What's Changed

• chore(release): automate desktop release train (#6586)
• docs(sources): reconcile provider and host counts (#6582)
• docs: publish panel implementation count (#6584)
• fix(license): put AGPL title first for detection (#6576) (#6583)
• fix(docs): point Mintlify OpenAPI download at real bundle (#6578)
• fix(license): expose AGPL text to scanners (#6576) (#6579)
• docs(about): update GitHub star count (#6580)
• fix(panels): deliver boot data to panels that mount after the pass (#6567)
• fix(resilience): fail closed on malformed blend inputs (#6570)
• fix(resilience): make whole-index pair gaps CI-visible (#6572)
• fix(resilience): activate financial system exposure safely (#6568)
• fix(resilience): compare acceptance outcomes, not gate config (#6566)
• fix(seeders): seed-bundle-resilience defers every section forever — #6531's budget is below every section's timeout+grace (#6564)
• fix(sentry): admit every app-serving host to the allowUrls ingest gate (#6565)
• fix(csp-filter): suppress the Google Fonts /l/font subsetting endpoint (TR round 7) (#6560)
• fix(sentry): the anonymous trampoline hop is '?' at runtime, not '' (#6554)
• fix(railway): stop recovery approval emails and retry failures (#6551)
• feat(i18n): add Traditional Chinese (zh-TW) locale (#6546)
• feat(i18n): Add Swahili language support (#5406)
• feat(webmcp): expose safe live dashboard controls (#6516)
• fix(sentry-triage): convex OCC conflict herds + Y4 trampoline gate hole (#6547)
• ci: let the acceptance-artifact validator run on the PR that commits one (#6544)
• refactor(markets): one stablecoin classifier instead of three copies (#6541)
• docs(resilience): commit the education post-flip acceptance artifact (#6460) (#6542)
• feat(resilience): ingest USDA food stocks and expose stocks-to-use (#6531)
• fix(resilience): condition the fin-sys integration premium on parent diversity (#6529)
• feat(company-monitoring): seal offline prediction custody (#6534)
• feat(data): mineral production & processing shares (USGS MCS / BGS) (#6527)
• feat: preflight system dependencies instead of failing mid-build (#6387)
• fix(railway): bound reconcile fanout and evidence reads (#6539)
• fix(compose): wire relay shared secret (#6540)
• feat(military): add defense industrial intelligence (#6536)
• feat(markets): correlate news volume with market returns (#6530)
• fix(ops): publish Railway drift as an independent check (#6533)
• fix(resilience): unblock education acceptance capture (#6532)
• fix(auth): restore readable input text in Clerk modal (#6535)
• fix(ops): make the Railway deploy-drift alarm carry signal (#6141) (#6522)
• fix(resilience): activate non-DRS debt imputation (#6526)
• fix(ci): invalidate stale deploy gate statuses (#6525)
• fix(railway): keep protected recovery reachable (#6524)
• fix(docs): repair the Mintlify deploy break and the lint that missed it (#6521)
• fix(sources): require explicit provider retirement (#6514)
• docs(platform): add customer evaluation guide (#6518)
• fix(resilience): stop absence from scoring as strength (#6515)
• fix(ingestion): publish Military-Bases seed metadata (#6471)
• fix(resilience): rebuild healthy education cohort (#6517)
• fix(sources): show readable provider names (#6512)
• fix(ci): recover deploy gate from API failures (#6513)
• fix(sources): publish complete provider catalog (#6509)
• fix(resilience): stop a transient seed-meta read failure from faking a dead producer (#6503)
• ci(e2e): upload Playwright traces when variant-smoke-full fails (#6496) (#6497)
• fix(welcome): stop internal CTAs minting affiliate codes, and guard every path to checkout (#6493) (#6504)
• chore(gitignore): ignore public/sources/ and tie the rule to the build (#6498) (#6506)
• docs(solutions): capture the self-comparing gate failure shape (#6487) (#6502)
• fix(sources): let the attribution drift gate see reference drift (#6487) (#6499)
• docs(openapi): document billing-verification 503 + ForbiddenError.code on gated ops (#5496)
• fix(sentry): filter the round-6 TR package-CDN webfonts (unpkg, jsDelivr) (#6495)
• docs(company-monitoring): remove provider approval claims (#6494)
• test(company-monitoring): add sealed evidence curation gate (#6488)
• docs(usage-errors): make Retry-After authoritative over the backoff schedule (#6485)
• feat(resilience): activate the education dimension (#6460) (#6473)
• docs(sources): domain-segmented data-sources catalog + /sources marketing page (#6491) (#6492)
• fix(energy): let the IEA country keys re-export seededAt, and give the guard test a fixture that can fail (#6489) (#6490)
• fix(feeds): point Tuoi Tre at its canonical host so Feed Validation stops blocking the news-health publish (#6484) (#6486)
• fix(premium): honor the retryable billing-verification 503 on premium RPCs (#6482)
• ops(webmcp): enroll dashboard origins and enforce security gates (#6465)
• fix(ci): let the post-merge monitor survive a blip and name the real cause (#6479) (#6481)
• fix(railway): let the watchdog go red, retry the read path, and stop the gate walk early (#6474) (#6478)
• fix(markets): order the gap-fetch timers so our own cutoff is never the provider's fault (#6468) (#6476)
• fix(convex): rename admission-snapshot so the production push is legal (#6480)
• feat(company-monitoring): classify and admit material impacts (#6470)
• docs(railway): correct three claims that shipped with the pagination fix (#6477)
• docs(resilience): record education probe acceptance and its two read traps (#6472)
• fix(railway): watchdog never paginates — GitHub rewrites next links to the repository-ID path (#6378) (#6469)
• fix(health): register the educationAttainment probe + education pre-flip gates (#6452, #6460) (#6467)
• ops(resilience): register the educationAttainment health probe (#6452) (#6464)
• fix(resilience): financialSystemExposure inverts the ranking — executable calibration gates, then the retune (#6459) (#6463)
• feat(company-monitoring): normalize scoped evidence candidates (#6457)
• fix(sentry): group limiter degradation by failure mode, not by route (#6454) (#6458)
• fix(sidecar): pin IPv6-only RSS fetches (#6456)
• fix(rate-limit): confirm CF edge-proof covers /api/* and warn when it stops (#6435)
• fix(rate-limit): meter the gateway reverse-geocode RPC at 60/min (#6451)
• fix(feeds): drop the dead YC Blog publisher-family label (#6455)
• feat(resilience): add flag-dark education dimension to the Country Resilience Index (#6450)
• fix(feeds): restore server-only sources to dashboard (#6444)
• fix(brief): corroboration gates count publisher families, not feed labels (#6443)
• fix(ui): harden panel font scaling (#6453)
• feat(company-monitoring): ingest verified X posts (#6424)
• fix: require expiring health probe cutovers (#6392)
• feat(ui): add global and per-panel font scaling (#6445)
• fix(ingestion): rebuild GB consumer-price roster around scrapeable retailers (#6358) (#6442)
• feat(mcp): expose story corroboration to agents (#4925 item 3) (#6421)
• feat(company-monitoring): add bounded Exa cohort discovery (#6404)
• fix(alerts): give keyword-spike alerts the sources, headlines and links they already held (#6414) (#6433)
• chore(ci): ignore generated sidecar bundles in edge checks (#5926)
• ops(ci): alarm on failed post-merge production deploys (#6376) (#6406)
• fix(api): rate-limit the three unguarded public proxies (#6234) (#6412)
• fix(session): stop one dropped mint request blacking out anonymous browsing (#6413)
• fix(settings): keep plan verification pending through auth retries (#6423)
• fix(sentry): split Cloudflare edge 5xx from origin 5xx by fingerprint (#6370) (#6409)
• fix(analytics): make the Umami retention tick commit, and size it for the volume (#6375) (#6407)
• fix(sentry): repair the alicdn font rule and filter the round-5 TR injectors (#6408)
• fix(markets): harden Hyperliquid and FRED live data (#6339)
• fix(rate-limit): stop the test-context abort racing the decision (#6236) (#6405)
• fix(gdelt-intel): share one timestamp validator between the fetch-ordering and health paths (#5858) (#6044)
