-
v2026.8.15
StableAll checks were successfulCI / release-scripts (pull_request) Successful in 6ssecurity-scan / SBOM (trivy) (pull_request) Successful in 10ssecurity-scan / Filesystem scan (trivy fs) (pull_request) Successful in 14ssecurity-scan / JS SCA (npm audit) (pull_request) Successful in 14ssecurity-scan / Python SAST (bandit) (pull_request) Successful in 19ssecurity-scan / Python SCA (pip-audit) (pull_request) Successful in 36sCI / pre-commit (pull_request) Successful in 56stest-build / build (frontend) (pull_request) Successful in 59sCI / frontend-test (pull_request) Successful in 59stest-build / build (backend) (pull_request) Successful in 1m5stest-build / build (pull_request) Successful in 0sCI / backend-test (pull_request) Successful in 2m17sCI / e2e (pull_request) Successful in 3m24sCI / release-scripts (push) Successful in 10ssecurity-scan / Filesystem scan (trivy fs) (push) Successful in 23ssecurity-scan / Python SAST (bandit) (push) Successful in 37ssecurity-scan / SBOM (trivy) (push) Successful in 13ssecurity-scan / JS SCA (npm audit) (push) Successful in 29ssecurity-scan / Python SCA (pip-audit) (push) Successful in 53srelease-and-deploy / release (push) Successful in 35srelease-and-deploy / release-scripts (push) Successful in 11spublish-main / build (frontend) (push) Successful in 2m13sCI / pre-commit (push) Successful in 2m42srelease-and-deploy / frontend-test (push) Successful in 2m22spublish-main / build (backend) (push) Successful in 3m26spublish-main / build (push) Successful in 0srelease-and-deploy / build (frontend) (push) Successful in 2m57srelease-and-deploy / pre-commit (push) Successful in 3m21srelease-and-deploy / build (backend) (push) Successful in 3m47srelease-and-deploy / build (push) Successful in 0sCI / frontend-test (push) Successful in 2m17sCI / backend-test (push) Successful in 9m15sCI / e2e (push) Successful in 9m42srelease-and-deploy / backend-test (push) Successful in 8m57srelease-and-deploy / e2e (push) Successful in 8m48srelease-and-deploy / ci (push) Successful in 0srelease-and-deploy / deploy (push) Successful in 1m49sreleased this
2026-08-15 20:19:50 +00:00 | 23 commits to main since this releaseThe composer edits markdown as text
- Reply, new message and notes run on the design system's editor instead of
Tiptap. You edit the markdown itself: the syntax shows on the line you are on
and is hidden elsewhere, the ``` of a code block included. - Tab nests a list item and indents inside a code block, Shift+Tab reverses it,
and Escape leaves the field before a second Escape closes the window. - A long message keeps the toolbar and the send button in view: the typing
surface grows to twenty lines, then scrolls. - The link bar lost its "Openen" button - the editor shows one beside the link
the cursor is in. - Fixed along the way, most visibly: the reply box had no accessible name,
pasting a screenshot over selected text deleted the text, the emoji list and
picker opened off screen on a scrolled page, and Escape from the link bar's
buttons closed the whole card. The rest is ingit log. - The toolbar's line markers (list, task, quote, heading, code block) now work
on an empty line, switch to another type, and put the cursor after the
marker instead of in front of it.
Menu and page titles
- The menu now sits behind a labeled "Menu" button: fixed top right on a wide
screen, beside the wordmark on a phone. Its items are real links
(cmd/ctrl-click opens a new tab), with the overview pages grouped under
"Overzichten". - The wordmark is a plain link to the Inbox above the page, and it scrolls
away with the content. - Inbox, Leeslijst and Instellingen have a visible page title, and the browser
tab follows the page ("Inbox - Waggle"). - Every page shares one left edge: titles, search, cards and the settings
sections all follow the design system's page gutter. - The inbox tour lost its menu step, and no longer jumps while the banners
load, ends on a click beside it, races through steps, or hides its card
steps under the modal.
Channel window
- Every root in the channel window now shows its reply count and unfolds in
place - until now only the saved message's own thread did.
Fixed
- Moving a card within its own list no longer drifts a slot off after half a
dozen moves into the same spot: positions are now also redistributed on a
reorder, not only when a card changes list. - A card moved with the keyboard now scrolls fully back into view instead of
stopping half under the fold. - Text in a dialog is the content colour again instead of pure black or white.
A native<dialog>carries the UA'scolor: CanvasText, which cut the
document colour off above every overlay.
Under the hood
- The composer has 21 props instead of 27, and the formatting toolbar gets its
own tests. - The app loads 39% less JavaScript (919 kB gzip to 556 kB), because the design
system is imported per component instead of as one chunk; see WDR-0005. - The Mattermost client now handles an unexpected response body the same way in
get_thread,get_postandget_channel_posts. The first two coerced before
they checked, which made the empty-thread branch unreachable. - The pinned-trivy-binary variables are scoped to the SBOM job that uses them,
so aTRIVY_-prefixed name no longer reaches the containerised filesystem
scan, where it lands in trivy's own config namespace. - CI downloads the pinned uv and trivy binaries with
--failand three retries.
Without--failan HTTP error was written to the tarball and reported as a
checksum mismatch, so a rate-limited download looked like a tampered binary. - The test schema is now keyed on the checkout as well as the xdist worker, so
two worktrees running the suite against the same database no longer drop each
other's tables mid-run. - The synthetic dev users, the Mattermost mock, the passwordless-login routes
and the synthetic-user bootstrap moved tobackend/devtools/, which the
container image does not copy; no dev-only code ships any more. - The container build now asserts it:
import wagglesucceeds and
import devtoolsfails in the built image. - Dependency bumps: uvicorn 0.52.3, sqlalchemy 2.0.52, ruff 0.16.3, ty 0.0.72,
the CodeMirror and Lezer packages, vue-tsc 3.3.10, typescript-eslint 8.67 and
nanoid 3.3.18 (CVE-2026-67213), plus the CI images (uv 0.12.5, trivy 0.74,
renovate 44.30) and the Postgres 17 digest. Tiptap is gone as a dependency.
Container images
- Reply, new message and notes run on the design system's editor instead of