Skip to content

0.7.1 (2026-09-30)

A stability, security and performance release: zero known vulnerabilities in the frontend's production dependencies, a non-root backend, opening a diagram no longer modifies it, edits are no longer lost when switching diagrams, and the app loads up to 71% less JavaScript.

⬆️ Upgrade notes

  • The backend container runs as an unprivileged user (app, uid/gid 1000). In the development scenario (deploy/local-full) source code is mounted from the host; on Linux, if your user is not uid 1000, Python can't write its caches (__pycache__) into the mounted folder, which is harmless. The production image mounts no code and is unaffected. To upgrade, rebuild the image: docker compose up -d --build.
  • Poetry 2.x in the backend image. If you install dependencies outside Docker, use Poetry 2.
  • New optional MAX_REQUEST_BODY_BYTES variable (default 5 MB): requests with a larger body get 413. Documented in backend/.env.example and .env.template.
  • New MongoDB index on diagrams (project_id, updated_at): created automatically when the backend starts.

✨ Improvements

  • Faster loading: each page is downloaded separately instead of one file for the whole app. Login and the dashboard download 193 KB of JavaScript instead of 668 KB, and show up in ~105 ms and ~130 ms (previously ~165 ms and ~190 ms). The editor paints the diagram in ~180 ms (previously ~300 ms).
  • The editor is preloaded in the background when signed in, so going from the dashboard to a diagram doesn't wait for the download.
  • Export loads its libraries only when exporting (html2canvas), which lightens the editor.
  • The dashboard's "Recent" list comes from a single indexed query instead of reading every diagram of every project with its content.

🔒 Security

  • Frontend dependencies with no known vulnerabilities (previously 25, one high): DOMPurify 3.4.16 (which sanitizes diagram SVGs), Mermaid 11.17.2 and react-router 7.18.4.
  • Dependency security patches apply again: since the pnpm migration (0.6.0), the frontend's 6 security overrides used npm's format and pnpm ignored them. They now live in pnpm.overrides.
  • Non-root backend and Poetry 2.5.1 (Poetry 1.8.3 and its dulwich dependency had advisories).
  • Global request size limit (413), whether the client declares the size or streams the body in chunks.

🐛 Fixes

  • Opening a diagram marked it as modified: the autosave and the zoom/position save fired on load, changing its modification date and the "Recent" order. It now saves only on a real change, and panning, zooming or resizing a panel no longer counts as a modification.
  • Edits were lost when made right before switching diagrams or leaving the editor (within the autosave's 1.5-second wait). They are now saved on switch, on leave and when the tab is hidden, and the browser warns when closing with pending changes, even if the save was already on its way. Saves are also sent one at a time, so a slow one can no longer overwrite a newer edit.
  • The top bar title showed the previous diagram while the next one loaded.
  • Native browser alerts (alert) in AI generation and provider settings, replaced by dismissible in-app notices that follow dark mode.

🌐 Translations

  • Strings still hardcoded in Spanish are now translated (Spanish and English): the new-diagram modal, preview messages (empty code, syntax error, render error), the resize tooltip and three error messages.
  • Dates follow the interface language everywhere: PDF/PNG exports, billing, subscription cancellation, profile, user administration and the editor (they used to be always in Spanish).

🧪 Tests

  • New tests for the request size limit, the "Recent" query and the modification-date rules.
  • Full suite: 277 tests, 52.38% coverage (45% gate).