• ops(railway): mark company-monitoring-worker planned so the post-#6397 apply can run (#6402) (#6403)
• fix(ingestion): harden theater posture publication (#6401)
• fix(energy): stop one absent country from withholding the JODI dataset (#6395) (#6400)
• fix(ingestion): reject empty theater posture publishes (#6393)
• fix(settings): apply source toggles to the live dashboard on close (#6380) (#6399)
• fix(analytics): judge collector health against its own baseline instead of a fixed 0.5 (#6026) (#6041)
• fix(railway): align deploy closures with build inputs (#6397)
• fix(ingestion): tolerate bounded consumer-price retailer loss (#6394)
• feat(company-monitoring): add durable scan orchestration (#6386)
• fix(ci): paginate the deploy gate's check-runs read (root cause of #6389) (#6391)
• fix(intel): stop feed newlines forging rows in the three sibling prompt blocks (#5881) (#5897)
• test(e2e): wait for degraded digest retry (#5899)
• fix(ci): keep the deploy gate posting a status when the required list is long (#6389) (#6390)
• fix: silence floating promise in playback snapshot-exit path (#5968)
• fix(correlation): harden seeder input reads (#6385)
• ops(monitor): acknowledge the eight consumer-price coverage partials against owner issues (#6363)
• fix(analytics): keep Umami storage warnings non-fatal (#6384)
• fix(monitor): monitor the newest gated main revision instead of failing on an undecided head (#6374)
• fix(dashboard): apply panel settings without a reload (#6379) (#6382)
• feat(markets): authorize Finnhub+AV quote provider chain (#6304) (#6350)
• fix(convex): stop a one-dot test helper from failing every convex deploy (#6232 follow-up) (#6373)
• fix(railway): fence reconciliation cutover with leases (#6326) (#6326)
• feat(company-monitoring): add bounded portfolio onboarding (#6232)
• test(company-monitoring): add progressive blind evaluation scorer (#6219)
• fix(railway): add reconciliation recovery control plane (#6325)
• feat(mcp): expose WTO trade flows to agents, name coverage-collapse causes (#6323) (#6353)
• fix(sentry): filter the two extension webfonts still dominating TR (follow-up to #6371) (#6372)
• fix(analytics): unblock Umami storage monitor (#6354)
• feat(markets): add the RUB quote table as a third FX panel tab (#6231) (#6352)
• fix(trade): serve every supported tariff-trend window and name what is uncovered (#6316) (#6349)
• fix(sentry): narrow the CSP rules to observed signatures and repair a vacuous guard (follow-up to #6369) (#6371)
• test: replace implementation checks with behavior coverage (#6368)
• fix(sentry): filter the CSP injectors that dominate TR/J0, and close two format gaps (#6369)
• fix(payments): send the welcome email to the account's current login address (#6335) (#6364)
• fix: unblock checkout on the API host and revive two dead iOS filters (#6365)
• fix(observability): stop two non-errors paging at Sentry error level (#6351)
• fix(entitlements): repair the free-tier ownership model shipped in #6345 (#6346)
• fix(insights): name which editorial gate rejected the world brief (#5947) (#6342)
• fix(entitlements): restore all free-tier-owned preferences (#6345)
• fix(china): recover Japan MOD releases from unterminated anchors (#6344)
• fix(consumer-prices): evidence-gated extraction recovery for the eight partial markets (#6182) (#6343)
• fix(api): classify truncated Convex response bodies as transient (#6340)
• feat: add visual stock/market watchlist customization (#1881)
• test(ci): eliminate observed timing and fixture flakes (#6327)
• fix(panels): transfer gate ownership on every user toggle (review P1) (#6338)
• fix(panels): stop the free-tier count cap being a one-way door (#6337)
• chore(trade): remove the v1 trade-flow cutover bridge (#6315) (#6329)
• fix(payments): send lifecycle emails to the account login email, not the checkout alias (#6330) (#6336)
• fix(sentry): name world-brief rejection gates, drop mutated-CSP noise (#6333)
• fix(china): stop scroll re-priming from flickering the corridor and nowcast panels (#6328)
• fix(markets): restore parameterized crypto quote requests (#6320)
• fix(markets): deliver quotes for custom watchlist symbols (#6318)
• fix(trade): serve every supported trade-flow window and name what is uncovered (#6309) (#6322)
• fix(rss): preserve stale feeds through upstream failures (#6312)
• fix(markets): honor stablecoin coin filters and restore custom IDs (#6317)
• perf(tests): cut idle waits and redundant parsing in unit + smoke CI (#6324)
• fix(markets): restore parameterized commodity quote requests (#6307) (#6314)
• fix(maritime): stop the AIS relay sustaining its own upstream IP block (#6313)
• fix(news): prioritize China feeds before digest deadline (#6311)
• fix(consumer-prices): attribute coverage loss to a bounded failure reason (#6301)
• docs(health): pin the published /api/health key count to the registry (#6300) (#6303)
• fix(china): retry Japan MOD empty index through proxy (#6302)
• fix(railway): classify unprovisioned seeders as planned (#6278)
• test(build-guards): make dist-gated skip explicit via WM_EXPECT_BUILT_OUTPUT (#6284)
• fix(health): stop a producer fault from masking a vanished data key (#6263) (#6299)
• chore(deps): bump postgres from 17-alpine to 18-alpine (#6293)
• feat(i18n): give the translator prompt the product's domain glossary (#6295)
• fix(webmcp): migrate tools to document.modelContext (#6292)
• fix(analytics): preserve collector timeout fallback (#6088)
• i18n(de): fix mistranslated domain terms and complete the German locale (#6294)
• fix(markets): bound market-implications LLM misses instead of alarming on each (#6259) (#6266)
• fix(security): patch js-yaml and stop upstream advisories blocking PRs (#6298)
• fix(consumer-prices): repair dead extraction fallback and prompt-fabricated prices (#6270)
• fix(markets): recover sector ETF valuations by rotating the proxy exit (#6290)
• refactor(china): retire the Vercel edge egress hop from the SZSE disclosure seeder (#6274)
• fix(weather): harden the US-only disclosure guards from the #6269 review (#6276)
• fix(weather): rank NWS alerts by severity before the 50-cap (#6277)
• fix(military): seed stale-snapshot flight fixtures through the normalizing field (#6291)
• fix(mcp): attach both source failure reasons to get_airspace error (#6085) (#6283)
• fix(military): bound stale flight recovery cache (#6287)
• feat(aviation): keyless ADS-B redundancy — adsb.lol primary, blind-spot gap-fill, ODbL attribution (#6273)
• fix(seeders): recover rejected Redis publications (#6286)
• fix(aviation): skip degenerate bbox block for icao24-only requests (#6275)
• fix(military): reject Upstash command errors (#6258)
• fix(military): deliver global flight coverage to dashboard (#6261)
• fix(china): retry transient NBS fetches so one socket blip can't stale the release calendar (#6264)
• fix(maritime): bound AIS reconnects and report degraded health (#6268)
• fix(worktree): self-heal hooks path at push time (#6285)
• fix(rate-limit): fail closed paid-provider market routes (#6260)
• fix(procurement): keep SAM seeding on reachable IPv4 (#6265)
• chore(worktree): verify dependency installation (#6131)
• ci: add generated-file drift gate for bootstrap-tier-keys (#6282)
• ops(railway): prune the recovered umami drift suppression and stop an empty baseline expiring (#6064) (#6281)
• fix: disclose US-only weather alert coverage (#6269)
• test(military): close three assertion gaps in the OpenSky cooldown suite (#6241) (#6255)
• fix(military): persist the OpenSky 429 cooldown so the seeder stops re-firing (#6241) (#6252)
• feat(markets): opt-in FX panel over the orphaned fx:yoy seed (#6199) (#6226)
• fix(docs): use MDX comments for the generated attribution markers (#6251)
• fix(architecture): close the four gold-standard deviations (#6235) (#6239)
• fix(military): one global OpenSky query per run — 86% → 43% of the daily credit quota (#6222) (#6244)
• feat(markets): show the CBR key rate in the Central Banks tab (#6202)
• docs(sources): audit upstream attribution inventory (#6250)
• perf(inp): cut /dashboard interaction-time work and fix the readout (#6221)
