v0.3.8

What's changed

• Editor: portable .hyc design/template files (download and import)
• Security: bump protobufjs to >= 7.6.5 (Dependabot GHSA-j3f2-48v5-ccww) (#9)
• Security: patch shell-quote, js-yaml, and brace-expansion DoS advisories (#10)
• Stock & fonts: live Iconify icons, merged All search, Source facet, Bunny fonts, ManyPixels pack
• Fonts & editor: full font library, lazy previews, resizable left panel, Stock Source facet
• Video design-mode, server export fidelity, and QR logo
• Security: fix code-scanning alerts and bump fast-uri (Dependabot #11)
• Security: make allocation bounds provable to CodeQL (clamp ints at sink)
• Security: use path-cutting guards / constant capacity for allocations
• Security: split table axis bounds into single-variable guards
• Security: allocate table axes at a constant size to clear CodeQL overflow
• Security: patch next, postcss, and sharp Dependabot advisories
• gitignore: ignore tmp/ scratch directory
• editor: start marquee on drag over locked-only content
• editor: set image as page background, with adjust and detach
• editor: resize templates to the canvas on apply, background follow-ups
• daemon: make start's immediate-death window injectable, deflake test
• SDK: add branch, live-audience, and data-proxy client methods
• Realtime: fold the CRDT server-side, snapshot on last leave, add branches
• Whiteboard: add a diagram spec with Mermaid in both directions
• Export: round-trip PPTX and render a deck to video
• Presentations: live audience, slide-follow, and present-and-record
• Export: cover the inline-file render guards with tests
• Presentations: slide layouts, live data bindings, and bulk CSV merge
• Presentations: deck ingestion, translation, and speaker notes
• Whiteboard: generate diagrams, cluster stickies, summarize a board
• Docs: sync the presentations roadmap with what now ships
• Security: patch the fast-uri and brace-expansion advisories
• Export: render blend modes, shadows, strokes, and effects as the canvas does
• Editor: upload background-removal cutouts instead of embedding them
• Repo: record two non-obvious zero-data-loss rules
• Docs: add the 2D creation-depth roadmap (F40 to F45)
• Render: gofmt the board and raster tests
• Docs: sequence F38 ahead of the creation-depth set on adoption evidence
• Text: order bidirectional text so RTL paragraphs read correctly (F38 FR-10)
• Docs: drop the enterprise governance layer from F38 scope
• Export: shape Arabic, and reach parity across SVG, PDF, and raster
• Schema: add a first-class document language (v18)
• Accessibility: add a reading-order rule and translatable messages
• Self-host: drop-in locales and fonts without a rebuild
• API: give upload and AI failures stable problem codes
• Editor: localize the UI and complete the accessibility model
• Docs: record the accessibility and export audit, and sync F38
• Security: patch pdfjs-dist, dompurify, js-yaml, and nanoid advisories
• Security: key the audience resolve cache with a process pepper
• Security: refuse IPv6 addresses that embed a private IPv4
• Backend: format three files with gofmt
• i18n: close the ratchet blind spot and externalize 27 strings
• Editor: replace raw accent classes with brand tokens
• Docs: sync F38 status with what actually shipped
• i18n: externalize prose in aria-label, title and placeholder
• API: give every problem+json response a stable code
• i18n: localize API errors and enforce the code-to-catalog seam
• Docs: record API error localization in F38
• Docs: defer the workspace audit trail, and stop advertising cut features
• Docs: close the capability gaps found auditing F40 to F45
• Docs: reclaim the schema version allocation before F40 starts
• Engine: derive boolean geometry from operands, retiring the placeholder
• Procgraph: the procedural graph evaluation core
• Docs: withdraw the creation-depth set (F40 to F45)
• Render: draw masks and composite groups, and drop the graph
• Editor: gate the animation preview, and localize the comment count
• Images: make background removal non-destructive (schema v20)
• Export: apply the image alpha mask in all three backends
• Assets: resolve relative content URLs and pass data and blob URLs through
• Editor: add a refinement brush for image alpha masks
• Editor: keep text boxes fitted to their content when restyling and resizing
• Editor: clamp fixed text boxes to their content on every height path
• Editor: fix the inline text editor's multi-line caret and line handling

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

What's Changed

• Security: bump protobufjs to >= 7.6.5 (Dependabot alert #6) by @devadattas in #9
• Security: patch shell-quote, js-yaml, brace-expansion (Dependabot #7-#10) by @devadattas in #10
• Security: fix CodeQL code-scanning alerts and bump fast-uri (Dependabot #11) by @devadattas in #12
• Security: patch next, postcss, and sharp Dependabot advisories by @devadattas in #13

Full Changelog: v0.3.7...v0.3.8