Penpot

:sparkles: New features & Enhancements

• Add MCP server integration Github #9174
• Add chunked upload API for large media and binary files (removes previous upload size limits) Github #9516
• Add anonymous telemetry event collection Github #9467
• Improve team name validation Github #9517
• Enhance readability of applied tokens in plugins API Github #9175
• Encourage use of flex/grid layouts in designs generated via MCP Github #9081
• Improve MCP server logging, adding Loki support Github #9415
• Add security headers to Nginx on Docker images Github #9519

:bug: Bugs fixed

• Fix text edition mode not exited when changing selection, blocking token application Github #9346
• Reduce memory usage of MCP server when handling images (by @opcode81) Github #9420
• Fix Plugin API token methods rejecting JS array of strings (by @boskodev790) Github #9162
• Fix release notes modal appearing behind the dashboard sidebar (by @RenzoMXD) Github #8296
• Fix empty warning on login Github #9520
• Fix maximum call stack size exceeded in SSE read-stream Github #9470
• Fix incorrect handling of version restore operation Github #9515
• Fix MCP ReplServer binding to all interfaces (0.0.0.0) instead of localhost, allowing unauthenticated RCE Github #9518
• Fix MCP integrations URL copy action to match the URL displayed in settings Github #9238
• Fix swapped analytics event names on MCP tab-switch dialog (by @Dexterity104) Github #9496
• Fix multiple selection on shapes with token applied to stroke color Github #9522
• Fix onboarding modals appearing behind libraries and templates panel Github #9521
• Fix keep-alive interval leak in PluginBridge (by @opcode81) Github #9430