Penpot - Package Updates

[Package Updates]

[1.16.4]

• Update penpot to 2.14.4
• Full Changelog

[Package Updates]

[1.16.5]

• Update penpot to 2.14.5
• Full Changelog
• Fix incorrect invitation token handling on register process Github #9380

[Package Updates]

[1.17.0]

• Update penpot to 2.15.2
• Full Changelog
• Add support for chunked uploading of fonts Github #9560
• Add MCP server integration Github #9174
• Add chunked upload API for large media and binary files (removes previous upload size limits) Github #8909
• Improve team name validation Github #9176
• Fix MCP integrations URL copy action to match the URL displayed in settings Github #9238
• Fix Plugin API token methods rejecting JS array of strings Github #9162
• Harden Nginx responses with standard security headers and hide upstream X-Powered-By headers
• Fix MCP ReplServer binding to all interfaces (0.0.0.0) instead of localhost, allowing unauthenticated RCE Github #9400
• Fix SSRF in media URL import and restrict unauthenticated asset access to public buckets only Github #9390
• Fix maximum call stack size exceeded in SSE read-stream Github #9470

[Package Updates]

[1.17.1]

• Update penpot to 2.15.3
• Full Changelog
• Fix Plugin API token methods failing with schema validation error on PRO Github #9641
• Sanitize comment content on rendering Github #9642
• Sanitize font family names on custom uploaded fonts Github #9643

[Package Updates]

[1.17.2]

• Update penpot to 2.15.4
• Full Changelog
• Add rate limiting and concurrency safety for file snapshot operations #9723 (MR: #9722)
• Prevent concurrent font uploads from causing excessive simultaneous requests #9922 (MR: #9921)
• Emit create-shape-layout for flex/grid layout creation from plugins and MCP (same event as workspace) #9652 (MR: #9654)
• Fix broken authentication on /assets handlers #9677 (MR: #9679)
• Fix API doc endpoint returning HTML as text/plain #9680 (MR: #9681)
• Fix unexpected error when opening the export dialog #9721 (MR: #9704)

[Package Updates]

[1.18.0]

• Update penpot to 2.16.0
• Full Changelog
• WebGL rendering (beta) user preference #9683 (MR:9113)
• Design Tokens at the design tab: numeric fields with token selection in place #9358
• Add delete group to assets panel context menu (by @FairyPigDev) #9141 (MR: #9151, #9211)
• Add HEX/HSB/HSL support to color picker with persistent model switcher (by @edwin-rivera-dev) #9133 (MR: #9134)
• Add Find & Replace for text content and layer names (by @statxc) #7108 (MR: #8899, #9687)
• Add read-only preview mode for saved versions (by @wdeveloper16) #7622 (MR: #8976, #9514)
• Fix library update button freezing #9330 (MR: #9513)
• Fix team invitation not automatically accepted after account validation #9776 (MR: #9782)
• Fix publishing or unpublishing file as library failing with unexpected state found error #10094 (MR: #10093)
• Fix team invitation failing when email address contains consecutive dots in domain #10097 (MR: #10096)

[Package Updates]

[1.18.1]

• Added enable-access-tokens and enable-mcp flags and handler for extra flags

[Package Updates]

[1.18.2]

• Update penpot to 2.16.1
• Full Changelog
• Batch multiple thumbnail deletions into a single RPC call #9944 (MR: #9943)
• Add WebSocket proxy configuration for MCP in Nginx example (by @lancatlin) #10153 (MR: #10152)
• Add tenant prefix to MCP Redis channel names for multi-environment isolation #10277 (MR: #10276)
• Show MCP key on Integrations page and remove non-recoverable warning from modal #10290 (MR: #10298)
• Add MCP status button with single-tab connection control #9923 (MR: #9930)
• Fix race condition between MCP initialization and plugin runtime #10138 (MR: #10137)
• Filter ignorable React removeChild errors from browser extensions in error boundary #10146 (MR: #10145)
• Show resolved values in font family token combobox when pasting comma-separated values #10212 (MR: #10215)
• Fix MCP server status toggle persistence and missing workspace connection options #10292 (MR: #10226)
• Allow pasting comma-separated emails in the invite members modal #10173 (MR: #10186)

[Package Updates]

[1.18.3]

• Update penpot to 2.16.2
• Full Changelog
• Fix error 500 when submitting the contact form #10178 (MR: #10419)
• Fix text editor modifying content and detaching applied typography tokens #10389 (MR: #10402)

[Package Updates]

[1.19.0]

