From d3258b3c7f9076ad8b1002983cfa89d95e385aea Mon Sep 17 00:00:00 2001
From: Jeroen Versteeg <firm.grip0126@fastmail.com>
Date: Fri, 9 Jan 2026 16:31:47 +0100
Subject: [PATCH 01/22] Replace use of instance variable with local

The partial `boards/edit/auto_close` used both `@board` as well as `board`.
---
 app/views/boards/edit/_auto_close.html.erb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/boards/edit/_auto_close.html.erb b/app/views/boards/edit/_auto_close.html.erb
index c32c1c050..8993c132e 100644
--- a/app/views/boards/edit/_auto_close.html.erb
+++ b/app/views/boards/edit/_auto_close.html.erb
@@ -1,7 +1,7 @@
-<%= turbo_frame_tag @board, :entropy do %>
+<%= turbo_frame_tag board, :entropy do %>
   <div class="margin-block-end">
     <h2 class="divider txt-large">Auto close</h2>
     <p class="margin-none-block-start">Fizzy doesn’t let stale cards stick around forever. Cards automatically move to “Not now” if no one updates, comments, or moves a card for…</p>
-    <%= render "entropy/auto_close", model: board, url: board_entropy_path(board), disabled: !Current.user.can_administer_board?(@board) %>
+    <%= render "entropy/auto_close", model: board, url: board_entropy_path(board), disabled: !Current.user.can_administer_board?(board) %>
   </div>
 <% end %>

From 6895135977e3d4fbe4493b1a5593aa4f115f4020 Mon Sep 17 00:00:00 2001
From: secretpray <a.p.ruban@gmail.com>
Date: Mon, 12 Jan 2026 18:44:35 +0200
Subject: [PATCH 02/22] Fix deprecation warnings for skip_before_action
 :verify_authenticity_token

Replace deprecated `skip_before_action :verify_authenticity_token` with
`skip_forgery_protection` to resolve Rails deprecation warnings.

Changes:
- app/controllers/notifications/unsubscribes_controller.rb
- saas/app/controllers/stripe/webhooks_controller.rb
---
 app/controllers/notifications/unsubscribes_controller.rb | 2 +-
 saas/app/controllers/stripe/webhooks_controller.rb       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/controllers/notifications/unsubscribes_controller.rb b/app/controllers/notifications/unsubscribes_controller.rb
index f7486d91e..d1842b169 100644
--- a/app/controllers/notifications/unsubscribes_controller.rb
+++ b/app/controllers/notifications/unsubscribes_controller.rb
@@ -1,6 +1,6 @@
 class Notifications::UnsubscribesController < ApplicationController
   allow_unauthenticated_access
-  skip_before_action :verify_authenticity_token
+  skip_forgery_protection
 
   before_action :set_user
 
diff --git a/saas/app/controllers/stripe/webhooks_controller.rb b/saas/app/controllers/stripe/webhooks_controller.rb
index cdfb6bcec..13dcd4699 100644
--- a/saas/app/controllers/stripe/webhooks_controller.rb
+++ b/saas/app/controllers/stripe/webhooks_controller.rb
@@ -1,7 +1,7 @@
 class Stripe::WebhooksController < ApplicationController
   allow_unauthenticated_access
   skip_before_action :require_account
-  skip_before_action :verify_authenticity_token
+  skip_forgery_protection
 
   def create
     if event = verify_webhook_signature

From 006e61ea5898ad470a7ef295895ca8b83e60a1ef Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Mon, 12 Jan 2026 10:30:18 -0800
Subject: [PATCH 03/22] Allow ActionText embed reuse and safe purge (#2346)

---
 .../initializers/active_storage_no_reuse.rb   | 35 +++++----
 ...active_storage_purge_on_last_attachment.rb | 40 ++++++++++
 script/migrations/backfill-storage-ledger.rb  |  6 +-
 test/models/storage/no_reuse_test.rb          | 77 +++++++++++++++++++
 4 files changed, 140 insertions(+), 18 deletions(-)
 create mode 100644 config/initializers/active_storage_purge_on_last_attachment.rb

diff --git a/config/initializers/active_storage_no_reuse.rb b/config/initializers/active_storage_no_reuse.rb
index 2def087fe..0bd057cde 100644
--- a/config/initializers/active_storage_no_reuse.rb
+++ b/config/initializers/active_storage_no_reuse.rb
@@ -16,6 +16,8 @@
 # attached to an untracked type (avatar/export) could theoretically be reused in a tracked
 # context. This is acceptable - user-accessible blob IDs from untracked contexts are
 # basically nonexistent in practice.
+#
+# Exception: ActionText embeds are allowed to reuse blobs to support copy/paste.
 
 ActiveSupport.on_load(:active_storage_attachment) do
   validate :blob_account_matches_record, on: :create
@@ -29,30 +31,31 @@ ActiveSupport.on_load(:active_storage_attachment) do
     # bypass tenancy checks via try(:account) returning nil - this is intentional as
     # these classes don't participate in storage tracking.
     def blob_account_matches_record
-      return unless record&.try(:account).present?
-      return if whitelisted_for_cross_account?
-
-      unless blob&.account_id == record.account.id
-        errors.add(:blob_id, "blob account must match record account")
+      if record&.try(:account).present? && !whitelisted_for_cross_account?
+        unless blob&.account_id == record.account.id
+          errors.add(:blob_id, "blob account must match record account")
+        end
       end
     end
 
     # Ledger integrity: blob can only have one tracked attachment
     def no_tracked_blob_reuse
       tracked_record = record&.try(:storage_tracked_record)
-      return unless tracked_record.present?
-      return if whitelisted_for_cross_account?
+      if tracked_record.present? &&
+          !whitelisted_for_cross_account? &&
+          !(record_type == "ActionText::RichText" && name == "embeds")
 
-      # Check for existing attachment of this blob in tracked contexts
-      # Uses Storage::TRACKED_RECORD_TYPES constant to stay generic
-      existing = ActiveStorage::Attachment
-        .where(blob_id: blob_id)
-        .where(record_type: Storage::TRACKED_RECORD_TYPES)
-        .where.not(id: id)
-        .exists?
+        # Check for existing attachment of this blob in tracked contexts
+        # Uses Storage::TRACKED_RECORD_TYPES constant to stay generic
+        existing = ActiveStorage::Attachment
+          .where(blob_id: blob_id)
+          .where(record_type: Storage::TRACKED_RECORD_TYPES)
+          .where.not(id: id)
+          .exists?
 
