RPAForge v0.4.0

What's Changed

• feat(studio): migrate canvas from React Flow 11 to XYFlow 12 by @chelslava in #532
• feat(studio): add ELK auto-layout for canvas (E1 phase 5.1) by @chelslava in #534
• feat(studio): add Mermaid flowchart import for canvas (E1 phase 5.2) by @chelslava in #536
• [#513] AI-генерация диаграмм (Фаза 5.3) by @chelslava in #538
• [#537] Фиксы AI-генерации после живого теста + activityParams/outputVariable by @chelslava in #541
• chore(deps-dev): bump @types/node from 25.9.4 to 26.0.0 in /packages/studio by @dependabot[bot] in #539

Full Changelog: v0.3.9...v0.4.0

RPAForge v0.3.9

What's Changed

• feat(studio): improve the Python code editor UX by @chelslava in #488
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /packages/studio by @dependabot[bot] in #507
• chore(deps-dev): bump vite-plugin-electron from 0.29.1 to 1.0.4 in /packages/studio by @dependabot[bot] in #506
• chore(deps-dev): bump vite-plugin-electron-renderer from 0.14.7 to 1.0.0 in /packages/studio by @dependabot[bot] in #508
• [#516] Extract RPA domain into framework-independent packages by @chelslava in #525
• feat(#516): Complete domain extraction - codegen tests, studio imports, verification by @chelslava in #526
• [#516] Domain extraction phase 2: @rpaforge/activities, @rpaforge/diagram-core, @rpaforge/validation by @chelslava in #530

Full Changelog: v0.3.8...v0.3.9

RPAForge v0.3.8

What's Changed

• fix(studio): allow project creation in new folders (0.3.8) by @chelslava in #487

Full Changelog: v0.3.7...v0.3.8

RPAForge v0.3.7

What's Changed

• fix(studio): remove stale electron/*.js shadowing .ts (the real bridge bug) — v0.3.7 by @chelslava in #486

Full Changelog: v0.3.6...v0.3.7

RPAForge v0.3.6

What's Changed

• ci(release): PyPI Trusted Publishing + fail loudly + decouple from release by @chelslava in #484
• fix(studio): bridge crashes from read-only install dir (v0.3.6) by @chelslava in #485

Full Changelog: v0.3.5...v0.3.6

RPAForge v0.3.5

What's Changed

• feat(studio): bundle Python engine into installer (PyInstaller) by @chelslava in #483

