Software-update: Penpot 2.18.0

Penpot is een opensource ontwerpprogramma waar programmeurs en grafische ontwikkelaars in kunnen samenwerken. Het is vergelijkbaar met software zoals Figma en Lunacy. Een basisversie kan gratis worden gebruikt en er zijn ook betaalde mogelijkheden met extra functionaliteit en betere ondersteuning. In alle gevallen heb je de mogelijkheid om het zelf te hosten of om van de cloud van Penpot gebruik te maken. Versie 2.18.0 is uitgekomen en hier zijn de volgende veranderingen en verbeteringen in aangebracht:

Epics and highlights

• Group toolbar drawing tools into shape and free-draw flyouts #9316 (PR: #9480, #10354)
• Add dedicated Line and Arrow drawing tools #9145 (PR: #9146)
• Show and manage comments while designing in the workspace #10239 (PR: #10275)

Bugs fixed

• Fix MCP integration hanging when the Penpot tab is backgrounded or frozen by the browser #10323 (PR: #10392)
• Fix synced component copy not reflowing children after spacing token update #9892
• Fix spacebar activating pan mode while typing a comment #10285 (PR: #10287)
• Fix plugin API rejecting negative letterSpacing values #9780 (PR: #10257)
• Fix plugin API addTheme calls failing with the signature shown in the high-level overview #10074 (PR: #10359)
• Fix empty text shape not being deleted on editor exit #10540 (PR: #10541)
• Fix broken token pills showing wrong default state when not selected #10524 (PR: #10535)
• Fix Chinese (zh-CN) translation showing wrong label for Intersection in board path menu #10346 (PR: #10381)
• Fix invalid formulas being accepted in numeric inputs #9581 (PR: #10659)
• Fix radial gradient handles blowing up in size when rotated on ellipses #10069 (PR: #10666)
• Fix plugin API validation errors being too generic to diagnose the failure #10072 (PR: #10667)
• Fix crash with referential integrity error when deleting a component inside a grid #10101 (PR: #10956)
• Fix component copies not preserving rotation when the main component has changes #10109 (PR: #10574)
• Fix text width and height staying stale after setting growType in the plugin API #10207 (PR: #9898)
• Fix padding not painted until expanding the 4-sides padding option #10278 (PR: #10602)
• Fix files with custom fonts breaking with a referential integrity error when moved between teams #10496 (PR: #10837)
• Fix clicking overlapping comment bubbles zooming to 20000% without showing the comments #10526 (PR: #10543)
• Fix user menu subsections in the dashboard not closing when hovering away from the parent option #10549 (PR: #10639)
• Fix self-hosted env-generated config.js being cached for 7 days so PENPOT_FLAGS changes did not reach already-cached browsers #10556 (PR: #11146)
• Fix color of selected text in light theme #10570 (PR: #10614)
• Fix margin input order being inconsistent with padding inputs and between collapsed and expanded states #10578 (PR: #10797)
• Fix uncaught DOMException when writing image/svg+xml content to the clipboard #10596 (PR: #10663)
• Fix tick icons not aligned in the font selector #10597 (PR: #10774)
• Fix incorrect padding values when multiple shapes are selected #10598 (PR: #10602)
• Fix integrity errors related to variants not being repaired #10606 (PR: #10768)
• Fix changing password showing 'Password should be at least 8 characters' error on the old password field #10626 (PR: #10661)
• Fix stroke caps disappearing when dragging #10633 (PR: #10634)
• Fix layout padding being saved as string after invalid input in multi-selection, causing persistence errors #10638 (PR: #10758)
• Fix inconsistent theme handling between Penpot and plugins #10676 (PR: #10677)
• Fix image stroke (strokeImage) support missing in the plugin API Stroke interface #10682 (PR: #10683)
• Fix SVG images not working as fill in the WebGL renderer #10705 (PR: #10707)
• Fix background blur not working on text shapes #10706 (PR: #10712)
• Fix background blur not applying on strokes #10713 (PR: #10716)
• Fix text shape with empty content breaking workspace updates #10725 (PR: #10731)
• Fix missing SVG option in the file filters when adding an image fill #10756 (PR: #10771)
• Update onboarding image #10779 (PR: #10783)
• Fix main toolbar overlapping the grid edition bar #10788 (PR: #10789)
• Fix WASM renderer panic when the WebGL context is restored mid-reload #10810 (PR: #10824)
• Fix nginx frontend forwarding the client Host header to backend/exporter, breaking Istio strict mTLS routing #10835 (PR: #11233)
• Fix tutorial templates with components causing errors #10839
• Fix plugin 'Try out' flow crashing when projects have not loaded yet #10858 (PR: #10859)
• Fix collapsed Fill color section on the design panel for new texts #10860 (PR: #10972)
• Fix grid item date tooltip in the project view showing 'Will be deleted' instead of creation date #10873 (PR: #11161)
• Merge stop and start measurement shortcut to match current behavior #10884 (PR: #10906)
• Fix shape size badge displayed twice when a user with Viewer permissions selects a shape #10893 (PR: #10985)
• Fix main menu being covered by the toolbar #10902 (PR: #10926)
• Fix font family typography asset persisting across files in newly created text layers #10925 (PR: #11134)
• Fix error raised when editing justified text #10944 (PR: #10945)
• Fix MCP WebSocket proxy failing after penpot-mcp container restarts due to stale nginx DNS resolution #10946 (PR: #10947)
• Fix verification email address being unreadable due to low-contrast text on the register success page #10950 (PR: #10965)
• Fix image swatches displaying a wrong format in the color picker list view #10951 (PR: #10975)
• Fix text editor crashing when dropping dragged text after selecting all content #10954 (PR: #10959)
• Fix MCP tokens being usable as API access tokens #10960 (PR: #10962)
• Add size limit and rate limiting to the send-user-feedback endpoint #10979 (PR: #10990)
• Fix main menu not keeping alignment when the left sidebar is expanded #10981 (PR: #10986)
• Fix update-profile-props RPC method accepting undocumented keys #10991 (PR: #10992)
• Fix import-binfile RPC method schema accepting a file-id parameter #10993 (PR: #10994)
