releases/v1.5.1.md

Rama master · réplica de lectura del repositorio original.

# v1.5.1

**Released:** 2026-09-29

Fix release: task checkboxes, translation coverage enforcement.

## Fixes

- **GFM task checkboxes render in the preview (#202)**: task lists were rendering as plain lists — the preview sanitizer's form-control ban (v0.8.6 anti-phishing hardening) stripped the inert `<input type="checkbox" disabled>` that GFM task lists emit. Sanitization now keeps exactly that inert shape (attributes whitelisted to type/checked/disabled); every interactive input remains forbidden, with regression tests covering hostile variants. Interactive click-to-toggle is tracked in #203.
- **Translation coverage enforced (#200, PR #201)**: new fallback-immune `TranslationCoverageTest` treats `en.yml` as the canonical schema and verifies every locale directly against the source YAML (runs in the hosted `test_ruby` job); all 86 missing keys backfilled with genuine translations (he 35, pt-BR 7, es/ja/ko/pt-PT 11 each — pt-PT/pt-BR correctly differentiated). Locale list derives from `available_locales` so future locales can't escape coverage.

## Test Coverage

- 929 Ruby tests (3,189 assertions), 1,913 JavaScript tests; hosted CI green on the release tree.