* main:
Consolidate footer text into a shared partial
Tweak comment history button on mobile
Transparent lexxy toolbar when inside a golden card
Add rel noopener to external links
* main:
Fix that caching should be disabled in dev by default. References 3cf841d463.
Revert "Add CJK (Chinese, Japanese, Korean) search support"
Account for new button sizes on mobile
Bump filter z-index when filters are open
Use a dedicated resource for showing cards in draft mode
Refactor popup.css styles for focus state
Add Segoe UI Variable Fizzy font face configuration comments
Update @layer name to `base` in font-face definition for "Segoe UI Variable Fizzy"
Fix font-face `src` reference for "Segoe UI Variable Fizzy" to correct local font lookup
Adjust font-weight range for "Segoe UI Variable Fizzy" to include 800-900
Update --font-sans and related font-face references to "Segoe UI Variable Fizzy" for consistency
Add "Segoe UI fizzy" to --font-sans and define custom font faces
Update --font-sans to include "Segoe UI Variable" for improved text rendering
Add margin to details inside popup styles
* main: (65 commits)
Repair scope for card styles within the columns view
Add missing list to cards page
Account for simpler public views
Fix public layout
Pull board-tools outside of the list for mobile
saas: move log_level setting into an environment variable
Restore log level configurability in production environment
Remove engagements
Use notch class so Save button is positioned correctly
Go back to board after clearing filters
Revert "Use existing no_filtering_url to direct back to the board when clearing filters"
Use existing no_filtering_url to direct back to the board when clearing filters
Ensure filters sit on top of cards
Fix public boards
Fix card grid layout
Fix Chinese/Japanese characters missing from printed PDFs on macOS
Add SQLite FTS5 support for CJK search
Add CJK (Chinese, Japanese, Korean) search support
Fix scrolling on mobile
Remember expanded state on navigation
...
* main: (63 commits)
Ignore hotkeys with modifiers
Fix 1Password account ID (was user UUID) (#2278)
Switch 1Password account to 37signals.1password.com (#2276)
Remove CSS testing comments
Max card count equals geared pagination size
Block IPv4-compatible IPv6 addresses in SSRF protection (#2273)
Only enable transitions on user interaction
Don't update counter if value hasn't changed
Add padding to upgrade message on larger screens
Add test coverage for autolinking multiple URLs
Add "noopener" to autolinks' rel attribute
Avoid string manipulation when autolinking.
Only bump z-index when nav is open
Move nav and related elements above footer
Delete Dockerfile.dev
fix: use the right gh-cli arch package (#2232)
Bump actions/attest-build-provenance from 3.0.0 to 3.1.0 (#2257)
Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#2256)
Consider user avatars always public
Implement authorization for Active Storage endpoints
...
* main: (107 commits)
Document the new sign in method
Replace handle_ naming
Use same constant for fake magic links
Replace FakeMagicLink with a temporary object
Tidy up session_token
Clean up interfaces
Split tests by controller or responsibility
Simplify auth logic
Fix due to unit test when creating with invalid emails
Restore sessions_controller test on creating invalid email address
Move magic link api tests to their own files
Rename test to clarify what they're about
Cleanup session creation
Update to always return a pending auth token for JSON responses.
Update API test for cross code
Change test expectation on single tenant mode account creation
Add unit tests for the new endpoints
Pass a server token when creating a magic link via API
Simplify code a bit
Simplify session create logic for both html and json
...
Remove data-action from the sanitizer allowlist to disallow injection
of potentially malicious Stimulus actions in user-provided
content. The lightbox controller now uses imageTarget callbacks to
handle clicks on image links.
Also add the file name as a caption in the light box, and fix the
caption color for dark mode visibility.
Adds `closed` field to card JSON response, allowing API consumers
to detect closed status without parsing the status enum or making
additional API calls.
Adrien Maston