v3.5.3

What's Changed

Security

• Fix npm audit advisories via overrides and bump to v3.5.3 by @linyows in #219
  • Pin uuid to ^14.0.0 to resolve GHSA-w5hq-g745-h8pq (mermaid still depends on uuid@^11)
  • Pin postcss to ^8.5.10 in next-based projects (website/, examples/nextjs-pagerouter, examples/nextjs-approuter) to resolve GHSA-qx2v-qp2m-jg93 (next pins postcss@8.4.31 in its CSS pipeline)
  • rotion does not bundle its dependencies, so this override only hardens the repo's own audit. Consumers of rotion still rely on the upstream mermaid fix because npm overrides are not transitive

Full Changelog: v3.5.2...v3.5.3

v3.5.2

What's Changed

Bug Fixes

• Fix Cannot read properties of undefined (reading 'getBBox') and intermittent hydration failures in mermaid code blocks on Next.js static-export sites by @linyows in #218
  • Disable mermaid's auto-render with mermaid.startOnLoad = false so the library no longer mutates the DOM (and inserts its temporary <div id=\"dmermaid-...\"> workspace) before React hydration runs
  • Switch from mermaid.run() to mermaid.render(id, source) and inject the returned SVG string via useState + dangerouslySetInnerHTML, keeping the rendered DOM under React's control
  • Capture the original diagram source once into sourceRef so re-runs (Strict Mode, HMR, language change) do not re-parse an already-replaced node
  • Skip mermaid.render when mermaidSvg is already populated, removing the race that produced duplicate d{id} workspace divs and Failed to execute 'removeChild' on 'Node' errors
  • Use distinct keys on the source vs rendered <pre> so React unmount → mount instead of reconciling differing children
  • Pin securityLevel: 'strict' explicitly in mermaid.initialize (matches mermaid v11's default but documents the XSS posture for diagram source coming from Notion)

Full Changelog: v3.5.1...v3.5.2

v3.5.1

What's Changed

Bug Fixes

• Fix unhandled Uncaught (in promise) in mermaid rendering — mermaid.init() was deprecated and its returned Promise was not awaited, and the async highlight() call from useEffect also dropped its Promise. Switched to mermaid.run({ nodes }) with await + try/catch, and attached .catch() on the useEffect call site so failures are logged instead of becoming unhandled rejections by @linyows in #217
• Fix Storybook Syntax error in text for the Mermaid code block — mermaid.run reads each node's innerHTML (not textContent) as the diagram source, so passing <pre> made it try to parse the wrapping <code> tags. The <code> element is now passed instead, and codeRef is typed as HTMLElement (was the mismatched HTMLPreElement) by @linyows in #217

Internal

• Enable biome nursery/noFloatingPromises rule on src/ui/components so unawaited Promises (forgotten await, dropped Promises in effects) are caught at lint time. Verified the rule flags the original two floating-Promise sites by @linyows in #217
• Exclude website/ and examples/ from the root biome.json's files.includes so type-aware project resolution no longer discovers nested root configs, allowing the sub-project biome configs to remain independent by @linyows in #217

Full Changelog: v3.5.0...v3.5.1

v3.5.0

What's Changed

Features

• Add Calendar database view — a Notion-style monthly calendar for databases with a date property. Renders events in a 7-column grid with weekday/header navigation (prev / today / next), weekStart ('sunday' | 'monday'), locale, and initialDate options. Supports the same href / link / query API as Gallery / Table / List. by @linyows in #215

  import { Calendar } from 'rotion/ui'
  
  <Calendar
    db={db}
    date="Date"
    keys={['Name', 'Tags']}
    options={{ initialDate: '2026-04-01', weekStart: 'monday', locale: 'ja-JP' }}
  />

• Multi-day spanning event bars — events with both start and end are drawn as a single continuous bar across cells, with squared-off continuation edges at week boundaries (Notion-style). Per-week slot allocation stacks overlapping events in vertical lanes.

