/penpot/penpot/issues/11611) (PR: [#11615](https://github.com/penpot/penpot/pull/11615))
+- Fix view-only share links disclosing unshared library pages when the file links a library [#11617](https://github.com/penpot/penpot/issues/11617) (PR: [#11627](https://github.com/penpot/penpot/pull/11627))
+- Fix canvas tiles showing only the background color while dragging the canvas background color picker [#11642](https://github.com/penpot/penpot/issues/11642) (PR: [#11643](https://github.com/penpot/penpot/pull/11643))
+- Fix title spacing and "added" pill padding in the libraries modal [#11645](https://github.com/penpot/penpot/issues/11645) (PR: [#11650](https://github.com/penpot/penpot/pull/11650))
+- Fix workspace crash when pasting before the page finishes loading [#11666](https://github.com/penpot/penpot/issues/11666) (PR: [#11674](https://github.com/penpot/penpot/pull/11674))
+- Fix tap area not matching the visible screen when zoomed out in the WebGL render (by @makesomethingshit) [#11689](https://github.com/penpot/penpot/issues/11689) (PR: [#11793](https://github.com/penpot/penpot/pull/11793))
+- Fix app crash when logging receives an empty level, and add the missing fatal level [#11690](https://github.com/penpot/penpot/issues/11690) (PR: [#11693](https://github.com/penpot/penpot/pull/11693))
+- Fix WebGL render ignoring drop and inner shadows on masked groups [#11697](https://github.com/penpot/penpot/issues/11697) (PR: [#11754](https://github.com/penpot/penpot/pull/11754))
+- Fix curves being created while Ctrl+dragging a path segment [#11702](https://github.com/penpot/penpot/issues/11702) (PR: [#11715](https://github.com/penpot/penpot/pull/11715))
+- Fix viewer role showing the search and replace option [#11706](https://github.com/penpot/penpot/issues/11706) (PR: [#11713](https://github.com/penpot/penpot/pull/11713))
+- Fix toggling the visibility of a child in a flex layout main component deleting the prototype interactions of its copies (by @ShreyashAgare26) [#11746](https://github.com/penpot/penpot/issues/11746) (PR: [#11788](https://github.com/penpot/penpot/pull/11788))
+- Fix cursor not visible on page load in the WebGL render [#11769](https://github.com/penpot/penpot/issues/11769) (PR: [#11770](https://github.com/penpot/penpot/pull/11770))
+- Fix library text styles detaching when copying and pasting an element [#11776](https://github.com/penpot/penpot/issues/11776) (PR: [#11785](https://github.com/penpot/penpot/pull/11785))
+- Fix Plugin API crashing the workspace when a shapechange listener is registered with an empty shape id [#11786](https://github.com/penpot/penpot/issues/11786) (PR: [#11787](https://github.com/penpot/penpot/pull/11787))
+- Fix borders not being fully rendered [#11805](https://github.com/penpot/penpot/issues/11805) (PR: [#11807](https://github.com/penpot/penpot/pull/11807))
+- Fix design token controls being enabled for fills and strokes below the first position [#11819](https://github.com/penpot/penpot/issues/11819) (PR: [#10913](https://github.com/penpot/penpot/pull/10913))
+- Fix viewer role showing the open libraries modal button [#11824](https://github.com/penpot/penpot/issues/11824) (PR: [#11849](https://github.com/penpot/penpot/pull/11849))
+- Fix extra padding on the "Sets" title in the tokens panel [#11826](https://github.com/penpot/penpot/issues/11826) (PR: [#11849](https://github.com/penpot/penpot/pull/11849))
+- Fix thumbnails failing on older Chromium browsers and each thumbnail rendering several times [#11878](https://github.com/penpot/penpot/issues/11878) (PR: [#11879](https://github.com/penpot/penpot/pull/11879))
+- Fix internal error when opening the libraries modal [#11943](https://github.com/penpot/penpot/issues/11943) (PR: [#11946](https://github.com/penpot/penpot/pull/11946))
+- Fix Plugin API `connectLibrary` linking unpublished files as libraries [#12001](https://github.com/penpot/penpot/issues/12001) (PR: [#12002](https://github.com/penpot/penpot/pull/12002))