-      if existing
-        errors.add(:blob_id, "cannot reuse blob in tracked storage context")
+        if existing
+          errors.add(:blob_id, "cannot reuse blob in tracked storage context")
+        end
       end
     end
 
diff --git a/config/initializers/active_storage_purge_on_last_attachment.rb b/config/initializers/active_storage_purge_on_last_attachment.rb
new file mode 100644
index 000000000..cbe0f0f13
--- /dev/null
+++ b/config/initializers/active_storage_purge_on_last_attachment.rb
@@ -0,0 +1,40 @@
+# Fizzy-specific override: ActiveStorage's default purge path uses `delete`,
+# which skips attachment callbacks. We need `destroy` so storage ledger detaches
+# are recorded and reused blobs (ActionText embeds) aren't purged until the
+# last attachment is gone. Keep this local to Fizzy; it's not a Rails default.
+module ActiveStorage
+  module PurgeOnLastAttachment
+    def purge
+      @purge_mode = :purge
+      destroy
+      purge_blob_if_last(:purge) if destroyed?
+    ensure
+      @purge_mode = nil
+    end
+
+    def purge_later
+      @purge_mode = :purge_later
+      destroy
+      purge_blob_if_last(:purge_later) if destroyed?
+    ensure
+      @purge_mode = nil
+    end
+
+    private
+      def purge_dependent_blob_later
+        if dependent == :purge_later && !@purge_mode
+          purge_blob_if_last(:purge_later)
+        end
+      end
+
+      def purge_blob_if_last(mode)
+        if blob && !blob.attachments.exists?
+          mode == :purge ? blob.purge : blob.purge_later
+        end
+      end
+  end
+end
+
+ActiveSupport.on_load(:active_storage_attachment) do
+  prepend ActiveStorage::PurgeOnLastAttachment
+end
diff --git a/script/migrations/backfill-storage-ledger.rb b/script/migrations/backfill-storage-ledger.rb
index 5d89342fc..aa3ec793f 100644
--- a/script/migrations/backfill-storage-ledger.rb
+++ b/script/migrations/backfill-storage-ledger.rb
@@ -10,17 +10,19 @@
 #
 # Safe to re-run: skips attachments that already have entries (by blob_id + recordable).
 #
-# IMPORTANT: Before running in production, verify zero historic blob reuse in tracked contexts:
+# OPTIONAL: If you want to enforce no-reuse for direct attachments, verify there are
+# no existing violations (ActionText embeds may legitimately reuse blobs):
 #
 #   ActiveStorage::Attachment
 #     .joins(:blob)
 #     .where(record_type: Storage::TRACKED_RECORD_TYPES)
+#     .where.not(record_type: "ActionText::RichText")
 #     .where.not(active_storage_blobs: { account_id: Storage::TEMPLATE_ACCOUNT_ID })
 #     .select(:blob_id)
 #     .group(:blob_id)
 #     .having("COUNT(*) > 1")
 #     .count
-#   # Should return empty hash if no reuse exists in tracked contexts
+#   # Should return empty hash if no direct-attachment reuse exists
 #
 # If reuse exists (excluding template blobs), fix the data first.
 class BackfillStorageLedger
diff --git a/test/models/storage/no_reuse_test.rb b/test/models/storage/no_reuse_test.rb
index 5af07511f..e876fe50c 100644
--- a/test/models/storage/no_reuse_test.rb
+++ b/test/models/storage/no_reuse_test.rb
@@ -33,6 +33,83 @@ class Storage::NoReuseTest < ActiveSupport::TestCase
     assert_equal 1, ActiveStorage::Attachment.where(blob_id: blob.id).count
   end
 
+  test "allows reuse for ActionText embeds" do
+    file = file_fixture("moon.jpg")
+    blob = ActiveStorage::Blob.create_and_upload! \
+      io: file.open,
+      filename: "embed.jpg",
+      content_type: "image/jpeg"
+
+    embed_html = ActionText::Attachment.from_attachable(blob).to_html
+
+    card1 = @board.cards.create!(title: "Card 1", creator: users(:david))
+    card1.update!(description: "<p>#{embed_html}</p>")
+    card1.reload
+
+    card2 = @board.cards.create!(title: "Card 2", creator: users(:david))
+    card2.update!(description: "<p>#{embed_html}</p>")
+    card2.reload
+
+    assert_equal 2, ActiveStorage::Attachment.where(
+      record_type: "ActionText::RichText",
+      name: "embeds",
+      blob_id: blob.id
+    ).count
+  end
+
+  test "purge_later does not purge blob when still attached elsewhere" do
+    file = file_fixture("moon.jpg")
+    blob = ActiveStorage::Blob.create_and_upload! \
+      io: file.open,
+      filename: "embed.jpg",
+      content_type: "image/jpeg"
+
+    embed_html = ActionText::Attachment.from_attachable(blob).to_html
+
+    card1 = @board.cards.create!(title: "Card 1", creator: users(:david))
+    card1.update!(description: "<p>#{embed_html}</p>")
+
+    card2 = @board.cards.create!(title: "Card 2", creator: users(:david))
+    card2.update!(description: "<p>#{embed_html}</p>")
+
+    attachment = ActiveStorage::Attachment.find_by(
+      record: card1.rich_text_description,
+      name: "embeds",
+      blob_id: blob.id
+    )
+
+    assert_no_enqueued_jobs only: ActiveStorage::PurgeJob do
+      attachment.purge_later
+    end
+
+    assert ActiveStorage::Blob.exists?(blob.id)
+    assert_equal 1, ActiveStorage::Attachment.where(blob_id: blob.id).count
+  end
+
+  test "purge_later enqueues purge when last attachment is removed" do
+    file = file_fixture("moon.jpg")
+    blob = ActiveStorage::Blob.create_and_upload! \
+      io: file.open,
+      filename: "embed.jpg",
+      content_type: "image/jpeg"
+
+    embed_html = ActionText::Attachment.from_attachable(blob).to_html
+
+    card = @board.cards.create!(title: "Card", creator: users(:david))
+    card.update!(description: "<p>#{embed_html}</p>")
+    card.reload
+
+    attachment = ActiveStorage::Attachment.find_by(
+      record: card.rich_text_description,
+      name: "embeds",
+      blob_id: blob.id
+    )
+
+    assert_enqueued_with job: ActiveStorage::PurgeJob, args: [ blob ] do
+      attachment.purge_later
+    end
+  end
+
   test "rejects cross-account blob attachment" do
     other_account = Account.create!(name: "Other")
     other_board = other_account.boards.create!(name: "Other Board", creator: users(:david))

From 99e89606b45da36bd83be41fd636625f877a0e50 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 13:06:30 -0600
Subject: [PATCH 04/22] Keep strong tags words on same line

---
 saas/app/views/account/settings/_free_plan.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/saas/app/views/account/settings/_free_plan.html.erb b/saas/app/views/account/settings/_free_plan.html.erb
index dacb7e150..edb5bb57a 100644
--- a/saas/app/views/account/settings/_free_plan.html.erb
+++ b/saas/app/views/account/settings/_free_plan.html.erb
@@ -10,7 +10,7 @@
   <% end %>
 </h3>
 
-<p class="margin-block-start-half">To keep using Fizzy <%= "past #{ number_with_delimiter(Plan.free.card_limit) } cards," unless Current.account.exceeding_storage_limit? %> it’s only <strong><%= format_currency(Plan.paid.price) %>/month</strong> for <strong>unlimited cards</strong>, <strong>unlimited users</strong>, and <strong><%= storage_to_human_size(Plan.paid.storage_limit) %></strong> of storage.</p>
+<p class="margin-block-start-half">To keep using Fizzy <%= "past #{ number_with_delimiter(Plan.free.card_limit) } cards," unless Current.account.exceeding_storage_limit? %> it’s only <strong><%= format_currency(Plan.paid.price) %>/month</strong> for <strong class="txt-nowrap">unlimited cards</strong>, <strong class="txt-nowrap">unlimited users</strong>, and <strong><%= storage_to_human_size(Plan.paid.storage_limit) %></strong> of storage.</p>
 
 <%= button_to "Upgrade to #{Plan.paid.name} for #{ format_currency(Plan.paid.price) }/month", account_subscription_path, class: "btn settings-subscription__button txt-medium", form: { data: { turbo: false } } %>
 

From af3fa177aa36a4082bf59c1613c918b466bedbf6 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 13:07:34 -0600
Subject: [PATCH 05/22] Phrasing tweak for exceeding storage limit

