v0.0.2

Dependency and toolchain refresh, and the security advisories it closes.

Security

npm audit is clean, and the two open Rust advisories are gone.

• pyo3 0.24 → 0.29 (with rust-numpy, which pins it exactly) — closes GHSA-36hh-v3qg-5jq4
  and GHSA-chgr-c6px-7xpp. Neither was reachable from this codebase: they concern
  nth/nth_back on PyList/PyTuple iterators and PyCFunction::new_closure, and none of
  those appears in the Rust here. The version is what a scanner reads, so the version moved.
• monaco-editor 0.54 → 0.56, carrying dompurify 3.1.7 → 3.4.8, and an override takes
  dompurify to 3.4.12 — twenty advisories in all. Monaco pins dompurify exactly, so without the
  override npm audit fix "resolves" them by downgrading Monaco.
• Dependabot alerts and security updates are now enabled on the repository, and pip was added
  to dependabot.yml, which had been missing the project's largest dependency surface.

Dependencies

dockview-core 4 → 7, vitest 3 → 4, TypeScript 5 → 7, ndarray 0.16 → 0.17, rfd 0.15 → 0.17,
@playwright/test 1.62.1, and every GitHub action to its current major. The
PYO3_USE_ABI3_FORWARD_COMPATIBILITY flag is gone: pyo3 0.29 names Python 3.14, so the
workaround the READMEs told contributors to use is no longer needed.

Two bumps are declined on purpose, and the repository records why. Vite stays at 7 — under 8
two pointer-gesture end-to-end tests break, which is a piece of work rather than a bump, and
Vite 7 carries no advisory. cupy-cuda12x keeps its >=13 floor, because that extra exists
for people held on an older CUDA driver: the floor is the feature, not lag.

Fixes

• The Monaco theme reads computed CSS variables and so gets whatever the minifier emitted; a
  three-digit colour made it refuse the theme outright. It now expands the shorthand.
• Nineteen of the twenty Monaco imports are side-effect only — the contributions behind Ctrl+F,
  folding and hover — and TypeScript did not resolve them by default. Monaco 0.56's new exports
  map would have removed those features in silence. noUncheckedSideEffectImports now makes the
  class visible, and the end-to-end suite exercises Ctrl+F and Ctrl+/ for what typing cannot
  prove.
• A real-time-preview test waited for any preview generation rather than the one it had asked
  about, and failed whenever a slower machine finished the first request early.
• The version lives in five files; the guard compared two of them. It reads all five now, and
  names the ones that disagree.

Install

The Windows installer is below. It is not code-signed, so SmartScreen warns on first run:
choose More info → Run anyway. Verify your download against SHA256SUMS.txt — noting that
MSI packaging is not bit-for-bit reproducible, since WiX embeds timestamps and generated GUIDs,
so a checksum identifies an artifact rather than a version.

Everything else installs from source: see the README.

v0.0.1

Retina 0.0.1 — first public release.

Open-source astrophotography image processing, fully scriptable in Python, with a VS Code-style
web interface. 141 processes, an automated pre-processing engine, projects that round-trip a
whole session including undo history, and an MCP server that opens the live session to an AI
agent. English by default, with a complete French translation.

Download

File
Retina-0.0.1.msi	Windows installer, 299 MiB, per-user install
SHA256SUMS.txt	checksum of the installer

Source, and how to run it without the installer: see the
README.

The installer is not code-signed, so Windows SmartScreen will warn on first run: choose
More info → Run anyway. Verify your download against SHA256SUMS.txt above — noting that
MSI packaging is not bit-for-bit reproducible (WiX embeds timestamps and generated GUIDs), so a
checksum identifies an artifact rather than a version.

Privacy

This program will not transfer any information to other networked systems unless specifically
requested by the user or the person installing or operating it. Full policy:
PRIVACY.md.

---

Full Changelog: https://github.com/jromang/retina/commits/v0.0.1