v1.29.1

[1.29.1] — 2026-09-29

• v1.29.1 succeeds the unpublished v1.29.0 tag. It ships everything listed under
  [1.29.0] below. The v1.29.0 tag stays as it is, but its desktop release was never published
  (see the note there). If you are upgrading from v1.28.8, read the
  [1.29.0] section
  for the full list of changes. PR #910. The main changes since v1.28.8 are:
  • Desktop projects save and open again on Linux and macOS (#907, PR #908).
  • Project persistence and data integrity work across web and desktop (#553).
  • Third-party notices and a CycloneDX SBOM in every desktop release (#871).
  • In-app Help no longer claims code-signed installers and names the correct data and log
    paths (#574, PR #904).
  • Visual Maturity remediation (editorial foundation, core primitives, overlays, product
    identity, loading and trust surfaces).
  • A qualified dependency update train (#872) and hardened CI and merge governance (#675, #447).
• Development dependencies brace-expansion, fast-uri and ip-address updated: the
  fresh security scan before the v1.29.1 tag found six advisories published after the release-prep
  cut: brace-expansion 5.0.9 (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr),
  fast-uri 3.1.7 (GHSA-hrr3-gc8f-f4qj) and ip-address 10.5.1 (GHSA-h3mg-xc3c-68pw,
  GHSA-j6r3-76f7-8jcv). They are used only by development tooling; the shipped desktop builds do
  not contain them. They now resolve to 5.0.12, 3.1.8 and 10.7.2. PR #912.
• Development dependency joi updated to 18.2.9 (GHSA-6h2x-m376-mqjq): joi 18.2.5, which
  the wait-on CI tool pulled in, failed the enforced OSV scan on the v1.29.0 tag. The shipped
  desktop and web builds do not contain joi (their SBOMs list no joi or wait-on
  component). The joi override floor rises from 18.2.5 to 18.2.6, so a later re-resolution
  cannot fall back to an affected version. PR #909.