Full Changelog: v0.3.4...v0.3.5

RPAForge v0.3.4

What's Changed

• feat(studio): объединить вкладки Дизайнер и Отладчик с режимом отладки by @chelslava in #305
• feat(studio): добавить ID запуска к логам консоли (#296) by @chelslava in #306
• Fix/pr 286 close window opener leak by @OddSteak in #321
• test: add loading component coverage by @mturac in #320
• chore(deps-dev): bump vitest from 3.2.4 to 4.1.6 in /packages/studio by @dependabot[bot] in #319
• docs(readme): fix grammar and capitalization issues by @KaniskaRaj in #314
• chore(deps-dev): bump jsdom from 26.1.0 to 29.1.1 in /packages/studio by @dependabot[bot] in #318
• chore(deps-dev): bump the npm-deps group across 1 directory with 6 updates by @dependabot[bot] in #315
• chore(deps): bump i18next from 24.2.3 to 26.2.0 in /packages/studio by @dependabot[bot] in #316
• chore(deps-dev): bump vite from 6.4.2 to 8.0.13 in /packages/studio by @dependabot[bot] in #317
• feat(studio): добавить кнопку тоггла миникарты в тулбар дизайнера (#295) by @chelslava in #339
• a11y: add ARIA attributes to ConsoleOutput (#291) by @chelslava in #338
• ux: require explicit window selection in SelectorBuilder (#290) by @chelslava in #337
• fix(studio): cancel in-flight fetchWindows on unmount (#281) by @chelslava in #336
• ux: preserve activity palette scroll position across debug sessions (#310) by @chelslava in #332
• stability: apply deduplication window in addLogs() (#308) by @chelslava in #322
• security: validate window handle access in _inspect_by_handle (#287) by @chelslava in #323
• fix(studio): fix StatusBar tips rotation using currentTipIndex (#284) by @chelslava in #324
• stability: consolidate beforeunload handlers into useAutoSave (#311) by @chelslava in #325
• stability: add asyncio timeout to long-running bridge handlers (#309) by @chelslava in #327
• perf(studio): skip autosave serialization on unchanged diagram (#297) by @chelslava in #329
• ux: show loading overlay when opening project folder (#312) by @chelslava in #331
• ux: fix false-positive beforeunload dialog when autosave is queued (#289) by @chelslava in #326
• ux: add confirmation dialog before removing sub-diagram (#288) by @chelslava in #335
• perf(studio): memoize MiniMap nodeColor with useCallback (#298) by @chelslava in #334
• perf(studio): debounce ConsoleOutput search input (#283) by @chelslava in #333
• ui: show platform-correct log path in ConsoleOutput (#294) by @chelslava in #330
• docs: add developer tasks issue template for issue #340 by @chelslava in #342
• ux: implement drag-and-drop reordering for activities (#224) by @chelslava in #344
• perf(studio): virtualize ConsoleOutput log list with react-virtuoso (#282) by @chelslava in #345
• a11y: add focus trap and Escape key handling to QuickAdd and SelectorSpy (#292) by @chelslava in #347
• ux: add context-aware activity suggestions to palette (#223) by @chelslava in #346
• ux: add undo/redo for variable operations (#225) by @chelslava in #343
• i18n: add errors locale keys for diagram Start node validation (#293) by @chelslava in #348
• feat(palette): add hover documentation tooltip for activities (#228) by @chelslava in #349
• fix: security fixes for SQL injection, atomic writes, and dependency hardening by @chelslava in #372
• tests: add security regression tests for Database and Credentials libraries by @chelslava in #373
• style: fix ruff formatting issues by @chelslava in #374
• feat: add subprocess pool size limits with validation (#369) by @chelslava in #375
• stability: implement context manager for Credentials library (#367) by @chelslava in #376
• docs: create troubleshooting guide with common issues (#366) by @chelslava in #377
• ui: add consistent empty states across all panels (#368) by @chelslava in #378
• feat: German language support + keyboard accessibility by @chelslava in #379
• feat: add template marketplace with categories and UI by @chelslava in #380
• fix(ci): handle non-JSON npm audit output by @chelslava in #381
• docs(i18n): translate docs/ to Russian (#371) by @chelslava in #383
• docs(libraries): add API reference for all 14 libraries (#350) by @chelslava in #385
• test(libraries): add security unit tests (#356) by @chelslava in #386
• docs(dev-guide): add architecture documentation (#357) by @chelslava in #384
• feat(studio): add interactive onboarding tour (#359) by @chelslava in #387
• refactor(core): split bridge/handlers.py into domain modules (#360) by @chelslava in #382
• fix(ci): resolve TypeScript and test failures on main by @chelslava in #388
• feat(studio): UI enhancements — design system, dark mode, search, shortcuts, tooltips by @chelslava in #389
• feat: UX/UI improvements, DataFrame Viewer, activity visuals, Python tests by @chelslava in #401
• fix: batch fixes — security, stability, a11y, and bug fixes (#390, #391, #392, #394, #395, #396, #398, #399, #400) by @chelslava in #402
• chore(deps-dev): bump @sveltejs/vite-plugin-svelte from 5.1.1 to 7.1.2 in /packages/studio by @dependabot[bot] in #439
• chore(deps-dev): bump @vitest/ui from 3.2.4 to 4.1.7 in /packages/studio by @dependabot[bot] in #438
• chore(deps): bump react-i18next from 15.7.4 to 17.0.8 in /packages/studio by @dependabot[bot] in #437
• chore(deps-dev): bump @vitejs/plugin-react from 4.7.0 to 6.0.2 in /packages/studio by @dependabot[bot] in #436
• chore(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1 in /packages/studio by @dependabot[bot] in #435
• Add theme-aware Studio dark mode by @culpen90 in #434
• fix(studio): resolve all ESLint errors and warnings (#440) by @chelslava in #441
• fix: resolve GitHub issues #421, #428, #430, #431 by @chelslava in #443
• fix: resolve GitHub issues #423, #415, #416 by @chelslava in #444
• fix: critical bugs in lifecycle, subprocess_executor, checkpoint, and resource cleanup by @chelslava in #445
• fix: thread safety, Credentials security, and WebUI resource leaks by @chelslava in #446
• fix: security and state bugs — codegen injection, DesktopUI cmd injection, DB warning, store duplication (#403, #405, #406, #413) by @chelslava in #447
• fix: output preload as .cjs to fix ESM SyntaxError in Electron sandbox (#442) by @chelslava in #448
• fix: resolve 6 stability, security and UX issues by @chelslava in #449
• fix(ui): improve loading and empty states in components (#418) by @chelslava in #450
• feat(i18n): add Spanish language support with dropdown selector by @chelslava in #451
• fix(database): resolve _ variable conflict with i18n by @chelslava in #452
• refactor!: remove robotframework dependency by @chelslava in #453
• chore(deps-dev): update black requirement from >=24.0 to >=26.5.1 by @dependabot[bot] in #460
• chore(deps-dev): bump electron-builder from 25.1.8 to 26.8.1 in /packages/studio by @dependabot[bot] in #459
• chore: combine dependabot dependency updates with react-joyride v3 fix by @chelslava in https://github.com/chelslav...