• fix(seed): preserve shared FX fallback provenance (#6233)
• feat(railway): give all 41 registry services an exact watch-path closure (#6204) (#6218)
• fix(railway): reconcile on Deploy Gate completion and alarm on a silent fleet (#6203) (#6216)
• fix(seo): make category explainer answer-first (#6217)
• fix(seed-utils): stop retrying a Retry-After the run cannot wait out (#6110) (#6215)
• fix(brief-gates): stop flagging a sentence-initial common noun the source already contains (#6109) (#6201)
• fix(seo): complete Dataset structured data (#6207)
• fix(railway): fail closed on partial fleet history (#6206)
• feat(china): seed Stock Connect northbound turnover + margin balance from SSE/SZSE (#6190)
• feat(company-monitoring): define dark service contract (#6188)
• test(company-monitoring): freeze viability and evaluation contract (#6186)
• fix(markets): keep replayed sector valuations safe, honest, and refreshable (#6197)
• fix(mcp): publish activationUnknown on the cache envelope (#6198)
• docs(correlation): record #5991 RRF decision (#6079)
• fix(consumer-prices): recover partial retailer extraction (#6185)
• feat(markets): add Bank of Russia RUB rates + CBR key rate seeder (#6154) (#6187)
• fix(aviation): preserve OpenSky credit budget (#6196)
• ops(railway): trigger seeder deploys from CI and judge drift against the service closure (#6142) (#6151)
• fix(health): bound content freshness activation grace (#6152)
• fix(markets): stabilize sector valuation coverage (#6183)
• fix(portwatch): retry transient ArcGIS rate limits (#6184)
• fix(client): keep map overlays on a faked WebGL context + name push 400s (#6194)
• fix(payments): capture unattributable Dodo events instead of retry-storming (#6191)
• test(prediction-markets): pin fixture expiry clock (#6195)
• ops(analytics): activate the Umami 90-day retention runner (#6148) (#6189)
• ci(proto): enforce breaking changes in workflow (#6147)
• feat(desktop): acknowledge checkout in returning browser (#6136)
• fix(review): restore the desktop handoff outcome guards dropped in the rebase (#5911, #6120) (#6145)
• fix(seeders): make every Railway entry point announce that it finished (#6144)
• feat(ops): detect when a Railway service is not running the merged commit (#6143)
• fix(desktop): migrate remaining links to shared opener (#6137)
• fix(desktop): commit the release train to one switching binary (#5908) (#6124)
• fix(mcp): ground world brief in seeded insights (#6134)
• fix(insights): don't split the brief lead at an acronym that carries its citation (#5947) (#6119)
• chore(supply-chain): promote FlowEstimate.source to a closed enum (#6101) (#6122)
• fix(health): widen PortWatch content freshness budget (#6135)
• fix(selfhost): allow Docker LLM origins through sidecar SSRF guard (#6130)
• fix(health): surface mid-publish military starvation (#6132)
• harden(health): treat an unreadable activation marker as unknown, not confirmed-absent (#6095) (#6117)
• fix(sentry-triage): five live issues across payments, analytics, session copy and crash filters (#6129)
• fix(security): clear production dependency audit failures (#6140)
• fix(military): stop seed-military-flights crashing on every run (#6128)
• fix(security): bump brace-expansion past GHSA-rgw5-rvv9-x895 (#6118) (#6123)
• fix(military): cap Wingbits aircraft detail batches (#6099)
• fix(quota): separate dashboard AI limits from MCP (#6105)
• fix(panels): hydrate late-mounted hub activity panels (#6100)
• fix(mcp): age the #6080 fixture guard on the content clock, not the legacy fallback (#6080) (#6096)
• fix(navigation): keep variant links on dashboard (#6098)
• fix(china-nowcast): publish an observed China energy-demand change (#6067) (#6081)
• ops(relay): attribute theater-posture publications to their actual source (#5945) (#6092)
• fix(mcp): align the freshness envelope with health's PortWatch content-freshness dimension (#6080) (#6094)
• fix(ops): reconcile Railway config drift (#6091)
• fix(markets): restore ETF valuation identity for Yahoo summaries (#6090)
• fix(china-nowcast): persist comparable corridor history (#6083)
• fix(china-nowcast): name each CCFI exclusion honestly and fail closed on undated observations (#6066) (#6077)
• fix(china): separate PortWatch content freshness and healthy-quiet groups in decision coverage (#6060) (#6073)
• chore(supply-chain): declare the CCFI period-change fields on ShippingIndex (#6078) (#6084)
• fix(china): accept same-publisher corridor corroboration (#6076)
• feat(search): build intelligence command deck (#5971)
• fix(china-nowcast): publish a directional CCFI period change (#6066) (#6074)
• fix(health): bound the consumer-price coverage rollout window (#6059) (#6075)
• fix(feeds): enforce complete geographic classifications (#6072)
• fix(health): retire expired on-demand softenings (#6071)
• fix(hydration): handle dashboard container scrolls (#5894)
• fix(news): refresh expired persistent RSS responses (#6069)
• fix(webcams): fit 2x2 wall to short viewports (#6065)
• fix(economic): accept full macro-stress FRED batch (#6062)
• fix(ui): normalize China dashboard panel styling (#6063)
• fix(insights): make world brief readable (#6061)
• fix(analytics): bound the umami pool's acquisition wait so overload fails fast (#6057)
• feat(feeds): P3 — Canada + Arctic/Nordic security source pack (#5960) (#6054)
• fix(map): gate CMD+K locked premium layers for free users (#6045) (#6049)
• fix(map): use hasPremiumAccess for GlobeMap premium gating (#6050)
• fix(seo): rotate Bing-rejected www IndexNow key (#6055) (#6056)
• feat(i18n): add Ukrainian (uk) locale + lang boost for UA feeds (#6052)
• fix(review): address code review findings for theater presets (#6023)
• fix(analytics): restore umami session_data writes and gate the image on a runtime write probe (#6051)
• fix(ingestion): bound provider retries and expose coverage (#6022)
• fix(digest): tie the replay read-snapshot's lifecycle down and prove it (#6039)
• fix(map): hide sunset iranAttacks toggle from SVG/mobile picker (#6048)
• fix(feeds): reconcile regional rollout contracts (#6031)
• docs: align public copy with code-derived counts — CII 31 Tier-1, 55 free layers, 41 MCP tools (#5488)
• feat(bootstrap): cut the slow public tier over to KV serving (stage 1, #5338) (#6035)
• fix(digest): page replay-log reads and re-anchor the caps to Upstash's real limit (#6033)
• fix(analytics): eliminate Umami session-data write race (#6034)
• fix(payments): absorb Dodo checkout 429s with a bounded jittered retry, pin SDK retries off (#6027) (#6032)
• fix(insights): let a lead cite every story a merged claim draws from (#6030)
• fix(review): harden geo coverage gate against silent-pass failures (#6029)
• fix(china): restore Japan MOD via the Japanese Joint Staff homepage (#5904) (#6013)
• fix(news): deduplicate before limiting summary headlines (#5969)
• fix(bootstrap): survive sandboxed iframes, match aliased fetch wrappers (#6028)
• test(feeds): geographic coverage health audit vs geography keyCountries (#5957) (#5999)
• feat(feeds): add strategic default weights separate from locale boost (#5958) (#6000)
• feat(correlation): add staged runtime correlation modes (#6020)
• fix(insights): restore world brief synthesis by reserving a corroborated lead slot (#5947) (#6019)
• fix(markets): restore complete sector valuation coverage (#5997)
• fix(analytics): aggregate collector health across users (#5998)
• feat(feeds): P1 — Africa depth beyond Nigeria (Horn, DRC, West Africa) (#5980)
• fix(analytics): harden Umami collector write-path acceptance (#5996)
• fix(analytics): gate receiptless-200 collector alerts on aggregate floors (#5978) (#5979)
• feat(feeds): P1 — Eastern flank neighbors pack (Romania, Baltics, Turkey Black Sea) (#5952) (#5975)
• feat(feeds): P1 — Indo-Pacific gaps (Taiwan mainstream, Pakistan, SE Asia security) (#5954) (#5977)
• feat(feeds): P1 — Caucasus, Central Asia, Belarus/Moldova theater packs (#5953) (#5976)
• fix(widgets): preserve custom panels across auth and cloud refresh (#5924)
• feat(feeds): P1 — Ukraine depth pack (local institutions + daily frontline assessment) (#5951) (#5972)