---
 saas/app/views/account/settings/_free_plan.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/saas/app/views/account/settings/_free_plan.html.erb b/saas/app/views/account/settings/_free_plan.html.erb
index edb5bb57a..ca467d8af 100644
--- a/saas/app/views/account/settings/_free_plan.html.erb
+++ b/saas/app/views/account/settings/_free_plan.html.erb
@@ -4,7 +4,7 @@
   <% elsif Current.account.exceeding_card_limit? %>
     You’ve used up your <u><%= number_with_delimiter(Plan.free.card_limit) %></u> free cards
   <% elsif Current.account.exceeding_storage_limit? %>
-    You’ve used up all <u><%= storage_to_human_size(Plan.free.storage_limit) %></u> free storage
+    You’ve used up all <u><%= storage_to_human_size(Plan.free.storage_limit) %></u> of free storage
   <% else %>
     You’ve used <u><%= Current.account.billed_cards_count %></u> free cards out of <%= number_with_delimiter(Plan.free.card_limit) %>
   <% end %>

From 8bb043bef817c6a66a13e025824b2216fb720b4b Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 13:14:37 -0600
Subject: [PATCH 06/22] Move Undo form inside closure message element

---
 app/assets/stylesheets/card-perma.css       |  4 ++++
 app/views/cards/container/_closure.html.erb | 10 ++++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/app/assets/stylesheets/card-perma.css b/app/assets/stylesheets/card-perma.css
index 240dadb4b..8d1340c23 100644
--- a/app/assets/stylesheets/card-perma.css
+++ b/app/assets/stylesheets/card-perma.css
@@ -343,5 +343,9 @@
     grid-area: closure-message;
     margin-block-start: 0.5ch;
     padding-inline: 1ch;
+
+    form {
+      display: inline;
+    }
   }
 }
diff --git a/app/views/cards/container/_closure.html.erb b/app/views/cards/container/_closure.html.erb
index 09b7a4ef4..8aa190c78 100644
--- a/app/views/cards/container/_closure.html.erb
+++ b/app/views/cards/container/_closure.html.erb
@@ -2,10 +2,12 @@
   <% if card.closed? %>
     <div class="card-perma__notch card-perma__notch--bottom flex-column">
       <div class="flex gap-half margin-block-start-double margin-block-end">
-        <span class="card-perma__closure-message">Completed by <%= card.closed_by.name %> on <%= local_datetime_tag(card.closed_at, style: :shortdate) %>.</span>
-        <%= button_to card_closure_path(card), method: :delete, class: "btn btn--plain borderless fill-transparent" do %>
-          <span class="pad-inline-end">Undo</span>
-        <% end %>
+        <span class="card-perma__closure-message">
+          Completed by <%= card.closed_by.name %> on <%= local_datetime_tag(card.closed_at, style: :shortdate) %>.
+          <%= button_to card_closure_path(card), method: :delete, class: "btn btn--plain borderless fill-transparent" do %>
+            <span class="pad-inline-end">Undo</span>
+          <% end %>
+        </span>
       </div>
     </div>
   <% else %>

From ca5bca979628f9a81a393023d9148583078e301a Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 13:18:39 -0600
Subject: [PATCH 07/22] Bump boost size up a tick on mobile

---
 app/assets/stylesheets/comments.css | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/assets/stylesheets/comments.css b/app/assets/stylesheets/comments.css
index a8956a98e..8fef15ebb 100644
--- a/app/assets/stylesheets/comments.css
+++ b/app/assets/stylesheets/comments.css
@@ -4,7 +4,7 @@
     --comment-padding-block: var(--block-space-half);
     --comment-padding-inline: var(--inline-space-double);
     --comment-max: 70ch;
-    --reaction-size: 2rem;
+    --reaction-size: 2.25rem;
 
     display: flex;
     flex-direction: column;
@@ -130,6 +130,10 @@
 
   .comment__edit {
     background-color: var(--color-ink-lightest);
+
+    &:hover {
+      z-index: 1;
+    }
   }
 
   .comment__permalink-title {

From 025d70dd130702be957497a5a8a0985095246c5e Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Wed, 7 Jan 2026 14:13:15 +0100
Subject: [PATCH 08/22] Use separate cache namespaces for each beta instance

Otherwise we end up with views including URLs from all the betas,
leading to some confusion and problems with the CSP.
---
 config/cache.yml            | 2 +-
 saas/config/deploy.beta.yml | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/cache.yml b/config/cache.yml
index d1716bb58..302a4f878 100644
--- a/config/cache.yml
+++ b/config/cache.yml
@@ -1,7 +1,7 @@
 default_options: &default_options
   store_options:
     max_age: <%= 60.days.to_i %>
-    namespace: <%= Rails.env %>
+    namespace: <%= "#{Rails.env}#{"-#{ENV["CACHE_NAMESPACE"]}" if ENV["CACHE_NAMESPACE"]}" %>
 
 default_connection: &default_connection
   database: cache
diff --git a/saas/config/deploy.beta.yml b/saas/config/deploy.beta.yml
index 14bf89698..d5fce9d32 100644
--- a/saas/config/deploy.beta.yml
+++ b/saas/config/deploy.beta.yml
@@ -75,6 +75,7 @@ ssh:
 env:
   clear:
     APP_FQDN: beta<%= @beta_number %>.fizzy-beta.com
+    CACHE_NAMESPACE: <%= @beta_number %>
     RAILS_ENV: beta
     RAILS_LOG_LEVEL: fatal # suppress unstructured log lines
     MYSQL_DATABASE_HOST: fizzy-mysql-primary

From df7df74752d6663337558a64ebfd13ab6f48bb5d Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 13:31:36 -0600
Subject: [PATCH 09/22] Brighten mini bubbles in dark mode

---
 app/assets/stylesheets/card-columns.css | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/app/assets/stylesheets/card-columns.css b/app/assets/stylesheets/card-columns.css
index 6aaacaf8b..0cf3df345 100644
--- a/app/assets/stylesheets/card-columns.css
+++ b/app/assets/stylesheets/card-columns.css
@@ -749,11 +749,12 @@
   .cards--doing.is-collapsed:has(.bubble:not([hidden])) .cards__transition-container {
     --bubble-color: var(--card-color, oklch(var(--lch-blue-medium)));
     --bubble-shape: 54% 46% 61% 39% / 57% 49% 51% 43%;
+    --bubble-opacity: 50%;
 
     &:before {
       background: radial-gradient(
-        color-mix(in srgb, var(--bubble-color) 8%, var(--color-canvas)) 50%,
-        color-mix(in srgb, var(--bubble-color) 48%, var(--color-canvas)) 100%
+        color-mix(in srgb, var(--bubble-color) calc(var(--bubble-opacity) / 5), var(--color-canvas)) 50%,
+        color-mix(in srgb, var(--bubble-color) var(--bubble-opacity), var(--color-canvas)) 100%
       );
       block-size: 1em;
       border-radius: var(--bubble-shape);
@@ -777,6 +778,22 @@
         z-index: -1;
       }
     }
+
+    @media (max-width: 639px) {
+      &.cards__expander-title:before {
+        display: none;
+      }
+    }
+
+    html[data-theme="dark"] & {
+      --bubble-opacity: 100%;
+    }
+
+    @media (prefers-color-scheme: dark) {
+      html:not([data-theme]) & {
+        --bubble-opacity: 100%;
+      }
+    }
   }
 
   /* Card column indicators

From 8288e85df6d26a61e554a5913afc617a477d7835 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 13:34:30 -0600
Subject: [PATCH 10/22] More sturated mini bubbles in light mode