• Fix assemble-chunks session lookup ignoring the profile-id scope #11011 (PR: #11012)
• Validate font-id team ownership in create-font-variant #11013 (PR: #11014)
• Validate team ownership on file library link endpoints #11015 (PR: #11016)
• Limit object size allocation in the V1 binfile parser #11017 (PR: #11018)
• Limit recursion depth in the Fressian reader #11019 (PR: #11020)
• Limit concurrent imports in the import-binfile RPC method #11023 (PR: #11024)
• Validate content-type on management upload endpoints #11025 (PR: #11026)
• Fix webhook endpoints allowing unauthorized access via creator-id fallback #11028 (PR: #11029)
• Escape markdown in user-controlled fields of Mattermost error notifications #11033 (PR: #11034)
• Enforce file read permission check on asset endpoints #11035 (PR: #11036)
• Add accumulated storage byte quota for media uploads #11037 (PR: #11038)
• Add bounding box dimension limit to exports #11041 (PR: #11042)
• Sanitize embedded scripts in SVG uploads #11043 (PR: #11044)
• Fix duplicate file ID returning inconsistent error responses #11045 (PR: #11050)
• Enforce permission checks in WebSocket subscription handlers #11052 (PR: #11054)
• Fix 'something went wrong' popup when using incremental numerical input interaction #11053 (PR: #10794)
• Enforce password complexity validation on the backend #11055 (PR: #11059)
• Normalize string inputs before processing #11060 (PR: #11061)
• Add cooldown to avoid sending duplicate invitation emails #11062 (PR: #11063)
• Enable SSRF protection for organization SSO validation #11064 (PR: #11065)
• Fix LDAP authentication storing client-supplied email instead of directory email and not escaping filter special characters #11084 (PR: #11085)
• Fix clone-file-media-object allowing to clone media objects from files without read access #11087 (PR: #11090)
• Fix 404 error page logo not visible in dark mode #11091 (PR: #11167)
• Fix incorrect permission handling when creating an invitation #11098 (PR: #11099)
• Reject zero or negative total-chunks values in upload sessions #11103 (PR: #11104)
• Fix import-binfile accepting unsupported version values without validation #11105 (PR: #11107)
• Fix sessions remaining active on other devices after account deletion #11114 (PR: #11115)
• Use random UUIDs for share link IDs instead of a predictable scheme #11116 (PR: #11117)
• Fix plugin manifest fetch hanging indefinitely without timeout #11119 (PR: #11120)
• Use constant-time comparison for shared key authentication #11121 (PR: #11122)
• Fix ESC key not closing the comment input box after posting a comment in the workspace #11128 (PR: #11131)
• Fix token edit modal crashing when resolving tokens with group nodes #11143 (PR: #11144)
• Fix text editor crashing when pasting into an empty text shape #11149 (PR: #11150)
• Fix comment avatars appearing on top of rulers when scrolling the canvas #11163 (PR: #11168)
• Fix infinite loop of get-teams and get-team-members calls when granting team access from an email link #11215 (PR: #11223)
• Fix RPC requests bypassing rate limiting with fractional bucket refill intervals #11253 (PR: #11254)
• Fix tempfile bucket serving objects to any authenticated user instead of only the uploader #11269 (PR: #11270)
• Fix increasing a value by clicking and dragging in a numeric input #11274 (PR: #11334)
• Fix notification pill rendering unescaped HTML in the detail section when importing tokens #11276 (PR: #11275)
• Fix share-link holders reading pages outside the authorized scope via the get-page RPC command #11281 (PR: #11284)
• Fix incorrect permission handling when managing share links on a file #11289 (PR: #11290)
• Fix backend session remaining valid after logout when the auth-token cookie is replayed #11316 (PR: #11317)
• Fix get-team-invitation-token requiring only read permissions #11358 (PR: #11359)
• Fix missing text in legacy SVG board thumbnails #10182 (PR: #11552)
• Fix workspace crash when applying transform modifiers in the WASM renderer #10894 (PR: #10896)
• Fix double-click on text bounding box entering edit mode instead of applying auto-width/auto-height with the WebGL renderer #10934 (PR: #11068)
• Limit ZIP entry count and object size on V3 binfile import #11021 (PR: #11022)
• Block plugin UI iframe URLs targeting the Penpot domain #11271 (PR: #11273)
• Restrict the MCP REPL code execution endpoint to development environments #11283 (PR: #11282)
• Filter share-link tokens from the get-view-only-bundle response #11285 (PR: #11286)
• Fix HTTP error responses disclosing internal database and filesystem paths to API clients #11287 (PR: #11288)
• Disable MCP developer tools in multi-user mode #11291 (PR: #11310)
• Fix Hide comments setting being ignored after opening the Comments section #11308 (PR: #11492)
• Block NAT64/6to4/Teredo IPv6 transition addresses in the SSRF guard #11319 (PR: #11320)
• Prevent team admins from removing the team owner #11367 (PR: #11368)
• Enforce share-link comment permissions and page scope #11370 (PR: #11371)
• Clean up orphaned teams, projects and files on profile deletion #11394 (PR: #11395)
• Use constant-time comparison for Management API shared key authentication #11426 (PR: #11534)
• Fix crash when pressing Ctrl+D with no shape selected #11448 (PR: #11491)
• Fix text layout not updating when auto-width is set by double-clicking the bounding box #11480 (PR: #11541)
• Fix workspace crash with index out of bounds when removing multiple interactions rapidly #11546 (PR: #11621)
• Fix workspace crash with 'too much recursion' error when editing grid layout #11562 (PR: #11563)
• Fix plugin API error when removing interactions #11618 (PR: #11621)
• Fix MCP REPL server starting in multi-user mode and inheriting the main server bind address #11631 (PR: #11632)
• Fix chunked upload storing duplicate objects when the same chunk index is sent twice #11634 (PR: #11635)
• Fix access token expiration select always showing Never after picking another option #11663 (PR: #11664)
• Fix workspace dropping unsaved changes when read-only blocks persistence #11672 (PR: #11699)
• Fix Plugin API failing silently when writing to an interaction the shape no longer has #11780 (PR: #11781)