 ### :sparkles: New features & Enhancements

 - Make backend storage resilient to interrupted writes, missing files and stalled cleanup [#11344](https://github.com/penpot/penpot/issues/11344) (PR: [#11345](https://github.com/penpot/penpot/pull/11345))
- Implement RTL support in the text editor v3 [#11262](https://github.com/penpot/penpot/issues/11262)
 - Improve path operations and edition in the path editor [#10889](https://github.com/penpot/penpot/issues/10889) (PR: [#10807](https://github.com/penpot/penpot/pull/10807))
 - Add configurable keyboard shortcuts [#9924](https://github.com/penpot/penpot/issues/9924) (PR: [#10237](https://github.com/penpot/penpot/pull/10237))
- Add auto-linking of libraries during import based on slugified name [#9263](https://github.com/penpot/penpot/issues/9263) (PR: [#9958](https://github.com/penpot/penpot/pull/9958))
- Add support for internal libraries and file sync for Design Tokens [#9334](https://github.com/penpot/penpot/issues/9334)
+- Add support for internal libraries and file sync for Design Tokens [#9334](https://github.com/penpot/penpot/issues/9334) (PR: [#10293](https://github.com/penpot/penpot/pull/10293))
 - Warn self-hosted users when their Penpot version is outdated and surface what they're missing [#10497](https://github.com/penpot/penpot/issues/10497) (PR: [#11411](https://github.com/penpot/penpot/pull/11411))
 - Add dedicated RPC methods for plugin registry operations with permission validation [#10952](https://github.com/penpot/penpot/issues/10952) (PR: [#10957](https://github.com/penpot/penpot/pull/10957))
 - Document MCP and internal resolver environment variables (by @ShreyashAgare26) [#11318](https://github.com/penpot/penpot/issues/11318) (PR: [#11572](https://github.com/penpot/penpot/pull/11572))
 - Add tokens source indicator to assets tab [#11365](https://github.com/penpot/penpot/issues/11365) (PR: [#11439](https://github.com/penpot/penpot/pull/11439))
- Export multiple fills to SVG [#11466](https://github.com/penpot/penpot/issues/11466) (PR: [#11467](https://github.com/penpot/penpot/pull/11467))
 - Add Penpot-specific board size presets (file thumbnail, template cover, plugin icon/cover) [#11561](https://github.com/penpot/penpot/issues/11561) (PR: [#11565](https://github.com/penpot/penpot/pull/11565))
+- Apply tokens to stroke per side [#9842](https://github.com/penpot/penpot/issues/9842) (PR: [#10913](https://github.com/penpot/penpot/pull/10913))
+- Add individual stroke widths per side (top, right, bottom, left) [#9854](https://github.com/penpot/penpot/issues/9854) (PR: [#10648](https://github.com/penpot/penpot/pull/10648))
+- Expand the token tree right after importing it (by @AKnassa) [#9819](https://github.com/penpot/penpot/issues/9819) (PR: [#10664](https://github.com/penpot/penpot/pull/10664))
+- Update the selection size badge live during resize, replacing the resize tooltip [#10259](https://github.com/penpot/penpot/issues/10259)
+- Add color variants, rotation correction, viewport flip and hide-when-too-small to the selection size badge [#10264](https://github.com/penpot/penpot/issues/10264) (PR: [#11884](https://github.com/penpot/penpot/pull/11884))
+- Support single-file SVG export with the WebGL render [#10546](https://github.com/penpot/penpot/issues/10546)
+- Persist the hide resolved comments preference and separate the filter options in the comments menu [#10686](https://github.com/penpot/penpot/issues/10686) (PR: [#10694](https://github.com/penpot/penpot/pull/10694))
+- Add rich link previews (Open Graph) for shared Penpot links [#10699](https://github.com/penpot/penpot/issues/10699) (PR: [#10700](https://github.com/penpot/penpot/pull/10700))
+- Add 3x export scale option [#10740](https://github.com/penpot/penpot/issues/10740) (PR: [#11598](https://github.com/penpot/penpot/pull/11598))
+- Show a validation message in the input instead of a toast when the email is already in use (by @ShreyashAgare26) [#10890](https://github.com/penpot/penpot/issues/10890) (PR: [#11647](https://github.com/penpot/penpot/pull/11647))
+- Take `waitForLayoutUpdate` into account in MCP instructions and implementation [#10901](https://github.com/penpot/penpot/issues/10901) (PR: [#11433](https://github.com/penpot/penpot/pull/11433))
