• v2026.9.19 828726562a

    v2026.9.19
    All checks were successful
    CI / release-scripts (pull_request) Successful in 10s
    security-scan / SBOM (trivy) (pull_request) Successful in 13s
    security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 21s
    security-scan / JS SCA (npm audit) (pull_request) Successful in 22s
    security-scan / Python SAST (bandit) (pull_request) Successful in 27s
    security-scan / Python SCA (pip-audit) (pull_request) Successful in 46s
    CI / pre-commit (pull_request) Successful in 1m20s
    test-build / build (backend) (pull_request) Successful in 1m13s
    test-build / build (frontend) (pull_request) Successful in 1m7s
    test-build / build (pull_request) Successful in 0s
    CI / frontend-test (pull_request) Successful in 1m28s
    CI / backend-test (pull_request) Successful in 3m25s
    CI / e2e (pull_request) Successful in 5m27s
    CI / release-scripts (push) Successful in 12s
    security-scan / SBOM (trivy) (push) Successful in 15s
    security-scan / Filesystem scan (trivy fs) (push) Successful in 21s
    security-scan / JS SCA (npm audit) (push) Successful in 23s
    security-scan / Python SAST (bandit) (push) Successful in 25s
    security-scan / Python SCA (pip-audit) (push) Successful in 44s
    CI / pre-commit (push) Successful in 1m2s
    CI / frontend-test (push) Successful in 1m7s
    publish-and-stage / build (frontend) (push) Successful in 1m12s
    publish-and-stage / build (backend) (push) Successful in 1m22s
    publish-and-stage / build (push) Successful in 0s
    CI / backend-test (push) Successful in 2m36s
    CI / e2e (push) Successful in 5m3s
    release-and-deploy / release-scripts (push) Successful in 6s
    release-and-deploy / release (push) Successful in 18s
    release-and-deploy / pre-commit (push) Successful in 54s
    release-and-deploy / frontend-test (push) Successful in 57s
    release-and-deploy / build (frontend) (push) Successful in 1m10s
    release-and-deploy / build (backend) (push) Successful in 1m16s
    release-and-deploy / build (push) Successful in 0s
    release-and-deploy / backend-test (push) Successful in 3m30s
    release-and-deploy / e2e (push) Successful in 5m21s
    release-and-deploy / ci (push) Successful in 0s
    release-and-deploy / deploy (push) Successful in 1m58s
    publish-and-stage / deploy-staging (push) Successful in 4m44s
    Stable

    robbertbos released this 2026-09-19 20:01:14 +00:00 | 139 commits to main since this release

    Composer

    • Bold no longer flickers while you type it: a space before the closing **
      moves outside once you leave the word, and bolding a selection leaves a
      trailing space out.
    • The caret sits on the insertion point instead of over the next letter, and
      against the URL at the end of a link; the open-link badge is one character
      you step over.
    • Fixed: quotes line up again. Wrapped lines align with the first, the indent
      follows the depth with or without a space after >, and a quote past the
      first 3000 characters gets its left bar.

    Fixed

    • Text after an empty nested quote (>> on its own line) disappeared from a
      rendered message; marked is pinned to 18.0.8, the last release without it.
    • Video previews play in production again: the nginx CSP had
      media-src 'none', now 'self'. A test holds default.conf to what the app
      needs.

    Under the hood

    • Images are published to ghcr.io too and ZAD deploys from there, since
      code.overheid.nl grants anonymous callers no pull scope. Every deploy first
      checks the images are anonymously pullable.
    • A push to main deploys its :<sha> image to a ZAD staging deployment.
    • Fixed: ZAD deploys hit GitHub's API rate limit now and then; the deploy jobs
      pin uv for zad-actions.
    • NLDD design system 0.8.90. Field errors moved to nldd-validation-list, as
      nldd-form-field-error-text is gone.
    • CI: e2e runs on two workers with a 60s test timeout; backend test output is
      quieter.
    • Dependency bumps: uv 0.12.17, Renovate 44.103.2, zad-actions 4.2.0, node
      24.21, nginx-unprivileged 1.31.6 and fresh python, postgres and keycloak
      digests; backend authlib 1.8, alembic 1.20, cachetools 7.2, uvicorn 0.53,
      sqlalchemy 2.0.54, cryptography 50.0.1, pydantic 2.13.5, ruff 0.16.8, ty
      0.0.82; frontend vue 3.5.43, vue-router 5.3.1, @tanstack/vue-query 5.103,
      dompurify 3.4.15, markdown-it 15.0.2, Playwright 1.63, vitest 5, vite 8.3,
      eslint 10.11.

    Container images