f2460eee29
🐛 Fix Draft.js selection offset DOMException on text editor re-render ( #10608 )
...
Clamp selection offset to node length in setDraftEditorSelection to
prevent DOMException when Draft.js SelectionState offset exceeds the
actual DOM text node length. This can happen during spellcheck, IME
composition, or race conditions during React re-renders.
Updates @penpot/draft-js to commit 09a33e0a which includes the fix
in addPointToSelection and addFocusToSelection.
Fixes #10607
AI-assisted-by: mimo-v2.5-pro
2026-07-09 10:59:40 +02:00
e2b52d88fc
⬆️ Update dependencies
2026-06-30 16:15:30 +02:00
a627d5c4d1
Merge remote-tracking branch 'origin/staging' into develop
2026-06-22 09:52:06 +02:00
960b90253f
⬆️ Update root deps
2026-06-22 09:04:13 +02:00
03341ed857
⬆️ Update npm deps and pnpm on all subpackages ( #10183 )
2026-06-15 13:57:29 +02:00
61c52a665d
⬆️ Update dependencies ( #10166 )
...
* ⬆️ Update exporter dependencies
* ⬆️ Update frontend dependencies
* ⬆️ Update nodejs version devenv and docker images
2026-06-15 12:03:59 +02:00
3419f7e60a
⬆️ Update root repo deps
2026-06-10 11:25:59 +02:00
c5bd583b1f
📎 Update root deps
2026-06-08 09:39:59 +02:00
f457c68355
📎 Backport devenv improvements
2026-06-05 11:44:20 +02:00
d66e8702e7
📎 Update root repo deps
2026-06-01 09:27:58 +02:00
ddba2ffa75
📎 Update Kaleidos Copyright ( #9929 )
2026-05-29 11:24:58 +02:00
e43703c368
📎 Update root dependencies
2026-05-27 10:57:06 +02:00
1161a163a7
⬆️ Update root repo opencode dependency
2026-05-18 19:59:12 +02:00
9b336e9a3d
✨ Add nrepl-eval script and skill
2026-05-10 10:49:53 +02:00
279231240d
🐛 Harden outbound HTTP requests against SSRF and restrict assets handlers ( #9390 )
...
* ⬆️ Update root deps
* 🐛 Harden outbound HTTP requests against SSRF and restrict unauthenticated asset access
- Add app.util.ssrf URL/host validator that resolves hostnames and blocks
loopback, link-local, site-local, cloud metadata, and operator-supplied CIDRs
- Add app.media.sanitize image EOF truncator that strips trailing data after
PNG IEND, JPEG EOI, GIF trailer, and WebP RIFF markers
- Disable HTTP client auto-redirect; add req-with-redirects! helper that
revalidates every redirect hop against the SSRF blocklist
- Wire SSRF validation and EOF sanitization into media/download-image
- Validate webhook URLs and OIDC profile picture URLs against SSRF
- Restrict /assets/by-id to require authentication for non-public buckets
(profile) while keeping public access for file-media-object,
file-object-thumbnail, team-font-variant, and file-data-fragment
- Add config knobs: ssrf-protection-enabled, ssrf-allowed-hosts,
ssrf-extra-blocked-cidrs
Signed-off-by: Andrey Antukh <niwi@niwi.nz >
---------
Signed-off-by: Andrey Antukh <niwi@niwi.nz >
2026-05-08 09:18:22 +02:00
a58dbec8f2
⬆️ Update root repo deps
2026-04-27 20:35:46 +02:00
2d5e50f352
⬆️ Update root repo deps
2026-04-24 08:17:32 +02:00
eeeb698d91
⬆️ Bump opencode-ai dev dependency 1.4.3 -> 1.14.19
...
Signed-off-by: Andrey Antukh <niwi@niwi.nz >
2026-04-20 20:13:15 +02:00
0fc2050526
⬆️ Update deps on root package.json
2026-04-13 15:00:47 +02:00
dfa45ec8d8
⬆️ Update deps on root package.json
2026-04-09 09:10:44 +02:00
9a0ae32488
⬆️ Update opencode dependency on repo root
2026-04-07 16:33:40 +02:00
e7e98255d9
⚡ Add scroll and zoom raf throttling ( #8812 )
...