---
 app/assets/stylesheets/card-columns.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/stylesheets/card-columns.css b/app/assets/stylesheets/card-columns.css
index 0cf3df345..f60e8da73 100644
--- a/app/assets/stylesheets/card-columns.css
+++ b/app/assets/stylesheets/card-columns.css
@@ -748,8 +748,8 @@
   .cards--maybe.is-collapsed:has(.bubble:not([hidden])) .cards__transition-container,
   .cards--doing.is-collapsed:has(.bubble:not([hidden])) .cards__transition-container {
     --bubble-color: var(--card-color, oklch(var(--lch-blue-medium)));
+    --bubble-opacity: 75%;
     --bubble-shape: 54% 46% 61% 39% / 57% 49% 51% 43%;
-    --bubble-opacity: 50%;
 
     &:before {
       background: radial-gradient(

From 4dedfce39f9879aeff3089418f5ceb8012a6533b Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 14:00:37 -0600
Subject: [PATCH 11/22] Add dialog manager to events page

---
 app/views/events/index.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/events/index.html.erb b/app/views/events/index.html.erb
index 1279e4dac..5e0744d26 100644
--- a/app/views/events/index.html.erb
+++ b/app/views/events/index.html.erb
@@ -6,7 +6,7 @@
 <% content_for :header do %>
   <%= render "events/index/add_card_button", user_filtering: @user_filtering %>
 
-  <h1 class="header__title">
+  <h1 class="header__title" data-controller="dialog-manager">
     <% if @user_filtering.boards.many? %>
       <span>Activity <%= @user_filtering.filter.boards.any? ? "in" : "across" %></span>
     <% else %>

From 64fdbf6b8fef564a7d7e47cebb6cf732fe208251 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 15:37:06 -0600
Subject: [PATCH 12/22] Clean up blank slates

---
 app/assets/stylesheets/blank-slates.css       | 51 +++++--------------
 app/assets/stylesheets/card-columns.css       | 28 +++++++++-
 app/assets/stylesheets/notifications.css      |  2 +-
 app/assets/stylesheets/search.css             |  2 +-
 .../columns/_empty_placeholder.html.erb       |  6 +--
 .../boards/show/_filtered_cards.html.erb      |  2 +-
 app/views/cards/index.html.erb                |  2 +-
 app/views/my/menus/_jump.html.erb             |  2 +-
 .../index/_unread_notifications.html.erb      |  2 +-
 .../boards/columns/closeds/show.html.erb      |  2 +-
 .../boards/columns/not_nows/show.html.erb     |  2 +-
 app/views/public/boards/columns/show.html.erb |  2 +-
 .../boards/columns/streams/show.html.erb      |  2 +-
 app/views/searches/_results.html.erb          |  2 +-
 test/controllers/searches_controller_test.rb  |  2 +-
 15 files changed, 54 insertions(+), 55 deletions(-)

diff --git a/app/assets/stylesheets/blank-slates.css b/app/assets/stylesheets/blank-slates.css
index aa221c452..90532c33c 100644
--- a/app/assets/stylesheets/blank-slates.css
+++ b/app/assets/stylesheets/blank-slates.css
@@ -1,46 +1,21 @@
+/* Styles for the blank slate. To manage when they are shown/hidden, do so in context */
+
 @layer components {
-  .blank-slate--drag {
-    box-shadow: none !important;
-    color: color-mix(in srgb, var(--card-color) 70%, var(--color-canvas));
-
-    p {
-      font-size: var(--text-small);
-      overflow: hidden;
-      text-align: center;
-      text-overflow: ellipsis;
-      white-space: nowrap;
-    }
-
-    .cards--maybe & {
-      background-color: var(--card-bg-color) !important;
-    }
-
-    .cards--grid & {
-      display: none;
-    }
-  }
-
-  .blank-slate--empty {
-    border: 2px dashed var(--color-ink-light);
+  .blank-slate {
     border-radius: 1ch;
+    border: 2px dashed var(--color-ink-lighter);
     color: var(--color-ink-dark);
-    margin-block-start: 2dvh;
-    padding: 1ch 2ch;
-    rotate: -3deg;
     font-weight: 500;
-
-    .cards:has(.card) & {
-      display: none;
-    }
+    margin-block-start: 2dvh;
+    padding: 1.5ch 2ch;
+    rotate: -3deg;
   }
 
-  .blank-slate--filters {
-    .cards--grid:has(.card) & {
-      display: none;
-    }
-  }
-
-  .cards__list:has(> :not(.blank-slate)) .card--hide-unless-empty {
-    display: none;
+  .blank-slate--drag {
+    background-color: color-mix(in srgb, transparent, var(--card-color) 5%);
+    border-color: color-mix(in srgb, transparent, var(--card-color) 10%);
+    color: color-mix(in srgb, transparent, var(--card-color) 75%);
+    margin-block-start: 0;
+    rotate: 0deg;
   }
 }
diff --git a/app/assets/stylesheets/card-columns.css b/app/assets/stylesheets/card-columns.css
index f60e8da73..4edb06c64 100644
--- a/app/assets/stylesheets/card-columns.css
+++ b/app/assets/stylesheets/card-columns.css
@@ -255,6 +255,27 @@
         }
       }
     }
+
+    &:has(.card) {
+      .blank-slate {
+        display: none;
+      }
+    }
+
+    /* Use the default blank-slate on small viewports since drag-and-drop isn't available */
+    [data-controller~="drag-and-drop"] & {
+      @media (max-width: 639px) {
+        .blank-slate--drag {
+          display: none;
+        }
+      }
+
+      @media (min-width: 640px) {
+        .blank-slate--default {
+          display: none;
+        }
+      }
+    }
   }
 
   .cards__new-column {
@@ -315,6 +336,10 @@
       inline-size: fit-content;
       margin: 0 0 0 auto;
     }
+
+    .blank-slate--drag {
+      display: none;
+    }
   }
 
   /* Column Elements
@@ -731,7 +756,8 @@
   .cards--on-deck {
     --card-color: var(--color-ink-light) !important;
 
-    .card {
+    .card,
+    .blank-slate {
       --card-color: var(--color-card-complete) !important;
     }
 
diff --git a/app/assets/stylesheets/notifications.css b/app/assets/stylesheets/notifications.css
index ada7324d2..91ff5750d 100644
--- a/app/assets/stylesheets/notifications.css
+++ b/app/assets/stylesheets/notifications.css
@@ -30,7 +30,7 @@
     }
 
     &:has(.card--notification) {
-      .notifications-list__empty-message {
+      .notifications-list__blank-slate {
         display: none;
       }
     }
diff --git a/app/assets/stylesheets/search.css b/app/assets/stylesheets/search.css
index fcd4563ca..5691ac5e5 100644
--- a/app/assets/stylesheets/search.css
+++ b/app/assets/stylesheets/search.css
@@ -71,7 +71,7 @@ summary {
     text-align: start;
   }
 