• fix(analytics): alert only on actionable collector write failures (#5974)
• ops(ingestion): bound aviation/RSS throttling and expose consumer-price partial coverage (#5970)
• feat(feeds): document and enforce UA/RU EN default balance (#5950) (#5966)
• feat(feeds): default-enable Ukraine/Poland frontline sources for EN (#5949) (#5963)
• fix(analytics): validate concurrent collector writes (#5964)
• fix(markets): restore sector valuation enrichment after Yahoo 401s (#5962)
• fix(insights): preserve freshness on synthesis rejection (#5947) (#5965)
• feat(growth): measure content-to-product handoffs (#5944)
• fix(ops): sync seed-conflict-intel Railway watch paths with GDELT bulk contract registry (#5961)
• Merge commit from fork
• feat(growth): operationalize AI visibility evidence loop (#5940)
• Merge commit from fork
• fix(seo): enforce complete meta descriptions (#5943)
• feat(mobile): add feed-first primary navigation (#5244)
• fix(auth): compensate Clerk token cache for client clock skew (#5938)
• test(auth): harden Clerk expiry regression (#5937) (#5942)
• fix(seo): add and validate Dataset descriptions (#5941)
• fix(auth): reject stale Clerk fallback after session switch (#5937)
• fix(ci): replace invalid Actions pin with the commit SHA it resolves to (#5925)
• fix(desktop-build): pass the client VITE_ env to Tauri builds and gate its completeness (#5905) (#5919)
• fix(pro): expose H1 in static page HTML (#5939)
• fix(mcp): expose commodities news to agents (#5914)
• test(china): pin Japan MOD Cloudflare fallback contract (#5917)
• fix(markets): restore sector valuation enrichment (#5918)
• fix(security): bump tauri to 2.11.5 and gate the advisory floor (#5518) (#5934)
• fix(seo): close sitemap and IndexNow coverage gaps (#5936)
• fix(seed): recover OFAC sanctions freshness (#5927)
• fix(markets): alarm on empty prediction pools (#5916)
• fix(auth): keep the Clerk token when its forced refresh fails (#5933)
• docs: document recent intelligence and billing features (#5913)
• epic(desktop): establish parity baseline and drift gates (#5902) (#5915)
• docs(mcp): document prediction market categories (#5898)
• Surface account and billing in one user menu (#5901)
• i18n: translate 88 new strings across all 23 remaining locales (#5882)
• fix(sentry): suppress SnapTube WebView bridge JSON.parse noise (#5900)
• fix(cross-source-signals): unwrap seed envelopes and align extractors with their writers (#5870) (#5896)
• fix(premium): observe entitlement desyncs (#5879)
• refactor(gating): split panel-gating.ts by gate (#5813) (#5893)
• fix(news): rotate a custom category's capped feed window and surface its source coverage (#5873) (#5887)
• fix(china): distinguish decision group unavailability (#5891)
• fix(intel): stop feed newlines forging rows in every analyst prompt block (#5857) (#5884)
• fix(entitlements): enforce declared export formats (#5880)
• fix(news): stop a degraded 200 digest from poisoning the last-good cache (#5877) (#5883)
• fix(news): validate cached classification values (#5553)
• fix(finance): derive the news/data panel-key collision so commodities-news is created (#5871) (#5888)
• fix(ops): prune the recovered gdeltIntel freshness suppression (#5770) (#5867)
• fix(markets): classify each prediction market into exactly one pool (#5733) (#5872)
• fix(wildfire): cap the canonical fires payload under the 5MB publish limit (#5866) (#5869)
• fix(news): stop 19 uncapped rss-proxy fetches and the doubled news load (#5376) (#5878)
• ci: attach provenance and SBOM attestations to the published image (#5788)
• fix(widgets): block beforeunload in custom widget sandbox (#5760)
• fix(gdelt): move consumers to one bulk materializer (#5863)
• fix(ml): stop caching a rejected model-load promise for the whole session (#5678)
• test(mcp-grant): add Playwright E2E spec for /mcp-grant consent page (#5658)
• refactor(tech-events): remove the dead narrowing from the cache-fill path (#5834)
• fix(self-hosting): support optional AIS and Windows seeders (#5799)
• fix(gdelt): rotate seed-gdelt-intel topics on last-attempt so one scarce DOC success stops monopolizing (#5848) (#5859)
• fix(checkout): preserve provider 429 responses end to end (#5862)
• docs(china): document complete data coverage (#5860)
• fix(intel): read materialized GDELT topics from Redis in chat-analyst (#5850) (#5856)
• fix(llm-health): quarantine models the provider rejects instead of retrying them on every call (#4949) (#5458)
• fix(security): bump sharp >=0.35.0 in blog-site (GHSA-f88m-g3jw-g9cj, HIGH) (#5477)
• fix(conflict): make the GDELT bulk export primary and demote the DOC country sweep to fallback (#5849) (#5855)
• fix(pro): fail closed on entitlement reload guard (#5853)
• docs(agents): clarify pull request authority (#5854)
• fix(china): close the SZSE proxy retry and edge diagnostic gaps (#5839)
• fix(auth): tolerate small Clerk JWT clock skew (#5832)
• fix(consumer-prices): gate implausible movers as parse artifacts (#5445) (#5461)
• fix(pro): prevent post-checkout entitlement reload loops (#5846)
• feat(pricing): 3 months free on every annual plan + API Business Annual SKU (#5845)
• fix(proxy): match the Decodo curl-endpoint rewrite case-insensitively (#5847)
• ci(gate): give each changes job a distinct check-run name (#5822) (#5842)
• fix(ci): restore deterministic main test runs (#5840)
• feat(market): blend fundamentals into the analyze-stock rating (#5598)
• fix(review): normalize Decodo host before sticky-port detection (#5837)
• fix(pro): stop upgrade banner flickering for Pro users (#5836)
• fix(correlation): suppress isolated slow-run warnings (#5835)
• fix(china): diversify SZSE proxy exits (#5833)
• fix(tech-events): cache the widest payload on cold-start fallback (#5427) (#5603)
• fix(gdelt): reduce rate-limited ingestion fanout (#5830)
• ci(gate): require every gated-workflow job, not just test.yml's (#5402) (#5825)
• test(mcp): reject extra intel-history requests (#5831)
• fix(hooks): repair the shared absolute core.hooksPath instead of warning (#5810) (#5824)
• docs(api): publish versioning and deprecation policy (#5827)
• test(mcp): pin intel history POST body privacy (#5821)
• fix(ci): preserve gate status API order (#5828)
• fix(ci): paginate gate status lookup (#5826)
• i18n(hi): translate 90 recently added strings across dashboard features (#5778)
• fix(ci): validate Railway project token context (#5816)
• fix(health): retire shipping rates recovery exception (#5784)
• fix: merge GED Candidate release onto annual UCDP base instead of probing annual-only (#5796)
• fix(ops): fail closed on ingestion acceptance drift (#5802)
• fix(sentry): attribute events to deployed builds (#5815)
• fix(premium): stop rendering a failed lookup and a signed-out caller as "free plan" (#5619) (#5779)
• fix(hooks): stop the green-tree cache attesting a tree the gates never ran (#5800) (#5809)
• fix(dashboard): gate playback on entitlements, not a dead Clerk field (#5812)
• fix(mcp): preserve conflict events within output budget (#5807)
• fix(conflict): fall back to official HAPI snapshots (#5806)
• test(docs): gate the /api/bootstrap Cache-Control values the docs publish (#5794) (#5808)
• fix(portwatch): make port-activity recovery converge (#5804)
• fix(china): require sustained SZSE recovery (#5803)
• fix(gdelt): bound ingestion recovery (#5805)
• feat(market): surface an LLM news-sentiment sub-score on stock analysis (#5656)
• feat(market): add per-stock risk analytics to stock analysis (#5649)
• fix(notifications): guide denied push users to browser settings (#5764)
• fix(hooks): route tests/dom/ to vitest instead of the node:test runner (#5795) (#5801)
• fix(china): add bounded SZSE edge fallback (#5786)
• test(checkout): close #5380 coverage gaps — false-passing idempotency test, webhook rollback, boundaries (#5606)
• fix(bootstrap): stop the edge answering an invalid key from a warm weather cache (#5386) (#5791)
• fix(security): harden contact and local-secret validation (#5787)
• fix(intel): give history ingestion a durable health signal (#5736) (#5792)
• fix(session): recover when cookies cannot persist (#5798)