* ⬆️ Update opencode and copilot deps
* 🐛 Decouple workspace-content from workspace-local to reduce scroll re-renders
Move workspace-local subscription from workspace-content* (parent) into
viewport* and viewport-classic* (children). workspace-content* now only
subscribes to the new workspace-vport derived atom, which changes only on
window resize — not on every scroll event. This prevents the sidebar,
palette and other workspace-content children from re-rendering on scroll.
* 🐛 Throttle wheel events to one state update per animation frame
Accumulate wheel event deltas in a mutable ref and flush them via
requestAnimationFrame, so that multiple wheel events between frames
produce a single state mutation instead of one per event. This prevents
the cascade of synchronous React re-renders (via useSyncExternalStore)
that can exceed the maximum update depth on rapid scrolling.
Both panning (scroll) and zoom (ctrl/mod+wheel) are throttled. Scroll
deltas are summed additively; zoom scales are compounded multiplicatively
with the latest cursor point used as the zoom center.
* ♻️ Extract schedule-zoom! and schedule-scroll! from on-mouse-wheel
* ♻️ Avoid zoom dep on on-mouse-wheel by using a ref
2026-03-30 12:06:56 +02:00
d7e0b0cf9f
📎 Add check-fmt script to root package.json
2026-03-30 11:06:13 +02:00
2ba3605f11
⬆️ Update root repo deps
2026-03-26 13:09:31 +01:00
8729fed724
📎 Add opencode and copilot deps on root package.json
2026-03-24 12:52:56 +01:00
32cf95265a
📚 Add GitHub Copilot instructions ( #8548 )
2026-03-10 13:12:15 +01:00
880b9b61c4
🎉 Integrate mcp repository
...
Original repository: https://github.com/penpot/penpot-mcp
Imported commit: fcfa67e908fc54e23a3a3543dee432472dc90c5d
2026-02-04 12:22:36 +01:00
d20c011db2
✨ Migrate plugins to pnpm
2025-12-30 14:56:15 +01:00
a4646373cf
♻️ Refactor wasm loading strategy on worker
2025-12-09 19:41:19 +01:00
e7029f2182
✨ Make automatic workflows not dependent on yarn
2025-12-01 08:17:52 +01:00
3c05f09fd1
🔧 Fix unnecessary playwright dependency in root dir ( #6577 )
2025-05-28 17:09:05 +02:00
29d23577d2
🎉 Add .penpot (binfile-v3) support for library
2025-05-20 13:06:07 +02:00
d01e3085f4
⬆️ Update yarn to 4.9.1
2025-05-14 10:39:34 +02:00
ff7b77bda7
⬆️ Update yarn
2025-04-01 20:01:21 +02:00
7158c4fd43
✨ Improve yarn setup on devenv
...
And update yarn version to 4.2.2
2024-05-23 12:21:07 +02:00
30321e54f0
📎 Add WebSocket mock
2024-05-07 11:59:33 +02:00
f19298f6b3
🎉 Add clj fmt checking on CI and fmt fix script
2023-11-29 11:48:38 +01:00
3e7db452b9
🔥 Remove node workspaces
2023-11-29 11:25:27 +01:00
01ab34abc5
📎 Set correct version on package.json file
2023-11-29 10:49:25 +01:00
aa2f7df28f
⬆️ Update yarn to 4.0.2 and start using npm workspaces
2023-11-29 10:44:36 +01:00
e21798f1ed
Move all files under frontend directory.
2016-11-20 20:03:17 +01:00
0fdb11e153
Update node dependencies.
2016-11-10 23:39:41 +01:00
c3c6385b54
Update npm dependencies.
2016-07-29 15:40:38 +03:00
9dc94caffd
Restructure build scripts for facilitate incorporate more apps.
2016-06-14 23:50:55 +03:00
17790256ec
Update node dependencies.
2016-05-24 21:52:29 +03:00
2ef31f3e08
Improve initial compilation and add worker compilation to dist.
2016-04-11 18:03:34 +03:00
2f6c632476
Minor improvements on gulpfile.
2016-04-03 13:19:11 +03:00
a192076e0c
Remove gulp-clean from dependencies.
2016-03-03 23:47:31 +02:00
f00c322689
Add template compilation to the gulp pipeline.
...
Just for avoid cache problems in production.
2016-02-28 10:12:25 +02:00
ffbaf87cf5
More fixes on deploy scripts.
2016-02-21 20:50:26 +02:00
Andrey Antukh