Fixed 2
- Fix binfile import storing unsanitized SVG and missing obfuscated SVG content-types
- Fix removed team members keeping file access after leaving the team
From Penpot
The open-source design and prototyping platform.
Release activity
| Jul | Aug | Sep | Oct | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Sunday | No releases on Jun 21, 2026 | No releases on Jun 28, 2026 | No releases on Jul 5, 2026 | No releases on Jul 12, 2026 | No releases on Jul 19, 2026 | No releases on Jul 26, 2026 | No releases on Aug 2, 2026 | No releases on Aug 9, 2026 | No releases on Aug 16, 2026 | No releases on Aug 23, 2026 | No releases on Aug 30, 2026 | No releases on Sep 6, 2026 | No releases on Sep 13, 2026 | No releases on Sep 20, 2026 | No releases on Sep 27, 2026 | No releases on Oct 4, 2026 |
| Monday | No releases on Jun 22, 2026 | No releases on Jun 29, 2026 | No releases on Jul 6, 2026 | No releases on Jul 13, 2026 | No releases on Jul 20, 2026 | No releases on Jul 27, 2026 | No releases on Aug 3, 2026 | No releases on Aug 10, 2026 | 1 release on Aug 17, 2026 | No releases on Aug 24, 2026 | No releases on Aug 31, 2026 | No releases on Sep 7, 2026 | No releases on Sep 14, 2026 | No releases on Sep 21, 2026 | No releases on Sep 28, 2026 | 1 release on Oct 5, 2026 |
| Tuesday | No releases on Jun 23, 2026 | No releases on Jun 30, 2026 | No releases on Jul 7, 2026 | No releases on Jul 14, 2026 | No releases on Jul 21, 2026 | No releases on Jul 28, 2026 | No releases on Aug 4, 2026 | No releases on Aug 11, 2026 | No releases on Aug 18, 2026 | No releases on Aug 25, 2026 | No releases on Sep 1, 2026 | No releases on Sep 8, 2026 | No releases on Sep 15, 2026 | No releases on Sep 22, 2026 | No releases on Sep 29, 2026 | 1 release on Oct 6, 2026 |
| Wednesday | 1 release on Jun 24, 2026 | 1 release on Jul 1, 2026 | No releases on Jul 8, 2026 | No releases on Jul 15, 2026 | 1 release on Jul 22, 2026 | No releases on Jul 29, 2026 | No releases on Aug 5, 2026 | No releases on Aug 12, 2026 | No releases on Aug 19, 2026 | No releases on Aug 26, 2026 | No releases on Sep 2, 2026 | No releases on Sep 9, 2026 | No releases on Sep 16, 2026 | 1 release on Sep 23, 2026 | No releases on Sep 30, 2026 | No releases on Oct 7, 2026 |
| Thursday | No releases on Jun 25, 2026 | No releases on Jul 2, 2026 | No releases on Jul 9, 2026 | No releases on Jul 16, 2026 | No releases on Jul 23, 2026 | No releases on Jul 30, 2026 | No releases on Aug 6, 2026 | No releases on Aug 13, 2026 | No releases on Aug 20, 2026 | 1 release on Aug 27, 2026 | No releases on Sep 3, 2026 | No releases on Sep 10, 2026 | No releases on Sep 17, 2026 | No releases on Sep 24, 2026 | 1 release on Oct 1, 2026 | No releases on Oct 8, 2026 |
| Friday | No releases on Jun 26, 2026 | No releases on Jul 3, 2026 | No releases on Jul 10, 2026 | No releases on Jul 17, 2026 | No releases on Jul 24, 2026 | No releases on Jul 31, 2026 | No releases on Aug 7, 2026 | No releases on Aug 14, 2026 | No releases on Aug 21, 2026 | No releases on Aug 28, 2026 | No releases on Sep 4, 2026 | No releases on Sep 11, 2026 | No releases on Sep 18, 2026 | No releases on Sep 25, 2026 | No releases on Oct 2, 2026 | No releases on Oct 9, 2026 |
| Saturday | No releases on Jun 27, 2026 | No releases on Jul 4, 2026 | No releases on Jul 11, 2026 | No releases on Jul 18, 2026 | No releases on Jul 25, 2026 | No releases on Aug 1, 2026 | No releases on Aug 8, 2026 | No releases on Aug 15, 2026 | No releases on Aug 22, 2026 | No releases on Aug 29, 2026 | No releases on Sep 5, 2026 | No releases on Sep 12, 2026 | No releases on Sep 19, 2026 | No releases on Sep 26, 2026 | No releases on Oct 3, 2026 |
16 releases since May 6, 2026, busiest day 2
Changelog
Fixed 1
- Fix workspace showing an internal error when syncing components or dragging in the color picker
Security 1
- Fix SVG sanitizer keeping namespace-prefixed script elements when uploading SVG files
Fixed 4
- Fix workspace freezing with a stack overflow when opening the context menu on a shape that isn't on the current page
- Fix workspace showing repeated error toasts when a third-party script injected into the page throws
- Fix register flow from workspace URL not working
- Fix empty response when exporting bin using API
Added 3
- Group toolbar drawing tools into shape and free-draw flyouts
- Add dedicated Line and Arrow drawing tools