-  .search__empty {
+  .search__blank-slate {
     margin-block: 3em;
     margin-inline: auto;
     inline-size: fit-content;
diff --git a/app/views/boards/columns/_empty_placeholder.html.erb b/app/views/boards/columns/_empty_placeholder.html.erb
index d9da8a896..21e709b84 100644
--- a/app/views/boards/columns/_empty_placeholder.html.erb
+++ b/app/views/boards/columns/_empty_placeholder.html.erb
@@ -1,4 +1,2 @@
-<div class="blank-slate blank-slate--drag card card--hide-unless-empty">
-  <p>Drag cards here</p>
-</div>
-<div class="blank-slate blank-slate--empty card--hide-unless-empty">No cards here</div>
+<div class="blank-slate blank-slate--default">No cards here</div>
+<div class="blank-slate blank-slate--drag overflow-ellipsis">Drag cards here</div>
diff --git a/app/views/boards/show/_filtered_cards.html.erb b/app/views/boards/show/_filtered_cards.html.erb
index 4e4d8f749..53b25f80f 100644
--- a/app/views/boards/show/_filtered_cards.html.erb
+++ b/app/views/boards/show/_filtered_cards.html.erb
@@ -3,6 +3,6 @@
     <%= with_automatic_pagination :filtered_cards_paginated_container, page do %>
       <%= render "cards/display/previews", cards: page.records, draggable: true %>
     <% end %>
-    <div class="blank-slate blank-slate--empty blank-slate--filters">No cards match this filter</div>
+    <div class="blank-slate">No cards match this filter</div>
   </div>
 </section>
diff --git a/app/views/cards/index.html.erb b/app/views/cards/index.html.erb
index a7e4769f5..20bbfac98 100644
--- a/app/views/cards/index.html.erb
+++ b/app/views/cards/index.html.erb
@@ -23,7 +23,7 @@
       <%= with_automatic_pagination :cards_paginated_container, @page do %>
         <%= render "cards/display/previews", cards: @page.records, draggable: true %>
       <% end %>
-      <div class="blank-slate blank-slate--empty blank-slate--filters">No cards match this filter</div>
+      <div class="blank-slate">No cards match this filter</div>
     </div>
   </section>
 <% end %>
diff --git a/app/views/my/menus/_jump.html.erb b/app/views/my/menus/_jump.html.erb
index 1f1ea70c9..f22bedf23 100644
--- a/app/views/my/menus/_jump.html.erb
+++ b/app/views/my/menus/_jump.html.erb
@@ -26,7 +26,7 @@
 
   <%= yield %>
 
-  <div class="nav__blank-slate blank-slate blank-slate--empty">
+  <div class="nav__blank-slate blank-slate">
     Nothing matches that filter
   </div>
 </div>
diff --git a/app/views/notifications/index/_unread_notifications.html.erb b/app/views/notifications/index/_unread_notifications.html.erb
index b8b9618d1..4890a4822 100644
--- a/app/views/notifications/index/_unread_notifications.html.erb
+++ b/app/views/notifications/index/_unread_notifications.html.erb
@@ -5,7 +5,7 @@
       <%= button_to "Mark all as read", bulk_reading_path, class: "btn txt-small", form: { data: { turbo: false } }, data: { action: "badge#clear" } %>
     </div>
   <% else %>
-    <div class="notifications-list__empty-message blank-slate blank-slate--empty align-self-center">
+    <div class="notifications-list__blank-slate blank-slate align-self-center">
       Nothing new for you
     </div>
   <% end %>
diff --git a/app/views/public/boards/columns/closeds/show.html.erb b/app/views/public/boards/columns/closeds/show.html.erb
index 21977743e..61ce3887d 100644
--- a/app/views/public/boards/columns/closeds/show.html.erb
+++ b/app/views/public/boards/columns/closeds/show.html.erb
@@ -18,7 +18,7 @@
           <%= render "cards/display/public_previews", cards: @page.records %>
         <% end %>
       <% else %>
-        <div class="blank-slate blank-slate--empty">No cards here</div>
+        <div class="blank-slate">No cards here</div>
       <% end %>
     </div>
   <% end %>
diff --git a/app/views/public/boards/columns/not_nows/show.html.erb b/app/views/public/boards/columns/not_nows/show.html.erb
index 786cb7afb..3dad8bcfe 100644
--- a/app/views/public/boards/columns/not_nows/show.html.erb
+++ b/app/views/public/boards/columns/not_nows/show.html.erb
@@ -18,7 +18,7 @@
           <%= render "cards/display/public_previews", cards: @page.records %>
         <% end %>
       <% else %>
-        <div class="blank-slate blank-slate--empty">No cards here</div>
+        <div class="blank-slate">No cards here</div>
       <% end %>
     </div>
   <% end %>
diff --git a/app/views/public/boards/columns/show.html.erb b/app/views/public/boards/columns/show.html.erb
index 6f0d2542f..a8a86451b 100644
--- a/app/views/public/boards/columns/show.html.erb
+++ b/app/views/public/boards/columns/show.html.erb
@@ -18,7 +18,7 @@
           <%= render "cards/display/public_previews", cards: @page.records %>
         <% end %>
       <% else %>
-        <div class="blank-slate blank-slate--empty">No cards here</div>
+        <div class="blank-slate">No cards here</div>
       <% end %>
     </div>
   <% end %>
diff --git a/app/views/public/boards/columns/streams/show.html.erb b/app/views/public/boards/columns/streams/show.html.erb
index 4df8c2b12..5566a7955 100644
--- a/app/views/public/boards/columns/streams/show.html.erb
+++ b/app/views/public/boards/columns/streams/show.html.erb
@@ -18,7 +18,7 @@
           <%= render "cards/display/public_previews", cards: @page.records %>
         <% end %>
       <% else %>
-        <div class="blank-slate blank-slate--empty">No cards here</div>
+        <div class="blank-slate">No cards here</div>
       <% end %>
     </div>
   <% end %>
diff --git a/app/views/searches/_results.html.erb b/app/views/searches/_results.html.erb
index 602878c65..0b622e95d 100644
--- a/app/views/searches/_results.html.erb
+++ b/app/views/searches/_results.html.erb
@@ -1,7 +1,7 @@
 <section class="search">
   <div class="search__results">
     <% unless page.used? %>
-      <div class="search__empty blank-slate blank-slate--empty">
+      <div class="search__blank-slate blank-slate">
         No matches
       </div>
     <% end %>
diff --git a/test/controllers/searches_controller_test.rb b/test/controllers/searches_controller_test.rb
index 14bd91e64..70ec15da9 100644
--- a/test/controllers/searches_controller_test.rb
+++ b/test/controllers/searches_controller_test.rb
@@ -39,7 +39,7 @@ class SearchesControllerTest < ActionDispatch::IntegrationTest
     # Searching with non-existent card id
     get search_path(q: "999999", script_name: "/#{@account.external_account_id}")
     assert_select "form[data-controller='auto-submit']", count: 0
-    assert_select ".search__empty", text: "No matches"
+    assert_select ".search__blank-slate", text: "No matches"
   end
 
   test "search highlights matched terms with proper HTML marks" do

From f428bfaa7c3234a7a79b13785b0bc66d50c5c4e9 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 15:43:59 -0600
Subject: [PATCH 13/22] Adjust border radius

---
 app/assets/stylesheets/blank-slates.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/stylesheets/blank-slates.css b/app/assets/stylesheets/blank-slates.css
index 90532c33c..5db13ef7f 100644
--- a/app/assets/stylesheets/blank-slates.css
+++ b/app/assets/stylesheets/blank-slates.css
@@ -2,7 +2,7 @@
 
 @layer components {
   .blank-slate {
-    border-radius: 1ch;
+    border-radius: 0.5ch;
     border: 2px dashed var(--color-ink-lighter);
     color: var(--color-ink-dark);
     font-weight: 500;

From 589ae1ab36846b73170122002042ff4b86660932 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Mon, 12 Jan 2026 16:23:20 -0600
Subject: [PATCH 14/22] Move handleDesktop inside
 restoreColumnsDisablingTransitions