• fix(ops): retire recovered China coverage exception (#5785)
• sec(intel): decide the untrusted-text posture and add a retraction path (#5743) (#5781)
• fix(seed): reject ACLED events without stable ids (#5783)
• fix(china): classify the Japan MOD proxy target block (#5776)
• fix(api-keys): tolerate transient auth races (#5780)
• fix(scripts): recognise keyword-preceded regex in stripJsComments (#5763)
• fix: decode HTML entities exactly once, repo-wide (#5436) (#5754)
• fix(auth): bound Clerk token cache by the token's own expiry (#5753)
• fix(checkout): handle a create-checkout 200 whose body will not parse (#5761)
• sec(seed): stop seeder imports from loading production credentials (#5767) (#5775)
• fix(ops): enforce ingestion operational acceptance (#5756)
• feat(mcp): expose client-side analysis composites as MCP tools (#5696) (#5739)
• fix(test): stop the China macro fixture rotting on a calendar date (#5762) (#5765)
• feat(intel): corporate intelligence — SEC EDGAR filings, 8-K material events, earnings surprises, real company enrichment (#5695) (#5738)
• fix(boot): handle the variant stylesheet preload rejection (#5758)
• feat(intel): historical intelligence memory — semantic search, timelines, and precedent matching (#5737)
• fix(prefs): serialize cloud preference writes (#5755)
• feat(mcp): on-demand NLP intelligence utilities — classify, extract entities, news clusters, keyword spikes (#5734)
• feat(forecast): geopolitical bet family — long-horizon market slice (#5735)
• fix(pro): stop Upgrade banner flashing for entitled users (#5728) (#5751)
• fix(research): reject incomplete daily coverage (#5746)
• fix(docs): align API meta descriptions with runtime (#5750)
• fix(analytics): verify collector writes and retry identity (#5748)
• fix(seo): submit apex MCP URL via IndexNow (#5749)
• fix(seo): expand crawlable meta descriptions (#5747)
• fix: gitignore docker-compose.override.yml and secrets/ (#5725)
• fix(auth): avoid negative-caching transient user-key failures (#5599)
• fix(seed): restore GDELT timeline recovery (#5719)
• feat(research): Strait of Hormuz transit report — source-backed research pilot (#5668) (#5721)
• fix(china): retry transient SZSE proxy failures (#5722)
• fix(health): bound degraded source markers (#5717)
• fix(test): isolate shallow Git fixture (#5732)
• fix(china): classify Japan MOD proxy failures (#5718)
• fix(conflict): recover HAPI from egress bot blocks (#5720)
• docs(legal): clarify optional World Monitor attribution (#5716)
• fix(seo): generate truthful sitemap freshness (#5711)
• feat(growth): establish SEO and AI-citation scorecard (#5709)
• fix(rate-limit): isolate paid callers from shared IP buckets (#5708)
• test(china): lock quiet disclosure health semantics (#5710)
• docs(legal): clarify subscription license tiers (#5702)
• chore(mcp): fold MCP-edge and gateway Pro-MCP gates into server/_shared/pro-mcp-gate.ts (#5659)
• feat(pricing): reduce Pro Business to $49.99/mo and $499/yr (#5688)
• fix(session): tell a dropped cookie apart from a rejected one (#5687)
• perf(globe): bound HTML marker count and instrument the field (#5368) (#5371)
• fix(e2e): retry once in CI so a Playwright protocol glitch stops reddening gates (#5686)
• fix(bootstrap): stop non-on-demand keys taking the credential-less public path (#5683)
• fix(session): scope wm-session blackouts to the failing route (#5674) (#5677)
• fix(session): tag dead-session route and stop premium 401s killing it (#5674) (#5680)
• fix(entitlements): honor Clerk Pro role in JSON gates (#5650)
• fix(entitlements): finish the billing-verification sweep (#5661)
• feat(welcome): add blog navigation and Palantir FAQ (#5681)
• test(gates): DOM-behavioral coverage for ExportGateControl, the PDF click cycle, resolveGateAction and PanelTabBar's locked notice (#5660)
• chore(i18n): refresh all 24 /pro locales for the pricing restructure + stop English copy silently rotting translations (#5655)
• feat(onboarding): surface command search in Pro setup
• test(seo): align pricing assertions with visible surfaces
• fix(csp): re-sync script-src hashes with the regenerated inline JSON-LD
• fix(ci): drop stale crawler-copy stats claim
• Address PR review feedback (#5676)
• fix(seo): replace crawler-only prerender content
• fix(comtrade): enforce CI and quota contracts
• fix(china): recover Japan MOD through proxy fallback (#5657)
• fix(i18n): stop advertising query locale alternates
• fix(china): proxy SZSE disclosures after direct failure (#5651)
• chore(china): give the decision-parity audit teeth (#5643) (#5648)
• fix(seo): generate canonical public product facts (#5672)
• chore(china): dedupe provenance OpenAPI schemas (#5647)
• docs(comtrade): record the verified Railway cron instead of assuming it
• fix(a11y): add focus-visible indicators for settings controls (#5059) (#5522)
• fix(comtrade): compose the period strategies, bound quota and coverage
• fix(hooks): use PR base ref for pre-push commits-ahead guard (#5670)
• fix(blog): track canonical-host conversions (#5662)
• fix(blog): attribute product conversion clicks
• fix(comtrade): fall back to prior period per-reporter, cap request quota
• fix(review): correct JSDoc target and give the Comtrade budget test teeth
• fix(docs): recompute stats on second main merge (178 components, 209 services)
• feat(pricing): seed real Dodo product IDs for Pro Business
• feat(china): compose decision-parity signals (#5639)
• fix(data): recover humanitarian, China, and PortWatch coverage (#5640)
• fix(comtrade): restore bilateral HS4 ingestion continuity
• fix(activation): harden day-0 outcome ownership (#5638)
• fix(entitlements): stop fresh Pro purchases getting 15 min of broken Pro (#5600) (#5623)
• feat(activation): record day-0 activation outcomes server-side (#5621) (#5626)
• feat(market): join upcoming earnings into stock analysis (#5636)
• feat(china): add opacity-resistant activity nowcast (#5631)
• docs(solutions): capture the npm registry outage that silently redded the security gate (#5637)
• docs(concepts): correct Plan Family entry — tier gates are thresholds
• docs(solutions): compound the credential-class vs plan-family quota lesson
• fix(docs): recompute stats on the merged tree (176 components, 207 services)
• fix(review): close API-tier OAuth quota leak + probe retry + popover staleness
• refactor(gates): consolidate cross-unit duplication from the simplify pass
• fix(export): widen print-host contentWindow slice with the document fallback member
• test(docs): update license-key guidance pin for the Pro Business wording
• docs(pricing): reconcile every surface with the new tier ladder and export gating
• feat(pro): pricing page restructure — Personal/Commercial axis header, Enterprise band, five-column grid; rebuild public/pro
• feat(pricing): Pro Business goes public — catalog copy, both mirrors, v3 cache key (7 sites), license-chip parity guard, pricing docs
• feat(dashboard): per-plan tab cap with visible locked add-control — Free 3 / Pro 10 / Pro Business 25, creation-only, billing-aware
• feat(export): entitlement-gated export with visible locked state, billing-aware CTAs, and PDF data report
• feat(activation): make the denial cohort readable, not just recorded (#5617) (#5630)
• feat(billing): Pro Business lifecycle — shared pro checkout family with upgrade carve-out, guided 409 copy, welcome email, day-0 activation
• fix(mcp): Settings quota widget reports plan-resolved limit — 250 for Pro Business, unlimited for Enterprise, client normalizer no longer coerces null/0 to 50
• feat(activation): record a browser-blocked step in its own durable bucket (#5617) (#5629)
• fix(summarization): stop logging 'All providers failed' for declined-by-design chains (#5377) (#5605)
• fix(military): harden cross-Strait activity publication (#5627)
• fix(ci): stop an npm registry outage from silently redding the security gate (#5628)
• feat(mcp): plan-driven daily quota for pro-family callers — 250/day Pro Business, null=unlimited, user_key stays 50