+- Add a standard context menu (Cut, Copy, Paste, Select all) on right-click when editing text [#10914](https://github.com/penpot/penpot/issues/10914) (PR: [#11677](https://github.com/penpot/penpot/pull/11677))
+- Process export requests as export jobs [#11133](https://github.com/penpot/penpot/issues/11133) (PR: [#11296](https://github.com/penpot/penpot/pull/11296))
+- Enable closed schemas for RPC method parameters [#11135](https://github.com/penpot/penpot/issues/11135) (PR: [#11136](https://github.com/penpot/penpot/pull/11136))
+- Add Content-Security-Policy and Strict-Transport-Security headers to the frontend image [#11374](https://github.com/penpot/penpot/issues/11374) (PR: [#11375](https://github.com/penpot/penpot/pull/11375))
+- Send a notification email when the password is changed or set [#11392](https://github.com/penpot/penpot/issues/11392) (PR: [#11393](https://github.com/penpot/penpot/pull/11393))
+- Lock accounts after repeated failed login attempts [#11397](https://github.com/penpot/penpot/issues/11397) (PR: [#11402](https://github.com/penpot/penpot/pull/11402), [#11895](https://github.com/penpot/penpot/pull/11895))
+- Enforce an absolute maximum session duration [#11444](https://github.com/penpot/penpot/issues/11444) (PR: [#11447](https://github.com/penpot/penpot/pull/11447))
+- Add a loading message to the libraries section [#11452](https://github.com/penpot/penpot/issues/11452) (PR: [#11594](https://github.com/penpot/penpot/pull/11594))
+- Resize image bounds independently from the image content on the canvas [#11516](https://github.com/penpot/penpot/issues/11516) (PR: [#11590](https://github.com/penpot/penpot/pull/11590))
+- Limit binfile import database connection time and stop rescanning ZIP entries [#11579](https://github.com/penpot/penpot/issues/11579) (PR: [#11584](https://github.com/penpot/penpot/pull/11584))
+- Apply the same validation rules in the Plugin API as in the UI [#11586](https://github.com/penpot/penpot/issues/11586) (PR: [#11587](https://github.com/penpot/penpot/pull/11587))
+- Fetch only the caller's share link in the view-only bundle (by @makesomethingshit) [#11633](https://github.com/penpot/penpot/issues/11633) (PR: [#11657](https://github.com/penpot/penpot/pull/11657))
+- Add Prometheus metrics for backend storage operations [#11676](https://github.com/penpot/penpot/issues/11676) (PR: [#11700](https://github.com/penpot/penpot/pull/11700))
+- Make "Fix when scrolling" work in the WebGL render [#11684](https://github.com/penpot/penpot/issues/11684) (PR: [#11752](https://github.com/penpot/penpot/pull/11752))
+- Complete Catalan translations [#11739](https://github.com/penpot/penpot/issues/11739) (PR: [#11741](https://github.com/penpot/penpot/pull/11741))
+- Remove the optional client-provided id from creation RPC endpoints [#11783](https://github.com/penpot/penpot/issues/11783) (PR: [#11784](https://github.com/penpot/penpot/pull/11784))
+- Allow color tokens for the canvas background [#11791](https://github.com/penpot/penpot/issues/11791) (PR: [#11923](https://github.com/penpot/penpot/pull/11923))
+- Show a "no assets yet" message for empty files in the libraries modal [#11811](https://github.com/penpot/penpot/issues/11811) (PR: [#11818](https://github.com/penpot/penpot/pull/11818))
+- Upgrade the MCP SDK to v2 and adopt the new protocol version [#11827](https://github.com/penpot/penpot/issues/11827) (PR: [#11841](https://github.com/penpot/penpot/pull/11841))
+- Remove legacy SSE support from the MCP server [#11846](https://github.com/penpot/penpot/issues/11846) (PR: [#11841](https://github.com/penpot/penpot/pull/11841))
+- Delete selected path handles with Backspace or Delete [#11858](https://github.com/penpot/penpot/issues/11858) (PR: [#11896](https://github.com/penpot/penpot/pull/11896))
+- Use the tooltip component in the token pill info [#11886](https://github.com/penpot/penpot/issues/11886) (PR: [#11900](https://github.com/penpot/penpot/pull/11900))
+- Hide the duplicate cursor when alt-dragging a shape that cannot be duplicated (by @0xTHAC0) [#11905](https://github.com/penpot/penpot/issues/11905) (PR: [#11195](https://github.com/penpot/penpot/pull/11195))