---
 .../controllers/collapsible_columns_controller.js         | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/javascript/controllers/collapsible_columns_controller.js b/app/javascript/controllers/collapsible_columns_controller.js
index 1a9ba4174..e432a054f 100644
--- a/app/javascript/controllers/collapsible_columns_controller.js
+++ b/app/javascript/controllers/collapsible_columns_controller.js
@@ -14,13 +14,12 @@ export default class extends Controller {
   }
 
   async connect() {
-    await this.#restoreColumnsDisablingTransitions()
-    this.#setupIntersectionObserver()
-
     this.mediaQuery = window.matchMedia(this.desktopBreakpointValue)
     this.handleDesktop = this.#handleDesktop.bind(this)
     this.mediaQuery.addEventListener("change", this.handleDesktop)
-    this.handleDesktop(this.mediaQuery)
+
+    await this.#restoreColumnsDisablingTransitions()
+    this.#setupIntersectionObserver()
   }
 
   disconnect() {
@@ -57,6 +56,7 @@ export default class extends Controller {
   async #restoreColumnsDisablingTransitions() {
     this.#disableTransitions()
     this.#restoreColumns()
+    this.#handleDesktop()
 
     await nextFrame()
     this.#enableTransitions()

From 603e4d10b3cc7e5183733a0b2fc028d75cada920 Mon Sep 17 00:00:00 2001
From: Alexander Zaytsev <nqst@users.noreply.github.com>
Date: Tue, 13 Jan 2026 09:50:37 +0100
Subject: [PATCH 15/22] Add `.txt-balance` utility

---
 app/assets/stylesheets/utilities.css | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/assets/stylesheets/utilities.css b/app/assets/stylesheets/utilities.css
index aa19f0f58..76dedfe12 100644
--- a/app/assets/stylesheets/utilities.css
+++ b/app/assets/stylesheets/utilities.css
@@ -24,6 +24,7 @@
   .txt-underline { text-decoration: underline; }
   .txt-tight-lines { line-height: 1.2; }
   .txt-nowrap { white-space: nowrap; }
+  .txt-balance { text-wrap: balance; }
   .txt-break { word-break: break-word; }
   .txt-uppercase { text-transform: uppercase; }
   .txt-capitalize { text-transform: capitalize; }

From 6c6a7be6076b10d51c732b7f79a9d6c92900ec28 Mon Sep 17 00:00:00 2001
From: Alexander Zaytsev <nqst@users.noreply.github.com>
Date: Tue, 13 Jan 2026 09:51:35 +0100
Subject: [PATCH 16/22] Balance magic link instructions

---
 app/views/sessions/magic_links/show.html.erb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/sessions/magic_links/show.html.erb b/app/views/sessions/magic_links/show.html.erb
index c4940e146..aba8411f5 100644
--- a/app/views/sessions/magic_links/show.html.erb
+++ b/app/views/sessions/magic_links/show.html.erb
@@ -3,7 +3,7 @@
 <div class="panel panel--centered flex flex-column gap-half <%= "shake" if flash[:alert] || flash[:shake] %>">
   <header>
     <h1 class="txt-x-large font-weight-black margin-none"><%= @page_title %></h1>
-    <p class="margin-none-block-start txt-medium">
+    <p class="margin-none-block-start txt-medium txt-balance">
       Then enter the verification code included in the email below:
     </p>
   </header>
@@ -15,7 +15,7 @@
         data: { magic_link_target: "input", action: "keydown.enter->magic-link#submitOnEnter paste->magic-link#submitOnPaste" } %>
   <% end %>
 
-  <p class="txt-small">The code sent to <strong><%= email_address_pending_authentication %></strong> will work for <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %>.</p>
+  <p class="txt-small txt-balance">The code sent to <strong><%= email_address_pending_authentication %></strong> will work for <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %>.</p>
 </div>
 
 <% if Rails.env.development? && flash[:magic_link_code].present? %>

From 40a5d6211e308e48917b2b8b9834387f1325c910 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Tue, 13 Jan 2026 11:41:49 +0100
Subject: [PATCH 17/22] Update development dependencies

---
 Gemfile.lock | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 4b3ce6e44..ad8f7fffd 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -149,11 +149,11 @@ GEM
     bindex (0.8.1)
     bootsnap (1.19.0)
       msgpack (~> 1.2)
-    brakeman (7.1.1)
+    brakeman (7.1.2)
       racc
     builder (3.3.0)
-    bundler-audit (0.9.2)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
       thor (~> 1.0)
     capybara (3.40.0)
       addressable
@@ -174,7 +174,7 @@ GEM
       rexml
     crass (1.0.6)
     date (3.5.1)
-    debug (1.11.0)
+    debug (1.11.1)
       irb (~> 1.10)
       reline (>= 0.3.8)
     dotenv (3.1.8)
@@ -184,7 +184,7 @@ GEM
     erubi (1.13.1)
     et-orbi (1.4.0)
       tzinfo
-    faker (3.5.2)
+    faker (3.5.3)
       i18n (>= 1.8.11, < 2)
     ffi (1.17.2-aarch64-linux-gnu)
     ffi (1.17.2-aarch64-linux-musl)
@@ -271,7 +271,7 @@ GEM
       stimulus-rails
       turbo-rails
     mittens (0.3.1)
-    mocha (2.8.2)
+    mocha (3.0.1)
       ruby2_keywords (>= 0.0.5)
     msgpack (1.8.0)
     net-http-persistent (4.0.6)
@@ -400,7 +400,7 @@ GEM
     ruby2_keywords (0.0.5)
     rubyzip (3.2.2)
     securerandom (0.4.1)
-    selenium-webdriver (4.38.0)
+    selenium-webdriver (4.39.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -440,7 +440,7 @@ GEM
     stimulus-rails (1.3.4)
       railties (>= 6.0.0)
     stringio (3.2.0)
-    thor (1.4.0)
+    thor (1.5.0)
     thruster (0.1.17)
     thruster (0.1.17-aarch64-linux)
     thruster (0.1.17-arm64-darwin)
@@ -458,8 +458,7 @@ GEM
       unicode-emoji (~> 4.1)
     unicode-emoji (4.1.0)
     uri (1.1.1)
-    vcr (6.3.1)
-      base64
+    vcr (6.4.0)
     web-console (4.2.1)
       actionview (>= 6.0.0)
       activemodel (>= 6.0.0)

From f6557856f7d0b8725ea2789c07277a231acf80f3 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Tue, 13 Jan 2026 11:42:22 +0100
Subject: [PATCH 18/22] Update runtime dependencies

