v0.3.15 — Playlist reorder, marquee fix, security patches

Velvet v0.3.15 — Playlist reorder, marquee fix, security patches

What's new

Drag-to-reorder in playlists

Songs in a saved playlist can now be dragged into any order. Hover a
track to reveal the grip handle (⠿) on its right side, then drag it up
or down. The new order is saved to the server the moment you drop.

A sort_order column is silently added to the playlist table on first
start — no data loss, existing playlists keep their insertion order until
you manually reorder them.

Scrolling title fix

Long song titles that triggered the marquee animation were displaying a
truncated ellipsis ("…") while scrolling. The full title now animates
through cleanly.

Security

brace-expansion was upgraded from 5.0.7 to 5.0.9, fixing a
high-severity DoS where a crafted pattern could cause unbounded memory
expansion and crash the process. body-parser was also updated to
address a low-severity DoS where an invalid limit value silently
disabled request-size enforcement. Both are dependency-only fixes with no
API changes.

Dependencies

All 12 pending Dependabot updates merged: helmet 8.3.0, nanoid 6.0.0,
ws 8.21.1, eslint-plugin-sonarjs 4.2.0, fast-xml-parser 5.10.1, axios
1.19.0, music-metadata 11.14.0, eslint 10.8.0, globals 17.8.0,
actions/setup-node v7, trivy-action (latest hash).