 ## 2.18.3

--- a/scripts/changelog.py
+++ b/scripts/changelog.py
@ -265,6 +265,7 @@ def cmd_report(args: argparse.Namespace) -> None:
    for pr in pr_by_num.values():
        unknown_issues.update(pr.get("closing_issues", []))
    unknown_issues |= collect_changelog_issues(extract_subsection(section, r"### :boom:"))
+    unknown_issues |= collect_changelog_issues(extract_subsection(section, r"### :rocket:"))
    unknown_issues -= set(issue_milestone_cache)
    external_issues: dict[int, dict] = {}
    if unknown_issues:
@ -375,6 +376,36 @@ def cmd_report(args: argparse.Namespace) -> None:
                    }
                )

+    # Type F: :rocket: out of sync with the `release highlight` label. The
+    # label is the only source of highlights: every labelled milestone
+    # issue goes under :rocket:, and nothing else does.
+    anomalies_f = []
+    rocket_issues = collect_changelog_issues(extract_subsection(section, r"### :rocket:"))
+    for issue_num in sorted(rocket_issues):
+        labels = get_issue_labels(issue_num)
+        if labels is None:
+            continue
+        if "release highlight" not in labels:
+            issue = issue_by_num.get(issue_num) or external_issues.get(issue_num) or {}
+            anomalies_f.append(
+                {
+                    "issue": issue_num,
+                    "issue_title": issue.get("title", ""),
+                    "reason": "under :rocket: without the `release highlight` label",
+                }
+            )
+    for issue_num, issue in sorted(issue_by_num.items()):
+        if issue_excluded(issue) or issue_num in rocket_issues:
+            continue
+        if "release highlight" in issue.get("labels", []):
+            anomalies_f.append(
+                {
+                    "issue": issue_num,
+                    "issue_title": issue.get("title", ""),
+                    "reason": "labelled `release highlight` but missing from :rocket:",
+                }
+            )
+
    # Type C: released X.Y.0 sections without a :rocket: subsection.
    # Patches (X.Y.Z with Z != 0) never carry :rocket: — only minors/majors.
    anomalies_c = []
@ -428,12 +459,13 @@ def cmd_report(args: argparse.Namespace) -> None:
        )
        f.write("---\n\n")

-        n_a, n_b, n_c, n_d, n_e = (
+        n_a, n_b, n_c, n_d, n_e, n_f = (
            len(anomalies_a),
            len(anomalies_b),
            len(anomalies_c),
            len(anomalies_d),
            len(anomalies_e),
+            len(anomalies_f),
        )

        f.write("## Summary\n\n")
@ -444,13 +476,14 @@ def cmd_report(args: argparse.Namespace) -> None:
            f"- **PR in {milestone}, closing issue in a different milestone:** {n_b}\n"
        )
        f.write(f"- **:boom: entry without breaking change label:** {n_e}\n")
-        f.write(f"- **Total anomalies:** {n_a + n_b + n_e}\n")
+        f.write(f"- **:rocket: out of sync with release highlight label:** {n_f}\n")
+        f.write(f"- **Total anomalies:** {n_a + n_b + n_e + n_f}\n")
        f.write(
            f"- **Released X.Y.0 version missing :rocket: section (gap):** {n_c}\n"
        )
        f.write(f"- **:rocket: entry without issue AND PR references (gap):** {n_d}\n\n")

-        if n_a or n_b or n_e:
+        if n_a or n_b or n_e or n_f:
            f.write("## Anomalies\n\n")
            f.write(
                "Types A and B are milestone mismatches between an issue in the changelog "
@ -461,6 +494,9 @@ def cmd_report(args: argparse.Namespace) -> None:
                "removing the misleading entry from the changelog.\n\n"
                "Type E entries stay in the changelog: either label the issue "
                "as `breaking change` or move the entry out of `:boom:`.\n\n"
+                "Type F is a rule violation: `:rocket:` must list exactly the "
+                "issues labelled `release highlight`. Fix the label on GitHub "
+                "or re-run the workflow.\n\n"
            )

            if n_a:
@ -512,6 +548,14 @@ def cmd_report(args: argparse.Namespace) -> None:
                for e in anomalies_e:
                    f.write(f"- ⚠️ {issue_link_title(e['issue'], e['issue_title'][:80])}\n")
                f.write("\n")
+
+            if n_f:
+                f.write("\n### :rocket: out of sync with release highlight label\n\n")
+                for e in anomalies_f:
+                    f.write(
+                        f"- ⚠️ {issue_link_title(e['issue'], e['issue_title'][:80])}: {e['reason']}\n"
+                    )
+                f.write("\n")
        else:
            f.write(
                "✅ No anomalies found. All (issue, PR) pairs in the changelog have aligned milestone assignments.\n\n"
@ -546,7 +590,7 @@ def cmd_report(args: argparse.Namespace) -> None:
                for d in anomalies_d:
                    f.write(f"- **{d['version']}**: `{d['line']}`\n")
                f.write("\n")
-        elif not (n_a or n_b or n_e):
+        elif not (n_a or n_b or n_e or n_f):
            f.write(
                "✅ No highlight gaps found. All released X.Y.0 versions have properly referenced :rocket: entries.\n\n"
            )