- Show and manage comments while designing in the workspace
Fixed 18
- Fix MCP integration hanging when the Penpot tab is backgrounded or frozen by the browser
- Fix synced component copy not reflowing children after spacing token update
- Fix spacebar activating pan mode while typing a comment
- Fix plugin API rejecting negative letterSpacing values
- Fix plugin API addTheme calls failing with the signature shown in the high-level overview
- Fix empty text shape not being deleted on editor exit
- Fix broken token pills showing wrong default state when not selected
- Fix Chinese (zh-CN) translation showing wrong label for Intersection in board path menu
- Fix invalid formulas being accepted in numeric inputs
- Fix radial gradient handles blowing up in size when rotated on ellipses
- Fix plugin API validation errors being too generic to diagnose the failure
- Fix crash with referential integrity error when deleting a component inside a grid
- Fix component copies not preserving rotation when the main component has changes
- Fix text width and height staying stale after setting growType in the plugin API
- Fix padding not painted until expanding the 4-sides padding option
- Fix files with custom fonts breaking with a referential integrity error when moved between teams
- Fix clicking overlapping comment bubbles zooming to 20000% without showing the comments
- Fix user menu subsections in the dashboard not closing when hovering away from the parent option
Fixed 2
- Fix linear gradients in SVG text exports being emitted as radial gradients
- Fix typography token becoming detached when editing text content
Security 1
- Fix command injection in SVG exporter via legacy fill-color
Fixed 20
- Overrides lost after switching component variant
- Malformed get-font-variants request when team-id is missing from dashboard URL
- Malformed get-profiles-for-file-comments request when file-id is missing from workspace URL
- Internal error when dragging inner layout with Boolean operations
- Frontend throwing raw TypeError on undefined .getData receivers across import, paste, drag, and text editor paths
- Workspace crash with 'can't access dead object' in Firefox when navigating between pages
- Workspace crash when holding an arrow key on a selection due to excessive re-renders
- Dashboard sidebar throwing removeChild NotFoundError during rapid keyboard navigation
- Asset download failing with S3 auth conflict when using access token
- Import worker crashing when importing non-Penpot zip files
- Viewer crash with WASM panic when opening URL with page-id
- Backend returning 500 when JSON request body has unrecognized escape sequence
- Color picker eyedropper crashing when viewport is unmounted during pointer move
- Flex layout crash when dragging shapes with missing bounds
- Export failing when shape has blank layer name
- Area selection (marquee) being aborted by select-shapes interrupt
- Gradient editor sending invalid stop offset when clicking outside gradient line
- Audit event validation failing when error reports contain string profile-id and missing token context
- MCP tool call timeout being too low for some operations
- MCP requests running into timeouts after leaving a file in Penpot
Added 11
- Expose variants retrieval on LibraryComponent via isVariant() type guard in plugin API
- Add search bar to prototype interaction destination dropdown
- Add dashed stroke customization with dash and gap inputs
- Add author, relative timestamp and short identifier to history entries
- Add typography token row to multiselected texts
- Add typography information to token dropdown option
- Add autocomplete combobox to token creation and edition forms
- Add list view mode to color picker UI
- Add composite typography token input to the Design sidebar
- Add layer blur effect
- Render guides in WebGL
Changed 5
- Render prototype viewer with WASM (Skia) engine instead of SVG
- Optimize propagation of tokens
- Cache OIDC provider records to skip per-login discovery
- Use Clipboard API consistently across the application
- Use $ as DTCG token/group discriminator and make $description optional
Fixed 3
- Validate shape on add-object to catch malformed inputs early
- Revert token migrations on clashing names to prevent data loss
- Avoid deduplicating temporary export files to prevent stale content
Security 1
- Harden CORS middleware to not reflect Origin with credentials enabled
Fixed 2