• Localized header and weekday labels — month label and weekday short names use Intl.DateTimeFormat(locale, ...) so any locale (fr-FR, de-DE, etc.) gets native names. Today / Previous month / Next month controls and aria-labels are localized via a small ja/en map.

• Weekend cell tinting — Saturday/Sunday cells are tinted via new --rotion-calendar-weekend-bg / --rotion-dark-calendar-weekend-bg tokens (#f9f8f7 / #202020).

Internal

• New components under src/ui/components/Calendar/: Calendar, CalendarHeader, CalendarWeek, CalendarCell, CalendarEvent, plus a small shared lib.ts for the date-key helper.
• One-pass event parsing: pages are parsed and sorted once per db.results change, then placed per week, instead of re-scanning all events for every week.
• Storybook stories include ThisMonthMultiDaySpans (and a linked variant) that mutate the fixture so the spanning layout is visible in the current month.

Full Changelog: v3.4.2...v3.5.0

v3.4.2

What's Changed

Bug Fixes

• Fix saveImage/saveFile deadlock on remote stalls — the previous code (res.pipe(writeStream); await res.end; await new Promise(finish/error)) hung forever after req.setTimeout aborted the request: res was destroyed without emitting end, and the writeStream Promise never resolved. Because saveImage is wrapped in withFileLock, the lock was never released and every other worker waiting on the same key (e.g. the database-... lock around FetchDatabase) deadlocked. Replaced with stream.pipeline so source-side errors and aborts propagate and clean up both ends. Also best-effort unlink partial files on failure to avoid serving corrupted cached downloads on the next run. by @linyows in #214
• Add operationTimeout option to withFileLock (default 10 min) — defense-in-depth: even if another inner operation hangs in the future, the lock is released and waiters get an error instead of stalling indefinitely. by @linyows in #214
• Fix iconRegexps over-capturing > and trailing / — [^"]+ URL captures included > (saving files like html-icon-...png>, which then crashed sharp), and a follow-up to [^"\s>]+ greedy still pulled the / of self-closing tags into the URL. Switched URL captures to lazy [^"\s>]+? with a trailing lookahead (?=["\s>]|\/>) so the URL boundary is explicit. [^"]+ is preserved for non-URL captures (e.g. sizes="..."). by @linyows in #214
• saveImage early-returns for .webp source URLs — alongside .ico/.svg. When the source is already webp, replaceExt(urlPath, '.webp') makes webpPath === filePath, so re-encoding via sharp(filePath).webp().toFile(webpPath) errored with Cannot use same file for input and output and lost width/height. by @linyows in #214

Internal

• Tighter HttpGetResponse typing (extends IncomingMessage), drop as unknown as Readable casts.
• 9 new regression tests covering each of the four fixes (138/138 pass).

Full Changelog: v3.4.1...v3.4.2

v3.4.1

What's Changed

Bug Fixes

• Fix iconRegexps quote leak that produced filenames with a stray trailing " (e.g. html-icon-...ico"), breaking artifact uploads on CI by @linyows in #212
• Bump default withFileLock timeout from 30s to 10 minutes — long-running operations like FetchDatabase (Notion API + many sequential image downloads inside one critical section) easily exceeded 30s under multi-worker contention by @linyows in #212

Testing

• Add icon regex regression tests for quoted href attributes by @linyows in #212

Full Changelog: v3.4.0...v3.4.1

v3.4.0

What's Changed

Bug Fixes

• Fix SIGBUS errors during Next.js parallel builds by @linyows in #201
• Fix writeCache tmp filename collision and remove unused imports by @linyows
• Remove circular dependency between files.ts and mutex.ts by @linyows
• Fix retry condition comparing wrong variable and rename typo by @linyows

Security

• Fix security vulnerabilities (lodash-es, dompurify, next) via npm audit fix by @linyows in #204 #205

Testing

• Add concurrency safety tests for saveImage, saveFile, and writeCache by @linyows
• Fix flaky variables.test.ts by using unique module cache keys by @linyows