• feat(billing): Pro Business catalog foundation — dataExport entitlement field, dual PLAN_PRECEDENCE entries, resolvePlanKey catalog fallback
• feat(china): compose regional logistics corridor control towers (#5593)
• docs(activation): capture the denied-permission dead-end learning (#5609) (#5624)
• fix(settings): clamp unavailable MCP tab (#5625)
• fix(premium): stop rendering a 403 as "Pro required — upgrade" when the client says Pro (#5608) (#5618)
• fix(activation): route a denied push permission to the blocked state (#5609) (#5615)
• fix(pro): point activation step 3 at MCP Clients, not the API upsell (#5607) (#5613)
• fix(military): stop cross-Strait seeder crashing on every publish (#5616)
• feat(china): add official exchange disclosure signals (#5594)
• fix(china): harden policy ingestion (#5610)
• feat(china): add official macro-financial pulse (#5597)
• feat(china): ingest official policy enforcement events (#5595)
• feat(military): add cross-strait activity baseline (#5596)
• docs: add Japanese README (#5410)
• feat(markets): expandable terminal price chart + fix(dev): OpenSky proxy path (#5459)
• fix(sidecar): release upstream fetch semaphore on stalled/truncated responses (#5489)
• feat(provenance): add decision-signal contract (#5592)
• fix(activation): land outcome tracking on main (#5590)
• fix(observability): detect silent catch blocks in Sentry coverage audit (#5586)
• fix: register missing Breaking Defense intel source (#5405)
• feat(business-seats): add domain-gated Pro seat invites for API Business (#5563)
• feat(activation): onboard unactivated first-cycle Pro users (#5564)
• fix(seo): preflight crawlable live sessions (#5589)
• feat(market): add structured fundamentals + panel to stock analysis (#5467)
• perf(market): serve the live price tape from the 'live' cache tier (#5465)
• fix(rss-proxy): preserve original error/response when relay fallback throws (#5464)
• fix(provenance): require explicit feed classifications (#5571)
• test: guard Pro JSON-LD pricing against catalog drift (#5451)
• fix(security): baseline unreachable brace expansion advisory (#5572)
• fix(conflict): fix humanitarian pipeline — HAPI per-identifier throttle, not IP (#5554) (#5568)
• feat(monitoring): probe the Umami analytics collector every 15 minutes (#5565) (#5567)
• docs: correct CII country coverage (#5511)
• refactor(forecast): extract market settlement loader (#5566)
• docs(architecture): align alert docs with wired producers (#5513)
• fix(header): keep Sign In visible on medium-width desktops (#5557)
• feat(forecast): Phase 2 — LLM ensemble + prediction-market/FRED calibration slices (#5525) (#5526)
• fix(news): fail-closed source provenance defaults (#5390) (#5556)
• fix(deps): bump postcss to 8.5.18+ to clear GHSA-r28c-9q8g-f849 (#5562)
• perf(gates): fix stale-hook delivery + batch esbuild check + incremental tsc (push timeouts) (#5558)
• feat(seo): close crawlable-corpus audit gaps — social meta, name aliases, trust links, partial risk rendering (#5555)
• feat(pricing): API Starter rename + commercial-license split + 5 Pro seats on Business ($299.99) (#5552)
• feat(seo): add crawlable live intelligence tools (#5546)
• fix(_crypto): fail closed on malformed auth inputs (#5550)
• fix(renewable): replace hardcoded fallback with last-known-good data (#5551)
• feat(activation): day-0 pro activation onboarding interstitial (#5534)
• fix(seo): prevent raw-text crawlers from extracting "WWorld Monitor" Move the decorative "W" brand mark from inline text to a CSS ::after pseudo-element. Raw textContent extraction now yields "World Monitor" instead of "WWorld Monitor". The visual appearance, accessible name, and first-paint footprint are unchanged — the ::after inherits the same font-size and color from .skeleton-brand-mark. Adds focused regression tests in deploy-config.test.mjs asserting: - Raw text does not contain "WWorld" - The brand mark span has no text content - The "W" is rendered via CSS content Fixes #5541 (#5549)
• fix(docker): preserve caller auth for local MCP requests (#5537)
• fix(docker): preserve caller auth for local MCP requests (#5492)
• feat(i18n): Hoàn thiện bản dịch tiếng Việt (vi.json) (#5539)
• fix(routing): redirect pricing to canonical section (#5548)
• fix(payments): dead-letter authenticated malformed webhooks instead of 401 (#5547)
• fix(giving): disclose published benchmark provenance (#5540)
• fix(payments): persist failed Dodo webhook incidents (#5533)
• Merge commit from fork
• test(bootstrap): cover DebugBear sampling boundaries (#5545)
• fix(seo): remove unsupported schemamap robots directive (#5544)
• chore(bootstrap): wind down the R2-origin experiment (DebugBear sampling + KTD7 no-go) (#5536)
• fix(payments): restore lapsed subscriber reactivation path (#5532)
• fix(security): bump find-my-way to 9.7.0 — GHSA-c96f-x56v-gq3h (HTTP/2 DDoS) (#5527)
• feat(api): enforce the sold daily cap + informative at-cap 429 (#4635) (#4684)
• fix(forecast): extend EIA settlement grace (#5524)
• fix(global-tenders): spread SAM.gov request budget, stop retrying 429s (#5444) (#5457)
• fix(auth): close the #5379 adversarial sweep — resource exhaustion, state corruption, MCP entitlement gaps, and the inert live suite (#5385)
• fix(auth): keep Pro brief denials out of session recovery (#5516)
• fix(python-sdk): avoid secret-scan literals (#5486)
• fix(mcp): route sibling fetches through canonical API (#5517)
• fix(notification-channels): bound convexRelay() with a 15s timeout (#5485)
• docs(solutions): compound #4771 learnings — coverage-semantics bug + i18n shell convention (#5495)
• ux(payments): billing-aware renewal/lapsed states instead of generic Upgrade CTA (#4771) (#5494)
• feat(homepage): link Palantir positioning article (#5491)
• fix(auth): honor current API access during renewal checks (#5490)
• fix(seed-gdelt-intel): degrade bookkeeping failures instead of crashing; brownout-scale timeline TTL; content-age opt-in (#5478) (#5481)
• ci(deploy-gate): retry the check-runs poll before posting a terminal 'pending' (#5479) (#5482)
• fix(payments): distinguish transient entitlement-lookup failure from confirmed denial (#5483)
• feat(blog): strengthen SEO and AI discoverability (#5475)
• fix(payments): re-check Dodo before stale-subscription denial (#5447)
• docs(blog): clarify WorldMonitor and Palantir positioning (#5480)
• feat(agent-readiness): advertise SDKs in the agent view + homepage rel=alternate pointer (orank round 2) (#5476)
• feat(agent-readiness): sandbox, docs-MCP JSON-RPC errors, schemamap, modular llms.txt (orank round) (#5469)
• fix(content): replace blog title cards with product imagery (#5452)
• feat(blog): pinned-post support; pin the Palantir post to the top of the index (#5446)
• docs(solutions): three-layer cache eviction runbook for the live product catalog (#5422)
• feat(content): receipts round — rewrite Palantir post, print the real scorecard, live radiation + tender records (#5443)
• Update blog post to 6 dashboards, fix variants count, and add Energy … (#5408)
• fix(seed-utils): retry transient Redis blips on the read path + skip-path meta ops (#5437) (#5438)
• fix(feed-digest): decode & last so RSS entities aren't decoded twice (#5432)
• fix(deps): clear sharp + fast-xml-parser high advisories redding audit-lockfile on all PRs (#5423) (#5424)
• fix(rss-proxy): remove dead rsshub.app from allowlists (#5414)
• fix(pricing): call out 'License / API key included' on the API Starter tier (#5419)
• feat(content): 13 blog posts — undocumented features (tenders, sanctions, aviation, radiation, energy dashboard…) + 'not Palantir' positioning (#5403)
• fix(deps): clear fresh high advisories redding audit-lockfile on all PRs (#5417) (#5418)
• fix(seed-research): isolate arXiv categories + retry + TTL so a single blip can't empty prod (#5409) (#5413)
• test(pro): critical-path budget guard for the committed /pro build (#5396) (#5397)
• test(rss-proxy): wire test file into CI, lock the SSRF/auth/rate-limit guards, fix relay www-tolerance (#5378) (#5399)
• chore(lint): appease biome 2.4.9's promoted rules across scripts/ (unblocks all PRs) (#5400)
• fix(analytics): swallow Umami beacon rejection leaking to Sentry (#5393)