- Fix error 500 when submitting the contact form
- Fix text editor modifying content and detaching applied typography tokens
Added 5
- Batch multiple thumbnail deletions into a single RPC call
- Add WebSocket proxy configuration for MCP in Nginx example
- Add tenant prefix to MCP Redis channel names for multi-environment isolation
- Show MCP key on Integrations page and remove non-recoverable warning from modal
- Add MCP status button with single-tab connection control
Fixed 6
- Fix race condition between MCP initialization and plugin runtime
- Filter ignorable React removeChild errors from browser extensions in error boundary
- Show resolved values in font family token combobox when pasting comma-separated values
- Fix MCP server status toggle persistence and missing workspace connection options
- Allow pasting comma-separated emails in the invite members modal
- Fix text element edit detaching applied color tokens
Added 20
- WebGL rendering beta user preference
- Design Tokens at the design tab with numeric fields and token selection
- Delete group option to assets panel context menu
- Alpha percentage display on library color values
- Clear artboard guides option to frame context menu
- Loader feedback while importing and exporting files
- Ability to duplicate color and typography styles
- WOFF2 support for user uploaded fonts
- Import Tokens from linked library
- Option to download custom fonts
- Copy as image option to workspace context menu
- Tab and Shift+Tab navigation to rename layers sequentially
- Copy and paste entire rows in existing table
- Rename token group functionality
- Duplicate token group functionality
- Copy token name from contextual menu
- Drag-to-change for numeric inputs in workspace sidebar
- Per-group add button for typographies
- Find and Replace for text content and layer names
- Use page name for multi-export ZIP and PDF downloads
Added 2
- Add rate limiting and concurrency safety for file snapshot operations
- Prevent concurrent font uploads from causing excessive simultaneous requests
Fixed 4
- Emit create-shape-layout for flex/grid layout creation from plugins and MCP
- Fix broken authentication on /assets handlers
- Fix API doc endpoint returning HTML as text/plain
- Fix unexpected error when opening the export dialog
Fixed 3
- Fix Plugin API token methods failing with schema validation error on PRO
- Sanitize comment content on rendering
- Sanitize font family names on custom uploaded fonts
Fixed 1
- Fix mcp related internal config for docker images
Added 1
- Support for chunked uploading of fonts
Added 4
- Add MCP server integration
- Add chunked upload API for large media and binary files, removing previous upload size limits
- Add anonymous telemetry event collection
- Add security headers to Nginx on Docker images
Changed 4
- Improve team name validation
- Enhance readability of applied tokens in plugins API
- Encourage use of flex/grid layouts in designs generated via MCP
- Improve MCP server logging, adding Loki support
Fixed 11
- Fix text edition mode not exited when changing selection, blocking token application
- Reduce memory usage of MCP server when handling images
- Fix Plugin API token methods rejecting JS array of strings
- Fix release notes modal appearing behind the dashboard sidebar
- Fix empty warning on login
- Fix maximum call stack size exceeded in SSE read-stream
- Fix incorrect handling of version restore operation
- Fix MCP integrations URL copy action to match the URL displayed in settings
- Fix swapped analytics event names on MCP tab-switch dialog
- Fix multiple selection on shapes with token applied to stroke color
- Fix onboarding modals appearing behind libraries and templates panel
Security 1
- Fix MCP ReplServer binding to all interfaces (0.0.0.0) instead of localhost, preventing unauthenticated RCE
Fixed 1
- Fix incorrect invitation token handling on register process
More in Creative Tools
View allExcalidraw
A virtual whiteboard for hand-drawn style diagrams.
Excalidraw
OpenCut
OpenCut release notes.
OpenCut
Inkscape
A free and open-source vector graphics editor.
Inkscape Project
GIMP
GIMP release notes.
The GIMP Team
LosslessCut
Lossless trimming and cutting of video and audio files.
Mikael Finstad
Aseprite
Animated sprite editor and pixel art tool.
Igara Studio
Discussion
If you publish Penpot, you can claim this product by proving you administer its repository.