• Update penpot to 2.17.0
• Full Changelog
• Render prototype viewer with WASM (Skia) engine instead of SVG #10037 (MR: #10038)
• Add dashed stroke customization with dash and gap inputs (by @EvaMarco) #3881 (MR: #9765)
• Add layer blur effect #9844 (MR: #10034)
• Add list view mode to color picker UI #4420 (MR: #9953)
• Add separate internal URI for exporter to handle Docker deployments where internal and public URIs differ #10627 (MR: #10630)
• Fix Copy as SVG: emit a single valid SVG document when multiple shapes are selected, and publish image/svg+xml to the clipboard so the paste target works in Inkscape and other SVG-native tools Github #838
• Fix SVG stroke line join not applied when pasting strokes #4836 (MR: #9982, #10019)
• Fix color picker eyedropper returning wrong color values on some GPUs #10135 (MR: #10255)
• Fix negative margins no longer working #10001 (MR: #10353)
• Fix workspace crash when converting SVG-raw shape to path #10612 (MR: #10613)

[Package Updates]

[1.19.1]

• Update penpot to 2.17.1
• Full Changelog
• Fix malformed get-font-variants request when team-id is missing from dashboard URL #10644 (MR: #10645)
• Fix malformed get-profiles-for-file-comments request when file-id is missing from workspace URL #10652 (MR: #10655)
• Fix workspace crash when holding an arrow key on a selection due to excessive re-renders #10726 (MR: #10736)
• Fix asset download failing with S3 auth conflict when using access token #10776 (MR: #10777)
• Fix internal error when dragging inner layout with Boolean operations #10647 (MR: #10778)
• Fix viewer crash with WASM panic when opening URL with page-id #10800 (MR: #10805)

[Package Updates]

[1.19.2]

• install imagick 7 from source

[Package Updates]

[1.19.3]

• Update penpot to 2.17.2
• Full Changelog
• Fix linear gradients in SVG text exports being emitted as radial gradients #5972 (MR: #11272)
• Fix typography token becoming detached when editing text content #11362 (MR: #11366)
• Fix command injection in SVG exporter via legacy fill-color (https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86)

[Package Updates]

[1.20.0]

• Update penpot to 2.18.0
• Full Changelog
• Group toolbar drawing tools into shape and free-draw flyouts #9316 (MR: #9480, #10354)
• Add dedicated Line and Arrow drawing tools (by @davidv399) #9145 (MR: #9146)
• Show and manage comments while designing in the workspace #10239 (MR: #10275)
• Add outline stroke to Paths #9961 (MR: #8677)
• Add a grid/list view toggle for files in the dashboard #10691 (MR: #10692)
• Add multi-selection and bulk delete support to pages in the workspace sitemap #10580 (MR: #10581)
• Fix LDAP authentication storing client-supplied email instead of directory email and not escaping filter special characters #11084 (MR: #11085)
• Fix sessions remaining active on other devices after account deletion #11114 (MR: #11115)
• Fix backend session remaining valid after logout when the auth-token cookie is replayed #11316 (MR: #11317)
• Sanitize embedded scripts in SVG uploads #11043 (MR: #11044)

[Package Updates]

[1.20.1]

• Update penpot to 2.18.1
• Full Changelog
• Fix workspace freezing with a stack overflow when opening the context menu on a shape that isn't on the current page #11882 (MR: #11891)
• Fix workspace showing repeated error toasts when a third-party script injected into the page throws #11813 (MR: #11816)
• Fix register flow from workspace URL not working #11753 (MR: #11756)
• Fix empty response when exporting bin using API (by @filipsajdak) #7649 (MR: #10341)

[Package Updates]

[1.20.2]

• Update penpot to 2.18.2
• Full Changelog
• Fix workspace showing an internal error when syncing components or dragging in the color picker #11933 (MR: #11941)
• Fix SVG sanitizer keeping namespace-prefixed script elements when uploading SVG files #12071 (MR: #12073)

[Package Updates]

[1.20.3]

• Update penpot to 2.18.3
• Full Changelog
• Fix binfile import storing unsanitized SVG and missing obfuscated SVG content-types #12104 (MR: #12105)
• Fix removed team members keeping file access after leaving the team #12106 (MR: #12097)

[Package Updates]

[1.20.4]

• Update base | stage to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[1.21.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[1.21.1]

• Update penpot to 2.18.4
• Full Changelog
• Fix storage GC deleting nothing when one pending object is still referenced #12276 (MR: #12269)
• Fix objects GC stopping file deletion when one file still has a child row #12277 (MR: #12269)
• Fix file restore leaving its storage objects marked for deletion #12278 (MR: #12269)
• Fix backend workers staying parked forever when nested calls take the same concurrency limits #12279 (MR: #12269)
• Fix one profile's activity blocking the audit events of every other profile #12280 (MR: #12269)
• Fix storage garbage collection blocking database vacuum during long deletions #12396 (MR: #12397)
• Fix saving a version taking seconds and the version quota never counting saved versions #12404 (MR: #12405)
• Fix file_change accumulating revisions that the objects GC never collects #12418 (MR: #12419)
• Add a graceful instance drain through the /readyz endpoint #12281 (MR: #12269)
• Add an accumulated queue gauge to the CLIMIT metrics #12282 (MR: #12269)