RPAForge v0.3.3

What's Changed

• security: add string sanitization and variable name validation by @chelslava in #244
• feat(ci): add dependency vulnerability scanning workflow by @chelslava in #245
• feat(security): implement input length limits by @chelslava in #246
• feat(studio): add bridge health monitoring to status bar by @chelslava in #247
• feat(engine): add state recovery checkpoint system by @chelslava in #248
• feat(engine): add process validation before execution by @chelslava in #249
• feat(core): implement retry circuit breaker pattern by @chelslava in #250
• perf(core): add LRU cache for AST expression parsing (fixes #209) by @chelslava in #252
• perf(core): use persistent pool for subprocess executor (fixes #208) by @chelslava in #253
• perf(core): add LRU cache and incremental codegen (fixes #206) by @chelslava in #254
• perf(studio): optimize React Flow canvas rendering (fixes #207) by @chelslava in #255
• style: fix formatting in test_codegen.py by @chelslava in #256
• perf(studio): optimize IndexedDB autosave with debouncing and RAF by @chelslava in #257
• feat(studio): improve error messaging with user-friendly cards by @chelslava in #258
• test(libraries): add comprehensive timeout handling tests by @chelslava in #259
• docs(ci): annotate all GitHub Actions workflow files with step-level comments by @SanskaarUndale21 in #261
• docs(studio): expand package README by @aqilaziz in #264
• fix(studio): reject Python keyword variable names by @chelslava in #267
• feat: Interactive Onboarding + UI Improvements by @chelslava in #268
• fix(tests): repair i18n mock after PR #268 by @chelslava in #269
• fix(tests): mock i18next HTTP backend to prevent ECONNREFUSED in CI by @chelslava in #270
• fix(i18n): fix missing translation keys and remove unused locale bundle by @chelslava in #271
• feat(studio): desktop Selector Builder window picker + inspect fix by @chelslava in #272
• fix(codeql): resolve all open CodeQL scanning alerts by @chelslava in #274
• chore(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 in /packages/studio by @dependabot[bot] in #277
• chore(deps): bump mermaid from 11.14.0 to 11.15.0 in /packages/studio by @dependabot[bot] in #275
• chore(deps-dev): bump @tootallnate/once from 2.0.0 to 2.0.1 in /packages/studio by @dependabot[bot] in #276
• chore(deps): bump uuid from 11.1.0 to 14.0.0 in /packages/studio by @dependabot[bot] in #278
• security: resolve ruff executable path via shutil.which() by @MD-Mushfiqur123 in #300
• fix(bridge): serialize _handle_run_diagram state mutations under lifecycle lock by @chelslava in #301
• fix(deps): add npm overrides to resolve 14 Dependabot security alerts by @chelslava in #302