Updated kamal, bootsnap, rqrcode, net-http-persistent, web-push, aws-sdk-s3, bcrypt & rouge
---
 Gemfile.lock      | 44 ++++++++++++++++++++++----------------------
 Gemfile.saas.lock | 46 +++++++++++++++++++++++-----------------------
 2 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index ad8f7fffd..0e48985b0 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -123,8 +123,8 @@ GEM
     ast (2.4.3)
     autotuner (1.1.0)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1197.0)
-    aws-sdk-core (3.240.0)
+    aws-partitions (1.1203.0)
+    aws-sdk-core (3.241.3)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -132,22 +132,22 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.118.0)
-      aws-sdk-core (~> 3, >= 3.239.1)
+    aws-sdk-kms (1.120.0)
+      aws-sdk-core (~> 3, >= 3.241.3)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.208.0)
-      aws-sdk-core (~> 3, >= 3.234.0)
+    aws-sdk-s3 (1.211.0)
+      aws-sdk-core (~> 3, >= 3.241.3)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.3.0)
-    bcrypt (3.1.20)
-    bcrypt_pbkdf (1.1.1)
+    bcrypt (3.1.21)
+    bcrypt_pbkdf (1.1.2)
     benchmark (0.5.0)
     bigdecimal (4.0.1)
     bindex (0.8.1)
-    bootsnap (1.19.0)
+    bootsnap (1.20.1)
       msgpack (~> 1.2)
     brakeman (7.1.2)
       racc
@@ -168,7 +168,7 @@ GEM
       logger (~> 1.5)
     chunky_png (1.4.0)
     concurrent-ruby (1.3.6)
-    connection_pool (2.5.5)
+    connection_pool (3.0.2)
     crack (1.0.1)
       bigdecimal
       rexml
@@ -177,7 +177,7 @@ GEM
     debug (1.11.1)
       irb (~> 1.10)
       reline (>= 0.3.8)
-    dotenv (3.1.8)
+    dotenv (3.2.0)
     drb (2.2.3)
     ed25519 (1.4.0)
     erb (6.0.1)
@@ -224,7 +224,7 @@ GEM
     json (2.18.0)
     jwt (3.1.2)
       base64
-    kamal (2.9.0)
+    kamal (2.10.1)
       activesupport (>= 7.0)
       base64 (~> 0.2)
       bcrypt_pbkdf (~> 1.0)
@@ -274,8 +274,8 @@ GEM
     mocha (3.0.1)
       ruby2_keywords (>= 0.0.5)
     msgpack (1.8.0)
-    net-http-persistent (4.0.6)
-      connection_pool (~> 2.2, >= 2.2.4)
+    net-http-persistent (4.0.8)
+      connection_pool (>= 2.2.4, < 4)
     net-imap (0.6.2)
       date
       net-protocol
@@ -307,7 +307,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.0-x86_64-linux-musl)
       racc (~> 1.4)
-    openssl (3.3.2)
+    openssl (4.0.0)
     ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.10.0)
@@ -319,7 +319,7 @@ GEM
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.6.0)
+    prism (1.8.0)
     propshaft (1.3.1)
       actionpack (>= 7.0.0)
       activesupport (>= 7.0.0)
@@ -360,11 +360,11 @@ GEM
     reline (0.6.3)
       io-console (~> 0.5)
     rexml (3.4.4)
-    rouge (4.6.1)
-    rqrcode (3.1.0)
+    rouge (4.7.0)
+    rqrcode (3.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
+    rqrcode_core (2.1.0)
     rubocop (1.81.7)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
@@ -430,7 +430,7 @@ GEM
     sqlite3 (2.8.0-x86_64-darwin)
     sqlite3 (2.8.0-x86_64-linux-gnu)
     sqlite3 (2.8.0-x86_64-linux-musl)
-    sshkit (1.24.0)
+    sshkit (1.25.0)
       base64
       logger
       net-scp (>= 1.1.2)
@@ -464,9 +464,9 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
-    web-push (3.0.2)
+    web-push (3.1.0)
       jwt (~> 3.0)
-      openssl (~> 3.0)
+      openssl (>= 3.0)
     webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 98cf833bc..37cabc12a 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -201,8 +201,8 @@ GEM
     ast (2.4.3)
     autotuner (1.1.0)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1197.0)
-    aws-sdk-core (3.240.0)
+    aws-partitions (1.1203.0)
+    aws-sdk-core (3.241.3)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -210,22 +210,22 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.118.0)
-      aws-sdk-core (~> 3, >= 3.239.1)
+    aws-sdk-kms (1.120.0)
+      aws-sdk-core (~> 3, >= 3.241.3)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.208.0)
-      aws-sdk-core (~> 3, >= 3.234.0)
+    aws-sdk-s3 (1.211.0)
+      aws-sdk-core (~> 3, >= 3.241.3)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.3.0)
-    bcrypt (3.1.20)
-    bcrypt_pbkdf (1.1.1)
+    bcrypt (3.1.21)
+    bcrypt_pbkdf (1.1.2)
     benchmark (0.5.0)
     bigdecimal (4.0.1)
     bindex (0.8.1)
-    bootsnap (1.19.0)
+    bootsnap (1.20.1)
       msgpack (~> 1.2)
     brakeman (7.1.1)
       racc
@@ -246,7 +246,7 @@ GEM
       logger (~> 1.5)
     chunky_png (1.4.0)
     concurrent-ruby (1.3.6)
-    connection_pool (2.5.5)
+    connection_pool (3.0.2)
     crack (1.0.1)
       bigdecimal
       rexml
@@ -255,7 +255,7 @@ GEM
     debug (1.11.0)
       irb (~> 1.10)
       reline (>= 0.3.8)
-    dotenv (3.1.8)
+    dotenv (3.2.0)
     drb (2.2.3)
     dry-initializer (3.2.0)
     ed25519 (1.4.0)
@@ -302,7 +302,7 @@ GEM
     json (2.18.0)
     jwt (3.1.2)
       base64
-    kamal (2.9.0)
+    kamal (2.10.1)
       activesupport (>= 7.0)
       base64 (~> 0.2)
       bcrypt_pbkdf (~> 1.0)
@@ -352,8 +352,8 @@ GEM
     mocha (2.8.2)
       ruby2_keywords (>= 0.0.5)
     msgpack (1.8.0)
-    net-http-persistent (4.0.6)
-      connection_pool (~> 2.2, >= 2.2.4)
+    net-http-persistent (4.0.8)
+      connection_pool (>= 2.2.4, < 4)
     net-imap (0.6.2)
       date
       net-protocol
@@ -383,7 +383,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.0-x86_64-linux-musl)
       racc (~> 1.4)
-    openssl (3.3.2)
+    openssl (4.0.0)
     ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.10.0)
@@ -395,7 +395,7 @@ GEM
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.6.0)
+    prism (1.8.0)
     prometheus-client-mmap (1.4.0)
       base64
       bigdecimal
@@ -470,11 +470,11 @@ GEM
       io-console (~> 0.5)
     rexml (3.4.4)
     rinku (2.0.6)
-    rouge (4.6.1)
-    rqrcode (3.1.0)
+    rouge (4.7.0)
+    rqrcode (3.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
+    rqrcode_core (2.1.0)
     rubocop (1.81.7)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
@@ -549,7 +549,7 @@ GEM
     sqlite3 (2.8.0-arm64-darwin)
     sqlite3 (2.8.0-x86_64-linux-gnu)
     sqlite3 (2.8.0-x86_64-linux-musl)
-    sshkit (1.24.0)
+    sshkit (1.25.0)
       base64
       logger
       net-scp (>= 1.1.2)
@@ -560,7 +560,7 @@ GEM
       railties (>= 6.0.0)
     stringio (3.2.0)
     stripe (18.0.1)
-    thor (1.4.0)
+    thor (1.5.0)
     thruster (0.1.17)
     thruster (0.1.17-aarch64-linux)
     thruster (0.1.17-arm64-darwin)
@@ -584,9 +584,9 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
-    web-push (3.0.2)
+    web-push (3.1.0)
       jwt (~> 3.0)
-      openssl (~> 3.0)
+      openssl (>= 3.0)
     webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)

From d5f270fe3a9a8838f29da94a4e8dbde81fc9f794 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Tue, 13 Jan 2026 12:06:43 +0100
Subject: [PATCH 19/22] Update development dependencies in SAAS lockfile

