v1.40.0

1.40.0 (2026-09-24)

Added

• auth: the sign-in card carries the instance's SSO label and logo (B432) (#1267) (0a1c685)
• email: the weekly digests are written in the recipient's language (B390) (#1242) (81ddf2b)
• sandbox: guests do not share with each other, and the UI says why (B355) (#1239) (cbaa0de)

Fixed

• api: every revision 409 names its last writer, built by one helper (B217) (#1261) (60231f1)
• data-sources: a failing provider refuses in its own words (B417) (#1255) (eb3fc9a)
• digest: the job reads the Preferences digest setting, and Sunday stays Sunday (B407) (#1240) (442e3e3)
• editor: saving to the slide library follows the type's declaration (B401) (#1245) (cf61dbb)
• email: every mail reads its recipient's language (B400) (#1241) (dc015e2)
• interactions: the likert protocol reads its scale from the declaration (B316) (#1263) (dddf378)
• media: a refused ImageKit copy is one sentence, never ImageKit's JSON (B412) (#1251) (ffac07b)
• media: an ImageKit sort has one spelling; lower case is a 400 (B273) (#1260) (54664ff)
• media: the ImageKit browse routes refuse in their own words (B415) (#1253) (5d8dfbf)
• notion: the Notion seam refuses in its own words (B416) (#1254) (40e8f93)
• organization: the no-mail invite report names the way in and stays (B433) (#1266) (c81b637)
• questions: anonymous capabilities is a 401, the gate's answer (B409) (#1249) (b915ca2)
• routes: every capturing /api row declares its captures (B399, 1/2) (#1243) (56395d0)
• routes: every capturing route row declares its captures (B399, 2/2) (#1244) (b3263d4)
• sandbox: the banner states the TTL from SANDBOX_TTL_HOURS (B356) (#1237) (cf6204e)
• server: SSE routes clean up through openSseStream's onClose (B404) (#1248) (9603cd9)
• slide-library: a tag is {id, name}, in the client too (B402) (#1246) (b81f8cb)
• slide-library: the card menu reads canEdit, a refusal is a sentence (B411) (#1250) (3b328e5)
• slide-types: deleting a custom type in use refuses with the count (B414) (#1252) (c473c3c)
• slides: every route that makes a slide goes through newSlide() (B272) (#1262) (a813392)
• stock-media: a Giphy/Unsplash 200 in the wrong shape is 502 too (B421) (#1259) (39e92b9)
• stock-media: a Giphy/Unsplash upstream failure is 502 in its own words (B419) (#1257) (6f7b6c8)
• stock-media: an unreadable Giphy/Unsplash 200 is 502 too, and the dead not-configured guards are gone (B420) (#1258) (d8fb299)
• themes: the Home theme tile shows the theme's own ground (B431) (#1265) (f6dc6d5)
• trash: the trash hint reads only the server's retention window (B405) (#1264) (96c8dda)
• uploads: JPEG has one content type, image/jpeg (B403) (#1247) (d8e03aa)

Security

• tags: the deck tags routes authorize the deck (B436) (#1268) (ed249ea)