releases/v1.11.0.md

Rama master · réplica de lectura del repositorio original.

# v1.11.0

**Released:** 2026-10-25

Feature release: five community contributions plus security maintenance. Changes since v1.10.0 (`87dc8a6..1140679`).

## Features

- **Surround selected text with typed markers (#251, closes #246)**: selecting text and typing `*`, `_`, backtick, `~`, `^`, or `=` wraps it with matching Markdown markers while keeping the inner text selected (repeat for bold/highlight). CommonMark-safe backtick delimiters, one undo step per operation, IME/paste/Vim/empty-cursor behavior preserved.
- **Accessible preview image overlay (#252, closes #247)**: click (or Enter/Space) a preview image to open it full-viewport; close via button, Escape, or backdrop with focus restored. Scheme-validated URLs, no sanitizer relaxation, trigger buttons injected post-sanitize with WeakMap click authorization.
- **Visual custom theme editor (#253, closes #248)**: Settings → General → Customize theme — base theme + 35 color roles with live preview, contrast warnings, Cancel/Escape restore. Server-side validation accepts strict hex colors only (no arbitrary CSS/URLs); persisted via the existing UI-keys-gated config path. CONFIG_VERSION 6.
- **Home with shared recent files (#250, closes #245)**: the logo opens a Home view listing the ten most recent notes, shared across browsers via `.fed` (paths + timestamps only, never content). Layered path validation (containment, .md-only, symlink/size guards), lock-protected atomic rewrites, rename/move/delete remapping, explicit clear.
- **Create items in the selected folder (#249, closes #244)**: New Note/Folder target the single selected Explorer folder (root otherwise); explicit context-menu destinations preserved; Hugo templates excluded.

## Security

- Vendored dompurify 3.4.16 → 3.4.17: clears three published advisories (critical SAFE_FOR_TEMPLATES bypass, high IN_PLACE incomplete fix, low SMIL/PARSER_MEDIA_TYPE skip). FrankMD's sanitizer config uses none of the affected modes; upgraded regardless. Dual-CDN byte-verified.
- crass 1.0.7 → 1.0.8 (GHSA-pq4g-8rxf-4g29, transitive via actionview).

## Dependency maintenance

- aws-sdk-s3 1.235.0 (core 3.260.0), ruby/setup-ruby pinned to v1.331.0 (tag-verified SHA).

## Known issues

- #254: DraftRecoveryTest (system) fails on rename/move flows — pre-existing since at least v1.10.0, invisible to hosted CI (system tests not in the CI job). Filed with evidence for a dedicated fix.

## Test Coverage

- 1,142 Ruby tests (4,385 assertions), 2,200 JavaScript tests (95 files); full `bin/ci` and hosted CI green on the release tree.