[Unreleased] gains the entry for #402

[nyblnet]

Release-blocking. #402 landed after the changelog reconstruction in #400, so [Unreleased] described twelve changes and would have shipped thirteen. One file, 16 insertions, no slides/ or kernel/ file touched.

Release notes go inside the signed envelope, and the update channel refuses to re-sign a version. An entry missing at the cut cannot be added afterwards — which is what makes this block rather than follow.

The framing took the most thought

The defect is real and measured: an SVG element's markup <style> applied document-wide, so one diagram's rules reached every other SVG on the page. Chrome probe, both builds — victim SVG rgb(255,0,0) on main, rgb(0,0,0) after, with the styled element red in both, so scoping cost an SVG none of its own rules.

But it is an isolation failure, not a break-in. sanitizeSvgCss already refused @-rules and url(), so a drawing's stylesheet could never load or execute anything, and still cannot. Writing it as a containment breach would be the more dramatic entry and the false one. Someone deciding whether to update deserves the true shape of what they were exposed to, so the entry says it outright:

Nothing could escape further than that: a drawing's stylesheet has never been able to load or run anything, and still cannot. This was one diagram reaching another's appearance, not reaching out of the document.

Written from the user's side

Lead paragraph is what someone actually saw — a slide with several diagrams looking wrong, and stranger the more it carried — with the mechanism after it, matching the twelve entries above.

The panel-vs-markup detail is kept because it explains why this survived so long: the stylesheet you write in the element panel was already scoped, so the feature looked correct everywhere anyone tested it. Only the path that takes pasted or imported SVG was unscoped.

Verified against main = 7422f4f.

[github-actions]

Build size

main (7422f4f) → docs/changelog-402 (c66b3df)

app	base	PR	change
bento/slides	669.3 KiB	669.3 KiB	0.0 KiB (0.00%)
bento/spaces	267.6 KiB	267.6 KiB	0.0 KiB (0.00%)
bento/dash	161.3 KiB	161.3 KiB	0.0 KiB (0.00%)

Updated: 2026-08-30T19:13:32Z