---
 Gemfile.saas.lock | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 37cabc12a..f340b4ae4 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -227,11 +227,11 @@ GEM
     bindex (0.8.1)
     bootsnap (1.20.1)
       msgpack (~> 1.2)
-    brakeman (7.1.1)
+    brakeman (7.1.2)
       racc
     builder (3.3.0)
-    bundler-audit (0.9.2)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
       thor (~> 1.0)
     capybara (3.40.0)
       addressable
@@ -252,7 +252,7 @@ GEM
       rexml
     crass (1.0.6)
     date (3.5.1)
-    debug (1.11.0)
+    debug (1.11.1)
       irb (~> 1.10)
       reline (>= 0.3.8)
     dotenv (3.2.0)
@@ -263,7 +263,7 @@ GEM
     erubi (1.13.1)
     et-orbi (1.4.0)
       tzinfo
-    faker (3.5.2)
+    faker (3.5.3)
       i18n (>= 1.8.11, < 2)
     ffi (1.17.2-aarch64-linux-gnu)
     ffi (1.17.2-aarch64-linux-musl)
@@ -349,7 +349,7 @@ GEM
       stimulus-rails
       turbo-rails
     mittens (0.3.1)
-    mocha (2.8.2)
+    mocha (3.0.1)
       ruby2_keywords (>= 0.0.5)
     msgpack (1.8.0)
     net-http-persistent (4.0.8)
@@ -511,7 +511,7 @@ GEM
     ruby2_keywords (0.0.5)
     rubyzip (3.2.2)
     securerandom (0.4.1)
-    selenium-webdriver (4.38.0)
+    selenium-webdriver (4.39.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -577,8 +577,7 @@ GEM
       unicode-emoji (~> 4.1)
     unicode-emoji (4.1.0)
     uri (1.1.1)
-    vcr (6.3.1)
-      base64
+    vcr (6.4.0)
     web-console (4.2.1)
       actionview (>= 6.0.0)
       activemodel (>= 6.0.0)

From 5e099c4c0647342d66df6f2adb961088811be115 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Tue, 13 Jan 2026 13:12:22 +0100
Subject: [PATCH 20/22] Delete pins belonging to cards in a board with revoked
 access

As part of cleaning up inaccessible data in the board after revoking
access.
---
 app/models/board/accessible.rb |  5 +++++
 test/models/access_test.rb     | 23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/app/models/board/accessible.rb b/app/models/board/accessible.rb
index 2f668ae4f..e5b86dbe1 100644
--- a/app/models/board/accessible.rb
+++ b/app/models/board/accessible.rb
@@ -46,6 +46,7 @@ module Board::Accessible
     mentions_for_user(user).destroy_all
     notifications_for_user(user).destroy_all
     watches_for(user).destroy_all
+    pins_for(user).destroy_all
   end
 
   def watchers
@@ -99,4 +100,8 @@ module Board::Accessible
     def watches_for(user)
       Watch.where(card: cards, user: user)
     end
+
+    def pins_for(user)
+      Pin.where(card: cards, user: user)
+    end
 end
diff --git a/test/models/access_test.rb b/test/models/access_test.rb
index 10787e5d3..b4580420d 100644
--- a/test/models/access_test.rb
+++ b/test/models/access_test.rb
@@ -80,4 +80,27 @@ class AccessTest < ActiveSupport::TestCase
 
     assert_not card.watched_by?(kevin)
   end
+
+  test "pins are destroyed when access is lost" do
+    kevin = users(:kevin)
+    board = boards(:writebook)
+    card = cards(:logo) # Kevin has pinned this card
+
+    other_board = boards(:miltons_wish_list)
+    other_card = cards(:radio)
+    other_board.accesses.grant_to(kevin)
+    other_card.pin_by(kevin)
+
+    assert card.pinned_by?(kevin)
+    assert other_card.pinned_by?(kevin)
+
+    kevin_access = accesses(:writebook_kevin)
+
+    perform_enqueued_jobs only: Board::CleanInaccessibleDataJob do
+      kevin_access.destroy
+    end
+
+    assert_not card.pinned_by?(kevin)
+    assert other_card.pinned_by?(kevin), "Pin on other board should not be destroyed"
+  end
 end

From fe57d9d01397596275a1160e9d22ba107cfc9b43 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Tue, 13 Jan 2026 11:55:01 -0600
Subject: [PATCH 21/22] Prevent comment content from overlapping with reaction
 button

---
 app/assets/stylesheets/comments.css | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/app/assets/stylesheets/comments.css b/app/assets/stylesheets/comments.css
index 8fef15ebb..006cbb985 100644
--- a/app/assets/stylesheets/comments.css
+++ b/app/assets/stylesheets/comments.css
@@ -109,6 +109,13 @@
     &:not:has(lexxy-editor) {
       padding-inline-end: var(--reaction-size);
     }
+
+    /* Add an empty space so the last line of text doesn't overlap with the reaction button */
+    .action-text-content > p:last-child::after {
+      content: "";
+      display: inline-block;
+      inline-size: var(--reaction-size);
+    }
   }
 
   .comment__content {

From c8059dea9042b98484a643c19f69af605b4195d5 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Tue, 13 Jan 2026 16:15:33 -0600
Subject: [PATCH 22/22] Disable card column buttons when active

---
 app/assets/stylesheets/card-columns.css | 1 +
 app/helpers/columns_helper.rb           | 1 +
 app/views/cards/columns/edit.html.erb   | 5 ++++-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/app/assets/stylesheets/card-columns.css b/app/assets/stylesheets/card-columns.css
index 4edb06c64..2c0c67ef9 100644
--- a/app/assets/stylesheets/card-columns.css
+++ b/app/assets/stylesheets/card-columns.css
@@ -849,6 +849,7 @@
     --btn-background: var(--card-color);
 
     color: var(--color-ink-inverted);
+    opacity: 1 !important;
 
     @media (hover: hover) {
       &:hover {
diff --git a/app/helpers/columns_helper.rb b/app/helpers/columns_helper.rb
index a92fb2824..b3e98b30e 100644
--- a/app/helpers/columns_helper.rb
+++ b/app/helpers/columns_helper.rb
@@ -5,6 +5,7 @@ module ColumnsHelper
       card_triage_path(card, column_id: column),
       method: :post,
       class: [ "card__column-name btn", { "card__column-name--current": column == card.column && card.open? } ],
+      disabled: column == card.column,
       style: "--column-color: #{column.color}",
       form_class: "flex gap-half",
       data: { turbo_frame: "_top", scroll_to_target: column == card.column && card.open? ? "target" : nil }
diff --git a/app/views/cards/columns/edit.html.erb b/app/views/cards/columns/edit.html.erb
index 586fac20f..162bfbbeb 100644
--- a/app/views/cards/columns/edit.html.erb
+++ b/app/views/cards/columns/edit.html.erb
@@ -5,6 +5,7 @@
     <%= button_to "Not now", card_not_now_path(@card),
         class: [ "card__column-name btn", { "card__column-name--current": @card.postponed? } ],
         style: "--column-color: var(--color-card-complete)",
+        disabled: @card.postponed?,
         role: "radio",
         aria: { checked: @card.postponed? },
         data: { scroll_to_target: @card.postponed? ? "target" : nil },
@@ -12,7 +13,8 @@
 
     <%= button_to "Maybe?", card_triage_path(@card), method: :delete,
         class: [ "card__column-name card__column-name--stream btn", { "card__column-name--current": @card.awaiting_triage? } ],
-          style: "--column-color: var(--color-card-default)",
+        style: "--column-color: var(--color-card-default)",
+        disabled: @card.awaiting_triage?,
         role: "radio",
         aria: { checked: @card.awaiting_triage? },
         data: { scroll_to_target: @card.awaiting_triage? ? "target" : nil },
@@ -25,6 +27,7 @@
     <%= button_to "Done", card_closure_path(@card),
         class: [ "card__column-name btn", { "card__column-name--current": @card.closed? } ],
         style: "--column-color: var(--color-card-complete)",
+        disabled: @card.closed?,
         role: "radio",
         aria: { checked: @card.closed? },
         data: { scroll_to_target: @card.closed? ? "target" : nil },