Clears GHSA-wrjc-x8rr-h8h6 (open redirect via backslash in <Link>/useNavigate)
and GHSA-337j-9hxr-rhxg (arbitrary constructor injection in deserializeErrors),
neither of which has a 6.x backport. Drops the now-unused @remix-run/router
resolution, since v7 no longer depends on it.
TypeScript 7's own tsc is the Go-native compiler, so the separate tsgo
binary from the dev-preview package is redundant. yarn type-check now
runs tsc --noEmit. Bump tsconfig target to ES2018 and add types: [node]
to fix the pre-existing NodeJS namespace, global, and /s regex flag
errors that stable tsc reports but tsgo did not.
The unmaintained decompress package (<=4.2.1) allows archive extraction
outside the target directory. Migrate electron before-pack to the patched
@xhmikosr/decompress fork (11.1.3) to resolve Dependabot alert #301.
* feat(electron): sign and notarize mac release builds when Apple credentials are present
* fix(electron): work around codesign PID parsing for digit-leading app name in @electron/notarize
codesign interprets a bare '5chan.app' argument as process ID 5, so
@electron/notarize 2.5.0's pre-upload signature check fails with 'No such
process'. Backport the './' basename prefix from electron/notarize#245 as
a yarn patch until forge depends on notarize >= 3.x.
* docs(agent-playbooks): record codesign PID parsing surprise for digit-leading app name
* fix(ci): keep mac signing env consistent with certificate availability
* feat(sci): add 4chan-style TeX support with MathJax on /sci/
- [math]/[eqn] tags typeset with MathJax 3 (lazy chunk, only on /sci/ with math present)
- 4chan-identical config: Safe mode, left-aligned eqn, neutered \color/\newcommand macros
- TeX button in reply modal title bar opens live TeX Preview modal
- /sci/ post form rules bullets for [math]/[eqn] usage and right-click source
- MathJax context menu on right-click (Show Math As > TeX Commands)
- woff fonts served from node_modules in dev and emitted into build
* feat(sci): finish TeX support: configmacros fix, preview preload, translations, tests
- add configmacros package so the 4chan macro neutering (\color, \newcommand, ...) applies
- preload MathJax when the TeX Preview opens, like 4chan
- stable closeModal callback for the preview modal
- pre-bundle mathjax components in vite optimizeDeps to avoid dev mid-session reload
- translate the 6 new TeX keys into all 35 languages
- markdown math segment component tests + math-tags unit tests
* feat(reply modal): add sci tex preview button
* fix(tex-preview): clear MathJax bookkeeping and pending typeset on close
Addresses Cursor Bugbot: the preview output was typeset via typesetMathElement but
never passed to clearMathElement on unmount, so repeated open/close cycles kept
detached nodes in MathJax's math list. Also cancels the pending debounce timer.
* fix(reply-modal): reset TeX preview state when the reply modal closes
Addresses CodeRabbit: showTexPreview persisted across close/reopen like the
bbcode preview flags, so the TeX preview would auto-open on the next reply.
Bump react and react-dom 19.1.2 -> 19.2.7 and @types/react and
@types/react-dom from v18 to v19. Keeps babel-plugin-react-compiler,
which is a separate build-time tool, not part of the React 19 runtime.
The @types v19 upgrade surfaced 21 type-only errors, all fixed without
runtime behavior changes:
- useRef<T>() now requires an explicit argument: pass undefined
- DOM element refs are RefObject<T | null>: widen PostFormFields and
AdvancedSettings ref prop types accordingly
- retype reply-modal onInput handler to FormEvent + currentTarget
- add a null guard for the boards-bar search input
- update test mocks for stricter cloneElement/forwardRef typings
Verified: type-check, lint, 1051 tests, and build pass; react-doctor
score unchanged at 54; browser smoke across Chromium/Firefox/WebKit
plus mobile viewport clean.
Tommaso Casaburi