v1.14.0

Released: 2026-11-05

Mobile usability and boundary-hardening release, with contributor improvements from @benjamonnguyen and @rafaself.

Added

Mobile workspace navigation and actions (#271): core Explorer actions now have a phone-friendly top navigation bar, document actions stay with the title, destructive actions remain unpinnable, and Format and Undo can be pinned in the overflow menu. Dialogs and prompts are better positioned on small screens, long-press keeps the native text menu, and modal backdrops dismiss consistently.
Mobile find/replace results (#271): phone layouts show matches with surrounding context instead of editor highlights. Rendering is bounded to 100 rows around the active match so large result sets remain responsive.
Keyboard confirmation (#271): destructive confirmation prompts can be accepted with Enter while retaining their existing cancel and focus behavior.

Explorer background menu dismissal (closes #269, #270): clicking outside the empty-area Explorer menu now dismisses it, with corrected browser coverage that clicks beyond the menu boundary.
Mobile accessibility and resize behavior (#271): browser zoom remains available, horizontal overflow is guarded without suppressing pinch gestures, and mobile-only Format/Undo rows correctly return after a desktop-to-mobile resize.
Upload and import validation: images and videos are accepted from detected file content rather than filename or declared MIME type, active-markup polyglots are rejected, validation covers every persistence path, and S3 receives the detected content type. Symlinked image leaves are excluded from picker results.
Filesystem and outbound-request boundaries: AI grammar operations are restricted to visible Markdown notes, URI userinfo is rejected before DNS resolution, backlinks skip symlinks and fail safely, and provider exception messages no longer leak into logs.
Omarchy integration and .fed guidance: theme colors follow Omarchy's current state path with a legacy fallback, launcher mounts are read-only, and documentation no longer describes the credential-bearing .fed file as an ordinary editable note.

Rails 8.1.4.1, rails-html-sanitizer 1.7.2, Nokogiri 1.19.7, Addressable 2.9.2, and their compatible transitive updates resolve the advisories detected by the current Ruby advisory database.

Combined v1.13.0..v1.14.0 state post-audited after both contributor merges; one desktop-to-mobile resize regression was found, fixed, and independently re-audited before release.
Full local CI green: 1,170 Ruby tests and 2,273 JavaScript tests, RuboCop, Brakeman, Bundler Audit, and importmap audit.
Hosted CI green on the exact pre-release application SHA and required again on the release metadata SHA before tagging.