• fix(deps): clear high-severity DoS advisories failing the security-audit gate (#5395)
• fix(mcp): make GET /mcp crawler-readable and fix the discovery cache key (#5382)
• docs(solutions): capture two reusable learnings from the KV cutover (#5338) (#5383)
• fix(auth): follow-up to #5369 — fix Infinity-exp test and reset leaked timeout (#5370)
• fix(checkout): retry transient create-checkout failures once with an Idempotency-Key (WORLDMONITOR-Q4) (#5374)
• fix(auth): adversarial sweep — resource exhaustion, boundary validation, test double contract (#5369)
• fix(sentry): suppress zero-frame 'Unexpected token' SyntaxErrors from injected scripts (#5367)
• fix(notifications): enforce Country Scope uniformly across all alert categories (#5359) (#5366)
• docs(solutions): seeder auxiliary Redis writes crash on Upstash timeout (#5365)
• fix(seed-utils): retry transient Redis failures in writeExtraKey / extendExistingTtl (#5364)
• docs(bootstrap): finalize U-K3 evidence with clean-24h confirmation (#5338) (#5363)
• docs(solutions): Sentry noise filtering with stack gating and signature matching (#5361)
• fix(sentry): suppress Clerk UI load failure and extension fetch-wrapper noise (#5360)
• feat(bootstrap): serve public tier from KV via the Worker (U-K4, #5338) (#5357)
• docs(solutions): desktop-CLS victim-vs-mover learning + panel-mount vocabulary (#5332) (#5356)
• i18n(it): complete Italian translation — translate remaining untransl… (#5349)
• test(dom): cover sanitizer and construction contracts (#5348)
• fix(seo): scope the Mintlify docs proxy to www + redirect prefix-less /api-reference/* (#5345) (#5347)
• feat(bootstrap): turn on the KV shadow measurement (U-K3 gate, #5338) (#5342)
• perf(cls): reserve grid slots for immediate-tier panels — shell the top-8 mounts (#5332) (#5344)
• feat(bootstrap): Workers KV serving path — publisher write + shadow measurement (U-K1, U-K2, #5338) (#5341)
• fix(brief): catch duration-led historical explainers (#5340)
• perf(bootstrap): record incumbent Redis latency (#5339)
• feat(cls): shift-time mover attribution — name what grew, not what moved (#5332) (#5336)
• fix(comtrade): restore HS preview classifier (#5337)
• fix(brief): exclude historical explainers (#5335)
• perf(cls): pin always-full panels to deterministic row heights (#5332) (#5333)
• fix(forecast): retire legacy infrastructure cascade forecasts (#5334)
• fix(bootstrap): preserve R2 RUM CORS headers at edge (#5331)
• docs(solutions): compound the #5300 lever-test learning + seed CONCEPTS.md (#5329)
• fix(bootstrap): preserve R2 origin RUM on Vercel (#5328)
• fix(forecast): present() observes 0 (not NaN) on absence — VOID-rate regression (#5327)
• fix(bootstrap): schedule R2 shadow work on Vercel (#5326)
• perf(bootstrap): prepare measured R2 origin rollout (#5325)
• fix(china): seed country index from ais relay (#5324)
• fix(news): audit China source coverage by locale (#5323)
• fix(health): detect vanished compact projections (#5322)
• perf(seeders): stop seeding float64 conversion noise into the market sparklines (#5300) (#5319)
• test(seeders): audit extraKey TTLs — and fix the wildfire projection it found (#5320)
• fix(china): keep country-index audit cache Railway-backed (#5318)
• test(seeders): ratchet the TTL-outlives-staleness invariant across the fleet (#5317)
• fix(forecasts): dashboard key shipped the 11.5MB seeder trace, not a projection (#5311) (#5315)
• fix(china): harden coverage audit contracts (#5314)
• feat(mcp): add procurement opportunities tool (#5312)
• perf(forecasts): serve the dashboard the forecast LIST, not the dossiers (#5300) (#5311)
• fix(china): complete coverage audit contract (#5313)
• perf(bootstrap): serve UCDP as a dashboard projection, not 2,000 raw events (#5300) (#5305)
• perf(bootstrap): stop shipping 17 tier keys no client reads (#5300) (#5308)
• fix(seeders): absorb a transient tender-source blip instead of raising a health warn (#5310)
• perf(bootstrap): serve thermal escalation as a dashboard-sized view, not the full watch (#5300) (#5303)
• perf(bootstrap): make cyberThreats an on-demand key instead of slow-tier freight (#5300) (#5302)
• fix(seeders): give the ACLED conflict key a TTL that outlives its staleness gate (#5309)
• perf(health): serve ?compact=1 from a compact verdict snapshot (#5300) (#5307)
• fix(forecast): give DeepSeek-Flash the routing its timeout always assumed (#5304)
• feat(china): add dedicated country summary (#5297)
• fix(natural): correct HKO health and cyclone wind fallback (#5298)
• docs(solutions): capture three verified learnings from the 2026-07-14 seeder/health session (#5306)
• feat(procurement): technology-relevance filtering and documented AusTender blocker (#5286) (#5299)
• fix(health): stop grading an unconfigured optional source as SEED_ERROR (#5295)
• feat(natural): add Pacific cyclone attribution (#5296)
• feat(china): add current macro and release calendar coverage (#5294)
• fix(sentry): close two beforeSend gaps re-surfacing known third-party noise (#5293)
• fix(railway): prevent skipped seeder deployments (#5292)
• fix(seeders): restore defense patents via USPTO ODP (#5284)
• fix(feeds): bypass Nature redirect loop (#5291)
• fix(seeders): stop seed-conflict-intel crash-looping when it has no usable source (#5256) (#5290)
• feat(china): add coverage health foundation (#5283)
• feat(china): deepen strategic trade and energy coverage (#5282)
• feat(china): deepen markets and server news coverage (#5281)
• feat(china): expand aviation and safe PLA identification (#5280)
• fix(seeders): declare papaparse + fast-xml-parser in scripts/package.json (#5266 regression) (#5289)
• fix(api): strip router-injected ?rpc= so public RPC URLs are CDN-shielded (#5285) (#5287)
• feat(procurement): add global tender intelligence (#5266)
• fix(e2e): tolerate detached smoke responses (#5267)
• fix(wildfire): package compactor with Railway seeder (#5270)
• fix(conflict): restore keyless GDELT fallback (#5269)
• fix(security): consolidate runtime hardening residuals (#5260)
• fix(seeders): fail retry when last-good keys are gone (#5258)
• perf(llm): cut DeepSeek Flash stall tail (#5257)
• perf(redis): shield residual dashboard read egress (#5263)
• perf(health): memoize Redis verdict sweep (#5262)
• docs: add Chinese README (#5265)
• fix(globe): guard OrbitControls against mixed mouse+touch pointer crashes (#5252)
• fix(health): measure list-typed data keys with LLEN, not STRLEN (#5254)
• fix(session): distinguish dead recovery reasons (#5253)
• perf(bootstrap): restore CDN cache shield for tier reads (#5249) (#5250)
• docs: fix inconsistent em dashes and real-time hyphenation (#5248)
• fix(sentry): skip client-synthesized session-degraded 503s (#5245) (#5247)
• feat(forecast): fast-resolving commodity price bets — Gate-1 accelerator (#5233) (#5243)
• fix(security): harden Turnstile client IP identity (#5241)
• fix(security): harden client-ip proof comparison (#5242)
• fix(seeders): extract dependency-free client-ip.ts so usage.ts stops pulling @upstash into seeder containers (#5231) (#5236)
• feat(forecast): bet-template engine + energy pilot (Phase 1, #5233) (#5238)
• feat(forecast): honesty bridges — real-skill Brier + funnel guardrail (Phase 0, #5233) (#5237)
• fix(telemetry): attribute usage to verified clients (#5229)
• fix(seo): advertise localized docs sitemap (#5226)
• fix(intelligence): cap deduct-situation LLM budget under edge ceiling (#5225)
• docs(i18n): expand Chinese SEO descriptions (#5223)
• fix(auth): suppress dead anonymous session retry storms (#5219)
• fix(security): harden webhook registration boundaries (#5218)
• docs(i18n): re-sync 87 zh-Hans pages to current English (#5215) (#5222)
• perf(mobile): split post-hydration long-task wave (#5220)
• fix(sentry): suppress h5player userscript frame-src CSP noise (#5221)
• docs: improve SEO titles and descriptions for zh translation (#5217)
• fix: repair broken links in zh translation (#5216)
• fix(rate-limit): isolate paid summarize callers (#5212)
• fix(boot): tolerate blocked browser storage (#5211)
