- Upgrade Vite from 5.4.21 to 8.0.8 in web
- Bump @sveltejs/vite-plugin-svelte from 4.0.4 to 7.0.0
- Upgrade vite-plugin-tailwind-purgecss from 0.2.1 to 0.3.5
- Bump AWS SDK Go v2 modules to latest patches
- Update ollama client from 0.20.4 to 0.21.1
- Upgrade go-git from 5.17.2 to 5.18.0
- Bump hasura go-graphql-client from 0.15.1 to 0.16.0
- Update perplexity-go from 2.15.0 to 2.16.1
- Refresh google api, genai, and transitive Go modules
- add `maskAPIKey` to redact all but last 4 chars of API keys (CWE-200)
- add `isRedacted` guard to prevent writing masked values back to `.env`
- mask all provider API keys in `GET /config` response payload
- sanitize note filenames with `basename` and allowlist regex (CWE-78, CWE-22)
- replace `exec`/shell commands in obsidian route with native `fs` APIs
- remove `escapeShellArg` helper now that shell execution is fully eliminated
- add path-confinement double-check ensuring resolved paths stay within target dirs
- sanitize note filenames in notes route using `basename` to block path traversal (CWE-22)
- return `safeFilename` instead of raw user input in notes POST response
- Update Svelte to version 5.53.5
- Upgrade @sveltejs/vite-plugin-svelte to 4.0.0
- Update lucide-svelte to version 0.575.0
- Upgrade Rollup to version 4.59.0
- Remove custom npm and pnpm install scripts
- Add postinstall script for svelte-kit sync
- Fix self-closing tags in Svelte components
- Change transcript joining to use newlines
- Make cleanPatternOutput method public in ChatService
- Remove svelte-markdown dependency from package.json
- Add vendor selector dropdown to filter available models
- Introduce `selectedVendor` writable store for vendor selection
- Add `vendorNames` derived store with sorted unique vendor names
- Add `filteredModels` derived store filtered by selected vendor
- Fix model deduplication to use `vendor:name` composite key
- Sort models by vendor then name, case-insensitive
- Display vendor prefix in model option labels
- Append content to existing assistant messages instead of replacing
- Fix loading message removal to search by index, not position
- Refactor SSE buffer splitting to always retain incomplete segments
- Trim segments before parsing to handle whitespace edge cases
- Consolidate duplicate message update logic across chat components
- Process remaining buffer after stream completion more reliably
Bumps the npm_and_yarn group with 1 update in the /web directory: @isaacs/brace-expansion.
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Fix Dependabot alert #94 (LOW):
- @eslint/plugin-kit vulnerability: Regular Expression Denial of Service
through ConfigCommentParser
- Updated from 0.2.8 (vulnerable) to 0.5.1 via pnpm/npm overrides
Build verified successful. All tests pass.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Fix Dependabot alert #76 (MEDIUM):
- esbuild vulnerability: allows any website to send requests to
development server and read responses
- Updated from 0.21.5 (vulnerable) to 0.27.2 via pnpm/npm overrides
Build verified successful. All tests pass.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Changes:
- Added npm "overrides" section to package.json alongside existing pnpm overrides
- Generated and tracked package-lock.json with security fixes applied
- Removed web/package-lock.json from .gitignore to support npm users
- Both npm and pnpm now enforce secure dependency versions
This enables developers to use either pnpm or npm while maintaining
consistent security posture across both package managers.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add greybeard_secure_prompt_engineer pattern to create secure system prompts
- Update pattern explanations and renumber existing entries
- Refactor build process to use npm hooks for copying JSON files
- Remove manual web static file copying from extract script
- Update .gitignore to exclude generated data and tmp directories
- Modify suggest_pattern categories to include new security pattern
- Delete redundant web static data file, rely on build hooks
- Use bind:value for proper two-way binding with Select component
- Handle empty input to clear session when user clears the field
- Skip session change if value unchanged to avoid redundant API calls
- Track previous session to restore when placeholder selected
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Extract session UI into dedicated SessionSelector.svelte component
- Use Select component instead of native <select>
- Add session message loading when selecting existing session
- Fix placeholder selection behavior to preserve current session
- Rename "Session ID" to "Session Name" for consistency
- Add proper error handling for session loading
- Simplify reactive statements with nullish coalescing
- Use ?? instead of || in ChatService.ts
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove reactive statement that was resetting input on each keystroke
- Initialize sessionInput only once in onMount
- Change layout to stack input and dropdown vertically for better display
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add session name parameter to GUI chat interface, enabling persistent
multi-turn conversations similar to CLI's --session flag.
Changes:
- Add SessionName field to PromptRequest in chat.go
- Add sessionName to ChatPrompt interface
- Include currentSession in ChatService requests
- Add Session ID input with existing sessions dropdown in DropdownGroup
Closes#680🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Extract positioning calculations into dedicated `positioning.ts` module
- Add reactive tooltip position updates on scroll/resize
- Improve accessibility with `aria-describedby` and unique IDs
- Add SSR safety with `isBrowser` flag check
- Replace inline position calculation with reactive statement
- Add window event listeners for position tracking
- Update unit tests to use extracted functions
- Add test coverage for style formatting function
- Replace 42MB favicon.png with proper 64x64 PNG (4.7KB)
- Replace 42MB fabric-logo.png with static PNG from first GIF frame (387KB)
- Optimize animated GIF from 42MB to 5.4MB (half resolution, 12fps, 128 colors)
- Update docs/images/fabric-logo-gif.gif with optimized version
Total reduction: ~168MB to ~11.2MB
Closes#1361
Signed-off-by: majiayu000 <majiayu000@users.noreply.github.com>
Use position: fixed and getBoundingClientRect() to calculate tooltip
position dynamically. This prevents tooltips from being clipped by
parent containers with overflow: hidden (such as slide transitions).
