github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-07-25 07:28:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
22,143 Commits 210 Branches 318 Tags
Commit Graph

2213 Commits

Author SHA1 Message Date
Andrey Antukh
d65e8317e3 📎 Update changelog 2026-06-11 10:41:05 +02:00
Andrey Antukh
2808268e52 📎 Update changelog 2026-06-03 14:36:05 +02:00
Andrey Antukh
fe9e47f947 Merge remote-tracking branch 'origin/main' into staging 2026-06-02 10:15:24 +02:00
Andrey Antukh
d49fa51fef Update changelog 2026-06-02 10:10:20 +02:00
rene0422
0efebc5e0e 🐛 Keep colliding tokens visible as broken pills 2026-05-29 12:28:10 +02:00
Andrey Antukh
95e7edc9d2 📚 Update changelog 2026-05-27 12:51:26 +02:00
Andrey Antukh
f6c76711f4 Merge remote-tracking branch 'origin/main' into staging 2026-05-27 11:34:59 +02:00
Andrey Antukh
5f30704b28 📚 Update changelog 2026-05-19 17:55:41 +02:00
Andrey Antukh
46c35b01a8 📎 Update changelog 2026-05-19 09:02:34 +02:00
Andrey Antukh
5b7c732449 Merge remote-tracking branch 'origin/main' into staging 2026-05-18 19:59:46 +02:00
Andrey Antukh
87b969bd05 📎 Update changelog 2026-05-18 19:59:12 +02:00
Andrey Antukh
4d9c6eba38 📎 Add missing bugfix entries to changelog 2026-05-18 16:20:27 +02:00
Andrey Antukh
7e522ae777 📎 Fix inconsistencies on CHANGES.md 2026-05-18 15:11:11 +02:00
Andrés Moya
82169bc0a3
🐛 Fix loss of swap slot in some cases of variant switch (#9147) 
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
Co-authored-by: Andrey Antukh <niwi@niwi.nz>
 2026-05-18 14:25:32 +02:00
Andrey Antukh
725a0c966c 📎 Fix incorrect entries on changelog 2026-05-18 14:23:18 +02:00
Andrés Moya
ab284febf7
🐛 Fix token application to grid padding (#9630) 2026-05-18 13:32:28 +02:00
Andrés Moya
25ee8dee78
🐛 Fix editing a text element detaches applied tokens (#9525) 2026-05-18 12:28:48 +02:00
andrés gonzález
24fe5559c5
📚 Update 2.16 changelog (#9689) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-18 10:31:24 +02:00
Andrey Antukh
6ac8012258 Merge remote-tracking branch 'origin/main' into staging 2026-05-15 11:57:16 +02:00
Andrey Antukh
3db0e5ee0d 📎 Update changelog 2026-05-15 11:31:58 +02:00
andrés gonzález
27ac0b7469
🐛 Unify layout creation telemetry for plugins and MCP (#9654) 
* 🐛 Unify layout creation telemetry for plugins and MCP

* 📚 Update changelog for version 2.15.4

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
Co-authored-by: Andrey Antukh <niwi@niwi.nz>
 2026-05-15 10:53:43 +02:00
andrés gonzález
310bf6fd6a
💄 Change auth illustration (#9552) 
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Andrey Antukh <niwi@niwi.nz>
 2026-05-14 16:25:53 +02:00
andrés gonzález
7e7bf7c458
✨ Update Open Graph and link preview metadata (#9557) 
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
Co-authored-by: Andrey Antukh <niwi@niwi.nz>
 2026-05-14 16:23:57 +02:00
Pablo Alba
5dafd44966
🐛 Fix library update button freezes and does not apply updates (#9513) 
Co-authored-by: Andrey Antukh <niwi@niwi.nz>
 2026-05-14 16:03:47 +02:00
Andrey Antukh
9021544c05 Merge remote-tracking branch 'origin/main' into staging 2026-05-14 15:24:29 +02:00
Andrey Antukh
05d40e3370 📚 Update changelog 2026-05-14 15:19:24 +02:00
Andrey Antukh
fd19bf121f 📎 Update changelog 2026-05-14 14:23:59 +02:00
Andrey Antukh
d78074307f Merge remote-tracking branch 'origin/main' into staging 2026-05-14 11:07:42 +02:00
Pablo Alba
bf880467b4
🐛 Fix dependency libraries visible in UI after unlinking main library (#9511) 2026-05-13 15:35:42 +02:00
Alejandro Alonso
1a3b057814 🐛 Fix atlas corruption when dragging large shapes after zoom change 2026-05-13 13:00:56 +02:00
Pablo Alba
fffafdab93
🐛 Fix library updates reappear after file is reloaded (#9563) 
* 🐛 Fix library updates reappear after file is reloaded

Summary
Migrate synced_at timestamps to a standalone file_library_sync table to ensure sync state is tracked for both direct and transitive libraries.

Problem
Transitive libraries (libraries imported by other libraries) are not stored as direct rows in file_library_rel. Because the system previously coupled synced_at directly to the file_library_rel schema, transitive libraries lacked a persistent location for their sync timestamps. This caused sync states to be lost or incorrectly reported for nested dependencies.

