Skip to content

LWT 3.2.2: Reading-flow fixes, language resolution, and security patches

Choose a tag to compare

View all tags
@HugoFara HugoFara released this 04 Aug 22:48
· 149 commits to main since this release
3.2.2
87c304b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release bundling the fixes landed since 3.2.1 (2026-06-30).

Reading and import

  • The term modal no longer hides what you are reading (#253). Clicking Add/Edit used to open a full-viewport modal over the text. The backdrop dimming is gone, the mobile card is a capped-height sheet, and the modal now places itself in the half of the viewport the clicked word is not in — so the word and its sentence stay visible while you type a translation.
  • A single-language install could never browse Gutenberg or GDL. currentlanguage is only written when you pick from the navbar dropdown, and with exactly one language there is no second option to switch to, so the setting could never be written — a fresh install was stuck there permanently. The navbar looked correct only because a <select> with no selected option displays the first one. Language resolution is now centralised, and a setting pointing at a deleted language no longer sticks either.
  • A CRLF term file broke tag-only imports. The last remaining site of the PHP_EOL splitting defect fixed in #241, #248 and #249.
  • One over-long headword aborted a whole dictionary import (#250). Importing FreeDict German-English lost all 517,533 usable entries because of a single 293-character headword. Unstorable headwords are now skipped and counted.
  • Restoring a backup wiped the database and reported success on Windows (#249), plus foreign-key ordering during replay and a CSP bug that made the restore file-picker a no-op.
  • Japanese (MeCab) parsing produced no tokens on Windows.

Internal

  • TermStatus is now the single source of truth for the word-status model (#246), replacing scattered status literals across PHP and TypeScript.
  • Single data_hex word identity in the reading view (#237), retiring the 2011 ¤/hex encoder that PHP 8.5 had begun deprecating.

Neither changes behaviour or wire format.

Security

Thirteen advisories cleared across two rounds — ten in #255, three more in #257. The latter includes two guzzle CVEs that reach the running application through league/oauth2-google (CVE-2026-69246, high; CVE-2026-69245, medium) and a brace-expansion override floor that its own follow-up advisory had overtaken.

composer audit and npm audit both report clean.

Upgrading

No migration or configuration change is required. Full detail in CHANGELOG.md.

Assets 8
Loading