Closes#1790
Signed-off-by: majiayu000 <majiayu000@users.noreply.github.com>
- Upgrade `pdfjs-dist` to v5 with new engine requirement
- Dynamically import PDF.js to avoid SSR import-time crashes
- Configure PDF worker via CDN using runtime PDF.js version
- Update PDF conversion pipeline to use lazy initialization
- Guard chat message localStorage persistence behind browser checks
- Reformat ChatService with consistent imports and typings
- Bump `patch-package` and refresh pnpm lock dependency graph
- Add `skeletonlabs` to VSCode spellcheck dictionary
Use SvelteKit's browser constant instead of typeof localStorage check
to properly handle server-side rendering. Prevents 'localStorage.getItem
is not a function' error when running dev server.
- Rename pattern directory to fix spelling error
- Add new pattern to explanations documentation
- Update suggest_pattern system with concall_summary references
- Include concall_summary in ANALYSIS category mappings
- Add concall_summary to BUSINESS category listings
- Append concall_summary to SUMMARIZE category references
- Update pattern descriptions JSON with new entry
- Generate pattern extracts for concall_summary functionality
- Add user documentation for earnings call analysis
- Include changelog entry for PR #1833
- Update `--raw` flag description across all documentation files
- Clarify flag only affects OpenAI-compatible providers behavior
- Document Anthropic models use smart parameter selection
- Remove outdated reference to system/user role changes
- Update help text in CLI flags definition
- Translate updated description to all supported locales
- Update shell completion descriptions for zsh and fish
- chore: incoming 1836 changelog entry
### CHANGES
- Add `create_conceptmap` for HTML concept maps using Vis.js
- Introduce `fix_typos` for text proofreading and corrections
- Implement `model_as_sherlock_freud` for psychological modeling
- Add `predict_person_actions` for behavior prediction
- Include `recommend_yoga_practice` for personalized yoga guidance
- Credit pattern contribution to @FELIPEGUEDESBR
# CHANGES
- Add new WELLNESS category with four patterns
- Add `model_as_sherlock_freud` for psychological detective analysis
- Add `predict_person_actions` for behavioral response predictions
- Add `recommend_yoga_practice` for personalized wellness guidance
- Add `fix_typos` pattern for proofreading corrections
- Update ANALYSIS category to include new patterns
- Update SELF category with wellness-related patterns
- Tag existing patterns with WELLNESS classification
### CHANGES
- Add `extract_characters` to identify and describe characters
- Update business category to include `extract_characters`
- Include `extract_characters` in extract category
- Add `extract_characters` description in pattern descriptions JSON
- Update user documentation with `extract_characters` details
## CHANGES
- Add top-level project name to navigation hierarchy
- Nest all sections under main project heading
- Fix npm install script path extension
- Update localhost URL to use HTML format
- Add "Mdsvex" to VSCode spelling dictionary
- Include "details" and "summary" to HTML tags
- Remove trailing newline from web README
### CHANGES
- Update Vite to version 5.4.20
- Update Rollup to version 4.50.1
- Add `@eslint-community/eslint-utils` version 4.9.0
- Update `@humanfs/node` to version 0.16.7
- Update `@humanwhocodes/retry` to version 0.4.3
- Update Rollup platform-specific packages to 4.50.1
- Add `@rollup/rollup-openharmony-arm64` version 4.50.1
- Closes Dependabot PR https://github.com/danielmiessler/Fabric/pull/1763
### CHANGES
- Add `create_story_about_people_interaction` pattern description
- Include pattern in `ANALYSIS` and `WRITING` categories
- Update `suggest_pattern` system and user documentation
- Modify JSON files to incorporate new pattern details
- Add internationalization system with Spanish support
- Create contexts and sessions tutorial documentation
- Fix broken Warp sponsorship image URL
- Add locale detection from environment variables
- Update VSCode settings with new dictionary words
- Exclude VSCode settings from version workflows
- Update pattern descriptions and explanations
- Add comprehensive i18n test coverage
- Add winget installation method for Windows
- Add Docker Hub and GHCR image references
- Include docker run examples for setup/patterns
- Remove deprecated PowerShell download link
- Delete unused show_fabric_options_markmap pattern
- Update suggest_pattern with new AI patterns
- Add personal development patterns for storytelling
CHANGES
- Add create_story_about_person system pattern with narrative workflow
- Add heal_person system pattern for compassionate healing plans
- Update pattern_explanations to register new patterns and renumber indices
- Extend pattern_descriptions with entries, tags, and concise descriptions
- Add pattern_extracts for both patterns with full instruction blocks
- Bump devalue dependency from 5.1.1 to 5.3.2
- Refresh lockfile snapshots to reference updated devalue version
- Sync web static pattern_descriptions with new patterns
Updates `devalue` from 5.1.1 to 5.3.2
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.1.1...v5.3.2)
---
updated-dependencies:
- dependency-name: devalue
dependency-version: 5.3.2
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
CHANGES
- Add -V/--vendor flag to specify model vendor
- Implement vendor-aware model resolution and availability validation
- Warn on ambiguous models; suggest --vendor to disambiguate
- Update bash, zsh, fish completions with vendor suggestions
- Extend --listmodels to print vendor|model when interactive
- Add VendorsModels.PrintWithVendor; sort vendors and models alphabetically
- Pass vendor through API; update server chat handler
- Standardize docs and errors to --yt-dlp-args="..." syntax
- Add test covering ambiguous model warning across multiple vendors
- Promote go-shellquote to direct dependency in go.mod