Dependencies

• Bump dompurify to 3.4.0, react to 19.2.5, next to 16.2.3, vite to 8.0.8, lodash to 4.18.1
• Bump storybook packages, @types/node, mermaid, defu, and other minor updates

Full Changelog: v3.3.0...v3.4.0

v3.3.0

What's Changed

• chore(deps): update @notionhq/client to 5.16.0 by @linyows in #179
• chore(deps): update @biomejs/biome to 2.4.10 by @linyows in #180
• fix: support Notion API icon type for page/database/callout icons by @linyows in #181

Full Changelog: v3.2.0...v3.3.0

v3.2.0

What's Changed

• chore(deps): bump svgo from 4.0.0 to 4.0.1 in /examples/astro by @dependabot[bot] in #158
• chore(deps-dev): bump svgo from 4.0.0 to 4.0.1 by @dependabot[bot] in #157
• chore(deps): bump dompurify from 3.3.1 to 3.3.2 by @dependabot[bot] in #160
• chore(deps): bump dompurify from 3.3.1 to 3.3.2 in /examples/astro by @dependabot[bot] in #159
• chore(deps-dev): bump @storybook/addon-links from 10.2.14 to 10.2.16 by @dependabot[bot] in #161
• chore(deps-dev): bump @types/node from 25.3.3 to 25.3.5 by @dependabot[bot] in #162
• chore(deps-dev): bump storybook from 10.2.10 to 10.2.16 by @dependabot[bot] in #163
• chore(deps-dev): bump cssnano from 7.1.2 to 7.1.3 by @dependabot[bot] in #164
• chore(deps-dev): bump @storybook/react-vite from 10.2.10 to 10.2.16 by @dependabot[bot] in #165
• chore(deps): bump dompurify from 3.3.1 to 3.3.2 in /examples/nextjs-pagerouter by @dependabot[bot] in #167
• chore(deps): bump devalue from 5.6.3 to 5.6.4 in /examples/astro by @dependabot[bot] in #168
• chore(deps): bump next from 16.1.6 to 16.1.7 in /website by @dependabot[bot] in #169
• chore(deps): bump next from 16.1.6 to 16.1.7 in /examples/nextjs-pagerouter by @dependabot[bot] in #170
• chore(deps): bump next from 16.1.6 to 16.1.7 in /examples/nextjs-approuter by @dependabot[bot] in #171
• chore(deps): bump h3 from 1.15.5 to 1.15.10 in /examples/astro by @dependabot[bot] in #172
• chore(deps): bump smol-toml from 1.6.0 to 1.6.1 in /examples/astro by @dependabot[bot] in #173
• chore(deps): bump picomatch in /examples/astro by @dependabot[bot] in #174
• chore(deps): bump picomatch by @dependabot[bot] in #175
• chore(deps): bump astro from 5.17.3 to 5.18.1 in /examples/astro by @dependabot[bot] in #176
• chore(deps): bump dompurify from 3.2.6 to 3.3.3 in /website by @dependabot[bot] in #177
• chore(deps): bump dompurify from 3.3.1 to 3.3.3 in /examples/nextjs-approuter by @dependabot[bot] in #178

Full Changelog: v3.1.1...v3.2.0

v3.1.1

What's Changed

• chore(deps): bump devalue from 5.6.2 to 5.6.3 in /examples/astro by @dependabot[bot] in #147
• chore(deps): bump katex from 0.16.28 to 0.16.32 by @dependabot[bot] in #151
• chore(deps-dev): bump @types/node from 25.3.0 to 25.3.3 by @dependabot[bot] in #154
• chore(deps-dev): bump @storybook/addon-onboarding from 10.2.10 to 10.2.14 by @dependabot[bot] in #155
• chore(deps-dev): bump @storybook/addon-links from 10.2.10 to 10.2.14 by @dependabot[bot] in #156
• chore(deps-dev): bump minimatch from 10.2.2 to 10.2.4 by @dependabot[bot] in #152
• chore(deps): bump @notionhq/client from 5.9.0 to 5.11.0 by @dependabot[bot] in #153

Full Changelog: v3.1.0...v3.1.1