Release v0.3.7 · hyscaler/HyCanvas

What's changed

AI: clear error when image generation hits a text-only provider
AI: add Zhipu AI (GLM) provider preset with CogView image generation
Backend: 540p preview proxies for large videos, Range/HEAD on asset content, longer daemon start grace
Video: server ffmpeg timeline renderer with nested-sequence flattening and export range
Video editor: full timeline editing suite
Video editor: close out the bug and gap backlog
Version history: correctness and safety fixes from the review
Video editor: URL import uses the in-app modal instead of the native browser prompt
Fix skewed Version-history timestamps by pinning the DB session to UTC (#7)
Editor: image and frame interaction fixes
Editor: Templates panel in the left rail with page-size suggestions
Collab bridge: keep the session's first edit undoable before room sync
Security: harden storage key handling and export download URLs (code scanning) (#8)
Video editor: validate export job ids at the download call sites

Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
ffmpeg is only required for server-side video export; everything else works without it.

Fix skewed Version-history timestamps by pinning the DB session to UTC by @devadattas in #7
Security: resolve CodeQL path-injection and request-forgery alerts by @devadattas in #8

Full Changelog: v0.3.6...v0.3.7