• v2026.8.15 63cb8fffce

    v2026.8.15
    All checks were successful
    CI / release-scripts (pull_request) Successful in 6s
    security-scan / SBOM (trivy) (pull_request) Successful in 10s
    security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 14s
    security-scan / JS SCA (npm audit) (pull_request) Successful in 14s
    security-scan / Python SAST (bandit) (pull_request) Successful in 19s
    security-scan / Python SCA (pip-audit) (pull_request) Successful in 36s
    CI / pre-commit (pull_request) Successful in 56s
    test-build / build (frontend) (pull_request) Successful in 59s
    CI / frontend-test (pull_request) Successful in 59s
    test-build / build (backend) (pull_request) Successful in 1m5s
    test-build / build (pull_request) Successful in 0s
    CI / backend-test (pull_request) Successful in 2m17s
    CI / e2e (pull_request) Successful in 3m24s
    CI / release-scripts (push) Successful in 10s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 23s
    security-scan / Python SAST (bandit) (push) Successful in 37s
    security-scan / SBOM (trivy) (push) Successful in 13s
    security-scan / JS SCA (npm audit) (push) Successful in 29s
    security-scan / Python SCA (pip-audit) (push) Successful in 53s
    release-and-deploy / release (push) Successful in 35s
    release-and-deploy / release-scripts (push) Successful in 11s
    publish-main / build (frontend) (push) Successful in 2m13s
    CI / pre-commit (push) Successful in 2m42s
    release-and-deploy / frontend-test (push) Successful in 2m22s
    publish-main / build (backend) (push) Successful in 3m26s
    publish-main / build (push) Successful in 0s
    release-and-deploy / build (frontend) (push) Successful in 2m57s
    release-and-deploy / pre-commit (push) Successful in 3m21s
    release-and-deploy / build (backend) (push) Successful in 3m47s
    release-and-deploy / build (push) Successful in 0s
    CI / frontend-test (push) Successful in 2m17s
    CI / backend-test (push) Successful in 9m15s
    CI / e2e (push) Successful in 9m42s
    release-and-deploy / backend-test (push) Successful in 8m57s
    release-and-deploy / e2e (push) Successful in 8m48s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / deploy (push) Successful in 1m49s
    Stable

    robbertbos released this 2026-08-15 20:19:50 +00:00 | 23 commits to main since this release

    The composer edits markdown as text

    • Reply, new message and notes run on the design system's editor instead of
      Tiptap. You edit the markdown itself: the syntax shows on the line you are on
      and is hidden elsewhere, the ``` of a code block included.
    • Tab nests a list item and indents inside a code block, Shift+Tab reverses it,
      and Escape leaves the field before a second Escape closes the window.
    • A long message keeps the toolbar and the send button in view: the typing
      surface grows to twenty lines, then scrolls.
    • The link bar lost its "Openen" button - the editor shows one beside the link
      the cursor is in.
    • Fixed along the way, most visibly: the reply box had no accessible name,
      pasting a screenshot over selected text deleted the text, the emoji list and
      picker opened off screen on a scrolled page, and Escape from the link bar's
      buttons closed the whole card. The rest is in git log.
    • The toolbar's line markers (list, task, quote, heading, code block) now work
      on an empty line, switch to another type, and put the cursor after the
      marker instead of in front of it.

    Menu and page titles

    • The menu now sits behind a labeled "Menu" button: fixed top right on a wide
      screen, beside the wordmark on a phone. Its items are real links
      (cmd/ctrl-click opens a new tab), with the overview pages grouped under
      "Overzichten".
    • The wordmark is a plain link to the Inbox above the page, and it scrolls
      away with the content.
    • Inbox, Leeslijst and Instellingen have a visible page title, and the browser
      tab follows the page ("Inbox - Waggle").
    • Every page shares one left edge: titles, search, cards and the settings
      sections all follow the design system's page gutter.
    • The inbox tour lost its menu step, and no longer jumps while the banners
      load, ends on a click beside it, races through steps, or hides its card
      steps under the modal.

    Channel window

    • Every root in the channel window now shows its reply count and unfolds in
      place - until now only the saved message's own thread did.

    Fixed

    • Moving a card within its own list no longer drifts a slot off after half a
      dozen moves into the same spot: positions are now also redistributed on a
      reorder, not only when a card changes list.
    • A card moved with the keyboard now scrolls fully back into view instead of
      stopping half under the fold.
    • Text in a dialog is the content colour again instead of pure black or white.
      A native <dialog> carries the UA's color: CanvasText, which cut the
      document colour off above every overlay.

    Under the hood

    • The composer has 21 props instead of 27, and the formatting toolbar gets its
      own tests.
    • The app loads 39% less JavaScript (919 kB gzip to 556 kB), because the design
      system is imported per component instead of as one chunk; see WDR-0005.
    • The Mattermost client now handles an unexpected response body the same way in
      get_thread, get_post and get_channel_posts. The first two coerced before
      they checked, which made the empty-thread branch unreachable.
    • The pinned-trivy-binary variables are scoped to the SBOM job that uses them,
      so a TRIVY_-prefixed name no longer reaches the containerised filesystem
      scan, where it lands in trivy's own config namespace.
    • CI downloads the pinned uv and trivy binaries with --fail and three retries.
      Without --fail an HTTP error was written to the tarball and reported as a
      checksum mismatch, so a rate-limited download looked like a tampered binary.
    • The test schema is now keyed on the checkout as well as the xdist worker, so
      two worktrees running the suite against the same database no longer drop each
      other's tables mid-run.
    • The synthetic dev users, the Mattermost mock, the passwordless-login routes
      and the synthetic-user bootstrap moved to backend/devtools/, which the
      container image does not copy; no dev-only code ships any more.
    • The container build now asserts it: import waggle succeeds and
      import devtools fails in the built image.
    • Dependency bumps: uvicorn 0.52.3, sqlalchemy 2.0.52, ruff 0.16.3, ty 0.0.72,
      the CodeMirror and Lezer packages, vue-tsc 3.3.10, typescript-eslint 8.67 and
      nanoid 3.3.18 (CVE-2026-67213), plus the CI images (uv 0.12.5, trivy 0.74,
      renovate 44.30) and the Postgres 17 digest. Tiptap is gone as a dependency.

    Container images