Changes
Schema Migration: Created file_library_sync and migrated existing synced_at values from file_library_rel.

Decoupling: Removed tight Foreign Key coupling to allow sync rows to exist independently of specific relationship records.

Persistent Writes: Added upsert-file-library-sync! helper. Updated all import, duplication, and RPC write paths (v1/v2/v3 importers, link-file-library) to ensure every write persists a sync row.

Unified Reads: Updated both direct and recursive/transitive library queries to fetch synced_at from the new table.

Testing: Added regression tests to verify that sync rows are correctly created/updated even when a transitive relation is absent in file_library_rel.

Impact
This fix ensures that the system accurately records and retrieves sync states for the entire library dependency tree, resolving the bug where nested libraries appeared out of sync.

* ✨ MR review
 2026-05-13 11:29:05 +02:00
Andrey Antukh
382efe3449 📚 Update changelog 2026-05-12 23:33:39 +02:00
Andrey Antukh
e5c99231da 📚 Update changelog 2026-05-12 18:43:08 +02:00
Andrey Antukh
ade0d2d0a8 📎 Update changelog with PR info 2026-05-12 13:01:42 +02:00
Andrey Antukh
bd3ca6f8e5 📚 Update changelog 2026-05-12 09:33:33 +02:00
Andrey Antukh
6ef231bf38 Merge remote-tracking branch 'origin/main' into staging 2026-05-11 14:04:27 +02:00
Andrey Antukh
b312e6b059 📚 Update changelog 2026-05-11 11:26:54 +02:00
Andrey Antukh
f2c631b8b7 Merge remote-tracking branch 'origin/main-staging' into staging 2026-05-11 09:30:10 +02:00
Andrey Antukh
1a212a2769 Merge remote-tracking branch 'origin/main-staging' 2026-05-11 08:46:25 +02:00
Andrey Antukh
6eba2e6c42 📚 Update changelog 2026-05-10 20:23:10 +02:00
andrés gonzález
9c771ae6b9
🐛 Fix MCP integrations copy button to match displayed URL (#9239) 2026-05-10 19:23:03 +02:00
Andrey Antukh
f414392f13 📎 Update changelog 2026-05-10 09:19:56 +02:00
Andrey Antukh
cf3455a487 📎 Add missing entry on CHANGES.md 2026-05-10 09:18:52 +02:00
Andrey Antukh
10a23a6869 Merge remote-tracking branch 'origin/main' into staging 2026-05-10 09:16:41 +02:00
Francis Santiago
e9588f3939
🐳 Reuse shared Nginx security headers (#9473) 
Signed-off-by: Francis Santiago <francis.santiago@kaleidos.net>
 2026-05-08 14:11:09 +02:00
Andrey Antukh
a50785f105 📎 Update changelog 2026-05-08 09:29:28 +02:00
Andrey Antukh
279231240d
🐛 Harden outbound HTTP requests against SSRF and restrict assets handlers (#9390) 
* ⬆️ Update root deps

* 🐛 Harden outbound HTTP requests against SSRF and restrict unauthenticated asset access

- Add app.util.ssrf URL/host validator that resolves hostnames and blocks
  loopback, link-local, site-local, cloud metadata, and operator-supplied CIDRs
- Add app.media.sanitize image EOF truncator that strips trailing data after
  PNG IEND, JPEG EOI, GIF trailer, and WebP RIFF markers
- Disable HTTP client auto-redirect; add req-with-redirects! helper that
  revalidates every redirect hop against the SSRF blocklist
- Wire SSRF validation and EOF sanitization into media/download-image
- Validate webhook URLs and OIDC profile picture URLs against SSRF
- Restrict /assets/by-id to require authentication for non-public buckets
  (profile) while keeping public access for file-media-object,
  file-object-thumbnail, team-font-variant, and file-data-fragment
- Add config knobs: ssrf-protection-enabled, ssrf-allowed-hosts,
  ssrf-extra-blocked-cidrs

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
 2026-05-08 09:18:22 +02:00
Andrey Antukh
3496435e69 📚 Update changelog 2026-05-08 00:32:21 +02:00
Andrey Antukh
d103feebfa 📚 Update changelog 2026-05-07 23:57:49 +02:00
Andrey Antukh
798ee46b4a 🐛 Bind MCP ReplServer to localhost to prevent unauthenticated RCE 
The ReplServer Express app was calling `app.listen(port)` with no host
argument, causing Node/Express to default to binding on all interfaces
(0.0.0.0). Combined with the unauthenticated /execute endpoint, any
network peer could POST arbitrary JS and get it run inside the MCP
process.

Fix: add a `host` parameter (default "localhost") to the ReplServer
constructor and pass it to `app.listen`. The call site in
PenpotMcpServer now forwards `this.host` (sourced from
PENPOT_MCP_SERVER_HOST env var, default "localhost"), so environment-
variable overrides continue to work.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
 2026-05-07 12:59:31 +02:00