v1.3.2 — Security hardening

Swept against the Jahia/jahia-security-scan taxonomy: clean on all high-severity classes (no XSS sink, no SQL2 injection, no custom endpoint/CSRF surface, no SSRF, no system session). Two low-severity items hardened:

• Author identity is never client-trusted — the displayed name is resolved from the server-set jcr:createdBy; the spoofable client-set authorName is no longer written or read (CND field kept as legacy).
• Task text is stripped of </> before being copied into a jnt:task title/description (defense in depth).

Plus a README currency pass (identity model, build version, full changelog).

v1.3.1 — Activation version banner

• Logs Content Review Panel <version> is activated on load, so a stale open jContent tab (which keeps its Module Federation bundle until reloaded) can be diagnosed at a glance.

v1.3.0 — Assignment via Jahia tasks

• Assign a comment to a site editor -> creates a standard Jahia jnt:task under /sites/<site>/tasks that appears in the assignee's Dashboard > My Tasks (no Java).
• One-way lifecycle sync: resolve -> finished, reopen -> active; reassign updates, unassign/delete removes.
• assigneeUserKey stored as the user node path (what the dashboard query matches) + assignee weakreference.
• Task rows link back to the reviewed page via the rvwmix:taskTarget mixin (targetNode).

v1.2.0 — Visual anchoring

• Point-and-click component anchoring over the Page Builder canvas: a capture layer hit-tests the iframe's [jahiatype=module] markers; hovered component is outlined, click anchors the comment (Esc cancels).
• Clicking a comment's chip scrolls the canvas to the component and flashes it.
• Falls back to the tree picker when no canvas is present (e.g. list views).

v1.1.0 — Review drawer, threads, anchoring

Initial published release.

• In-context review drawer on jnt:page / jmix:mainResource; comments stored as hidden, non-published JCR nodes (jmix:nolive + jmix:hiddenType).
• Chat comments (author + timestamp); resolve / reopen; delete-own.
• One-level threaded replies; component anchoring via the tree picker; resolve-all; new-comment toast.
• Inline two-step confirm (native window.confirm freezes jContent).
• EN/FR i18n.