New features & Enhancements

• Group toolbar drawing tools into shape and free-draw flyouts #9316 (PR: #9480, #10354)
• Add outline stroke to Paths #9961 (PR: #8677)
• Add dedicated Line and Arrow drawing tools #9145 (PR: #9146)
• Refactor wasm rulers and UI state #10116 (PR: #10461)
• Improve team invitations modal in the dashboard #10484 (PR: #10459)
• Highlight the first matching font in the font list when searching #3204 (PR: #9512, #10450)
• Preserve token references when copying and pasting properties instead of resolving them to values #9582 (PR: #10665)
• Add waitForLayoutUpdate method to the plugin API #10136 (PR: #9898)
• Show and manage comments while designing in the workspace #10239 (PR: #10275)
• Simplify MCP server configuration for common MCP clients #10355 (PR: #10604)
• Remove misleading MCP client JSON snippet from the key-generated modal #10399 (PR: #10415)
• Preview font families in the font selector #10403 (PR: #10411)
• Remember expanded/collapsed state of token sets in the color tokens picker (session scope) #10551 (PR: #10864)
• Show token sets in reverse order by default in the color tokens picker #10552 (PR: #10658)
• Show token sets in reverse order by default in the color tokens picker #10552 (PR: #10658)
• Add multi-selection and bulk delete support to pages in the workspace sitemap #10580 (PR: #10581)
• Add a grid/list view toggle for files in the dashboard #10691 (PR: #10692)
• Migrate Docker images to Docker Hardened Images (DHI) #10720 (PR: #10732, #10733, #10734)
• Adopt React Aria #10802 (PR: #10675)
• Add plugin API function for awaiting component updates beyond waitForLayoutUpdate #10927 (PR: #10964)
• Emit open-workspace-file audit event with file statistics on workspace load #11106 (PR: #11138)
• Restrict optional ids to v4, v7 and v8 UUIDs in creation RPC endpoints #11778 (PR: #11777)

Versienummer	2.18.0
Releasestatus	Final
Besturingssystemen	Platformonafhankelijk
Website	Penpot
Download	https://penpot.app
Licentietype	Open source/betaald