New Contributors

• @SanskaarUndale21 made their first contribution in #261
• @aqilaziz made their first contribution in #264
• @MD-Mushfiqur123 made their first contribution in #300

Full Changelog: v0.3.2...v0.3.3

v0.3.2 — RPA-style block redesign & auto-routing

What's new

Block redesign

• Inputs on top, outputs on bottom — vertical RPA flow convention across all blocks
• Start/End — pill shape with colored glow shadow
• IfBlock — hexagonal clip-path shape with True/False port labels
• WhileBlock — violet accent (↻ Loop badge)
• ForEachBlock — cyan accent (⟳ For Each badge)
• ActivityBlock — colored library badges, output result indicator
• ActivityPalette — border-left accents, pill count badges, improved hover
• Dynamic width — Switch/Parallel blocks expand automatically when many outputs would overlap

Auto-routing edges

• AutoRouteEdge — orthogonal routing via getSmoothStepPath (borderRadius: 12, offset: 40)
• ConnectionLine — animated indigo dashed line while dragging connections
• Default edge type changed to auto-route

Magnetic ports

• connectionRadius={40} — snaps connections within 40px of a port
• Compatible handles glow and scale up during active connection drag

RPAForge v0.3.1

RPAForge v0.3.1 - Security Patch Release

Critical Security Fixes

This release addresses critical security vulnerabilities identified in issue #180.

1. SQL Injection Prevention (Database Library)

• Added table name validation with regex pattern ^[a-zA-Z_][a-zA-Z0-9_]*$
• Applied to: insert_rows, update_rows, delete_rows, count_rows, bulk_insert_rows

2. Unsafe getattr Prevention (Executor)

• Added library name validation with pattern ^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)*$
• Added activity name validation with pattern ^[a-zA-Z_][a-zA-Z0-9 _]*$
• Validation called before any getattr operations

3. Path Traversal Prevention (File Library)

• Added symlink validation to prevent path escapes via symlinks
• Raises FileAccessError if path resolves outside expected location

4. Null Pointer Prevention (Electron)

• Added explicit null check and isDestroyed() verification for dialog operations
• Throws descriptive error instead of silent crash

5. File System Race Condition (CodeQL #79)

• Changed log writing from path-based appendFile to file descriptor operations
• Prevents TOCTOU (time-of-check to time-of-use) race condition

Bug Fixes

• Fixed preload script CommonJS format for Electron
• Replaced window.prompt() with modal InputDialog component
• Fixed variable filtering by project in PropertyPanel and VariablePanel
• Fixed Ruff output parsing for code validation
• Fixed pnpm workspace configuration
• Resolved TypeScript errors in tests and components
• Improved IndexedDB error handling and logging
• Fixed Python code validation with inline error highlighting

CI Improvements

• Switched from npm/pip to pnpm/uv for faster installs
• Added Python 3.13 for Black formatting
• Added Node.js 24 for TypeScript analysis
• Fixed test-ui job with proper workspace setup

Dependencies

• Updated various dev dependencies via Dependabot
• Python 3.10, 3.11, 3.12 support
• Node.js 24+ for building

---

Full changelog: v0.3.0...v0.3.1

What's Changed

• chore(deps-dev): bump vitest from 3.2.4 to 4.1.5 in /packages/studio by @dependabot[bot] in #78
• chore(deps-dev): bump @types/chokidar from 1.7.5 to 2.1.7 in /packages/studio by @dependabot[bot] in #77
• chore(deps-dev): update pytest-xdist requirement from >=3.0 to >=3.8.0 by @dependabot[bot] in #76
• chore(deps-dev): update build requirement from >=1.0 to >=1.4.4 by @dependabot[bot] in #75
• feat: implement comprehensive IPC validation with JSON Schema (v3) by @chelslava in #91
• test: integration tests for bridge lifecycle, cancellation, and debugger (#66, #67, #68) by @chelslava in #92
• feat: execution engine abstraction layer for DI and testability (#87) by @chelslava in #94
• fix: address critical security vulnerabilities (#180) by @chelslava in #184
• fix: resolve file-system-race condition (CodeQL #79) by @chelslava in #185

Full Changelog: v0.3.0...v0.3.1