Penpot - Package Updates

[Package Updates]

[1.16.4]

• Update penpot to 2.14.4
• Full Changelog

[Package Updates]

[1.16.5]

• Update penpot to 2.14.5
• Full Changelog
• Fix incorrect invitation token handling on register process Github #9380

[Package Updates]

[1.17.0]

• Update penpot to 2.15.2
• Full Changelog
• Add support for chunked uploading of fonts Github #9560
• Add MCP server integration Github #9174
• Add chunked upload API for large media and binary files (removes previous upload size limits) Github #8909
• Improve team name validation Github #9176
• Fix MCP integrations URL copy action to match the URL displayed in settings Github #9238
• Fix Plugin API token methods rejecting JS array of strings Github #9162
• Harden Nginx responses with standard security headers and hide upstream X-Powered-By headers
• Fix MCP ReplServer binding to all interfaces (0.0.0.0) instead of localhost, allowing unauthenticated RCE Github #9400
• Fix SSRF in media URL import and restrict unauthenticated asset access to public buckets only Github #9390
• Fix maximum call stack size exceeded in SSE read-stream Github #9470

[Package Updates]

[1.17.1]

• Update penpot to 2.15.3
• Full Changelog
• Fix Plugin API token methods failing with schema validation error on PRO Github #9641
• Sanitize comment content on rendering Github #9642
• Sanitize font family names on custom uploaded fonts Github #9643

[Package Updates]

[1.17.2]

• Update penpot to 2.15.4
• Full Changelog
• Add rate limiting and concurrency safety for file snapshot operations #9723 (MR: #9722)
• Prevent concurrent font uploads from causing excessive simultaneous requests #9922 (MR: #9921)
• Emit create-shape-layout for flex/grid layout creation from plugins and MCP (same event as workspace) #9652 (MR: #9654)
• Fix broken authentication on /assets handlers #9677 (MR: #9679)
• Fix API doc endpoint returning HTML as text/plain #9680 (MR: #9681)
• Fix unexpected error when opening the export dialog #9721 (MR: #9704)

[Package Updates]

[1.18.0]

• Update penpot to 2.16.0
• Full Changelog
• WebGL rendering (beta) user preference #9683 (MR:9113)
• Design Tokens at the design tab: numeric fields with token selection in place #9358
• Add delete group to assets panel context menu (by @FairyPigDev) #9141 (MR: #9151, #9211)
• Add HEX/HSB/HSL support to color picker with persistent model switcher (by @edwin-rivera-dev) #9133 (MR: #9134)
• Add Find & Replace for text content and layer names (by @statxc) #7108 (MR: #8899, #9687)
• Add read-only preview mode for saved versions (by @wdeveloper16) #7622 (MR: #8976, #9514)
• Fix library update button freezing #9330 (MR: #9513)
• Fix team invitation not automatically accepted after account validation #9776 (MR: #9782)
• Fix publishing or unpublishing file as library failing with unexpected state found error #10094 (MR: #10093)
• Fix team invitation failing when email address contains consecutive dots in domain #10097 (MR: #10096)

[Package Updates]

[1.18.1]

• Added enable-access-tokens and enable-mcp flags and handler for extra flags

[Package Updates]

[1.18.2]

• Update penpot to 2.16.1
• Full Changelog
• Batch multiple thumbnail deletions into a single RPC call #9944 (MR: #9943)
• Add WebSocket proxy configuration for MCP in Nginx example (by @lancatlin) #10153 (MR: #10152)
• Add tenant prefix to MCP Redis channel names for multi-environment isolation #10277 (MR: #10276)
• Show MCP key on Integrations page and remove non-recoverable warning from modal #10290 (MR: #10298)
• Add MCP status button with single-tab connection control #9923 (MR: #9930)
• Fix race condition between MCP initialization and plugin runtime #10138 (MR: #10137)
• Filter ignorable React removeChild errors from browser extensions in error boundary #10146 (MR: #10145)
• Show resolved values in font family token combobox when pasting comma-separated values #10212 (MR: #10215)
• Fix MCP server status toggle persistence and missing workspace connection options #10292 (MR: #10226)
• Allow pasting comma-separated emails in the invite members modal #10173 (MR: #10186)

[Package Updates]

[1.18.3]

• Update penpot to 2.16.2
• Full Changelog
• Fix error 500 when submitting the contact form #10178 (MR: #10419)
• Fix text editor modifying content and detaching applied typography tokens #10389 (MR: #10402)

[Package Updates]

[1.19.0]

• Update penpot to 2.17.0
• Full Changelog
• Render prototype viewer with WASM (Skia) engine instead of SVG #10037 (MR: #10038)
• Add dashed stroke customization with dash and gap inputs (by @EvaMarco) #3881 (MR: #9765)
• Add layer blur effect #9844 (MR: #10034)
• Add list view mode to color picker UI #4420 (MR: #9953)
• Add separate internal URI for exporter to handle Docker deployments where internal and public URIs differ #10627 (MR: #10630)
• Fix Copy as SVG: emit a single valid SVG document when multiple shapes are selected, and publish image/svg+xml to the clipboard so the paste target works in Inkscape and other SVG-native tools Github #838
• Fix SVG stroke line join not applied when pasting strokes #4836 (MR: #9982, #10019)
• Fix color picker eyedropper returning wrong color values on some GPUs #10135 (MR: #10255)
• Fix negative margins no longer working #10001 (MR: #10353)
• Fix workspace crash when converting SVG-raw shape to path #10612 (MR: #10613)