• feat(docs): add Chinese (zh-Hans) translation at full parity (#5214)
• fix(convex): enforce Pro gate on notification channels (#5210)
• fix(cls): create #mapSection already collapsed for the collapsed-map cohort (#5159) (#5205)
• fix(build): co-locate ResilienceWidget into panels-intel chunk (#5203) (#5204)
• perf(map): gate overlay counter-scale var writes on real zoom change (#5080 slice 2) (#5202)
• docs: improve SEO titles for MCP apps and overview pages (#5200)
• feat(mcp-apps): expand interactive widget fleet 5 → 10 (#4956) (#5199)
• fix(risk): make canonical CII the only product source (#5197)
• fix(forecast): resolve judged entries from deadline evidence (#5196)
• fix(brief): reject truncated why-matters prose (#5184)
• docs: improve SEO title for license page (#5182)
• fix(brief): vary analyst why-matters prose (#5175)
• fix(docs): explain how to find and replace API keys (#5181)
• docs(legal): set UAE governing law, clarify refunds, ground operator in Dubai (#5180)
• docs: tighten SEO metadata on About, Privacy, and Terms pages (#5179)
• fix(homepage): point WIRED citation to the global wired.com edition (#5178)
• feat(docs): add About, Privacy, and Terms trust pages (#5177)
• fix: clarify IMF real GDP local-currency units (#4072)
• docs: fix typo and escape pipe in pipelines table (#5176)
• fix(welcome): drop dead Wikidata QID from homepage sameAs (#5174)
• perf(search): defer mobile sheet population past first paint (#5167)
• fix(a11y): restore Intel Feed tag contrast (#5172)
• perf(mobile): profile panel work and trim font precache (#5173)
• fix(cls): preserve collapsed map boot footprint (#5161)
• fix(welcome): support legacy root clearing (#5164)
• Fix Windows / CRLF compatibility and test suite bugs (#4358)
• feat(airlines): Add automated ICAO-IATA code generator script (#4309)
• ci(consumer-prices): run vitest suite (#5154)
• fix(convex): guard JSON object request bodies (#5156)
• fix(edge): allow longer enterprise wm_ keys through bot gate (#5155)
• docs: unescape HTML entities inside inline code spans (#5152)
• docs: tighten indicators & signals description under 160 chars (#5151)
• fix(docs): prevent internal plan publication drift (#5149)
• fix(matcher): don't treat missing category as an exact category match (#5139)
• fix(observability): filter Floot automation + DebugBear-wrapped fetch Sentry noise (#5143)
• fix(forecast): reclassify unrest count specs to judged (#5091) (#5142)
• fix: correct verb form "time out" in desktop-app doc (#5146)
• fix: repair broken links flagged by mint broken-links (#5144)
• docs: tighten SEO descriptions across 71 pages to 130-160 chars (#5145)
• chore(deps): bump actions/github-script from 7.0.1 to 9.0.0 (#5122)
• chore(deps): bump actions/setup-go from 5.6.0 to 6.5.0 (#5118)
• fix(seed): time-box seed-conflict-intel GDELT fallback sweep to fit the fetch deadline (#5140) (#5141)
• chore(deps): bump actions/checkout from 4.3.1 to 6.0.3 (#5121)
• chore(deps): bump docker/build-push-action from 7.0.0 to 7.2.0 (#5120)
• chore(deps): bump node in /consumer-prices-core (#5117)
• perf(cls): take cached-mode banner out of flow to stop column shove (#4580) (#5137)
• fix(forecast): reclassify conflict/ucdp_zone count specs to judged (#5136) (#5138)
• fix(forecast): fall back to GDELT for conflict events when ACLED creds absent (#5099) (#5134)
• perf(cls): pin mobile boot skeleton to the real map footprint (#4580) (#5133)
• perf(observability): sample field web-vital telemetry to cut Sentry volume ~80% (#5132)
• perf(lcp): paint cached World Brief at panel construction (#4890) (#5130)
• fix(dashboard): stabilize CLS-prone deep-dive motion (#5124)
• fix(lcp): tag field LCP element selector (#5123)
• fix(forecast): harden simulation keyword matching (#5128)
• test(forecast): lock ACLED health visibility (#5127)
• chore(perf-tooling): harden render-axis interaction traces (#5125)
• fix(seed): don't crash seed-conflict-intel when ACLED creds are absent (#5126)
• fix(pro): collect DebugBear RUM on marketing pages (#5116)
• fix(forecast): calibrate detector probabilities (#5107)
• test(forecast): tighten simulation selection assertions (#5112)
• fix(forecast): surface silent forecast input feed gaps (#5109)
• fix(dashboard): reduce mobile map tap presentation work (#5111)
• fix(forecast): guard market calibration anchors (#5105)
• fix(forecast): fail ACLED seed when primary feed is unavailable (#5106)
• fix(forecast): harden theater simulation gating (#5108)
• fix(sentry): suppress Firefox host-suffixed NetworkError for DebugBear RUM beacon (#5110)
• fix(forecast): enforce hard resolution publish coverage (#5096)
• fix(forecast): restore FRED macro signals (#5104)
• fix(frontend): harden dashboard lazy loading and metadata (#5089)
• feat(api): IETF RateLimit headers + verifiable signed webhook sample (orank Usability) (#5095)
• perf(dashboard): add mobile tap render-axis tracing (#5088)
• fix(rum): wire lcp web-vitals reporting (#5090)
• fix(forecast): resolve judged forecast outcomes (#5087)
• fix(forecast): use ACLED resolution feeds for hard counts (#5085)
• perf(edge): cache apex→www 301 + point published human links at www (#5081) (#5086)
• fix(api): cool down Finnhub symbol-search 429s (#5082)
• perf(wildfire): cap dashboard fire payload (#5083)
• fix(relay): stop double-TLS wrapping OpenSky proxy fetches (#5074) (#5084)
• Fix forecast hard resolution coverage (#5072)
• fix(seeders): don't crash a bundle when a member fails gracefully (#5077) (#5078)
• perf(forecast): prune archived terminal entries from the resolution ledger (#5067) (#5073)
• Fix SPA lifecycle recovery (#5064)
• Fix seeder health metadata drift (#5071)
• fix(aviation): avoid caching unavailable flight data (#5070)
• Fix RPC no-store cache contract (#5068)
• Harden Convex entitlement lifecycle races (#5065)
• test(news): stabilize completeness selection attribution fixture (#5069)
• Fix container healthchecks: IPv6/localhost + auth-gated probe path (#5051)
• fix(forecast): avoid stale UCDP count resolutions (#5063)
• fix(docker): keyless healthcheck + wire UCDP_ACCESS_TOKEN into ais-relay env (#5052)
• perf(map): cut INP input-delay — guard rebuild loops, throttle hover query, yield-schedule heavy commit (#5042) (#5045)
• perf(dashboard/INP): route flashLocation through the base-map geometry cache (#5049) (#5050)
• fix(checkout): quiet active subscription blocks (#5048)
• feat(corpus): make chokepoint/country pages useful + deep-link into the live map (#5044)
• feat(billing): self-serve Starter→Business API upgrade (#4634) (#4672)
• feat(api): add plan limit notification lifecycle (#4648)
• fix(news): keep digest cold builds under edge timeout (#5047)
• perf(onboarding): defer mission-preset auto-open to idle after paint (#5046)
• feat(content): add crawlable static corpus (#5041)
• fix(digest): prefix story-track reads in previews (#5040)
• docs(mcp): document endpoint exposure workflow (#5039)
• feat(agent-skills): expand catalog with tranche 4 recipes (#5033)
• feat(mcp-apps): interactive dashboard fleet — 4 new ui:// widgets (#4959) (#5035)
• perf(map): skip zoom-hidden SVG marker DOM (#5036)
• fix(seed-economy): bound FRED fetch concurrency under the 240s deadline (#5037) (#5038)
• Harden watchlist notification follow-ups (#5034)
• fix(payments): pace dunning Resend sends under the 10 req/s limit (#5032)
• feat(markets): ticker tagging at ingest, market-hours awareness, watchlist story alerts (#4922) (#5031)
• perf(pro): keep signal bars animation off layout (#5028)
• fix(pipeline): harden AIS relay Upstash detection, mask Redis creds, add EVALSHA-free rate-limit fallback (#5025)
• feat(forecast): add resolution ledger and scorecard (#5024)
• fix(notifications): fail open on dedup SETNX errors (#5026)
• fix(forecast): harden simulation outcome writes (#5027)
• perf(pro): split @sentry into its own cacheable chunk (#5019) (#5020)
• perf(map): route boot-path container geometry through the resize cache (#5017) (#5022)
• chore(aeo): brand-named developer-resource discoverability pages (#5023)
• chore(perf): remove stale protomaps.github.io dns-prefetch (#5016) (#5021)
• perf(pages): immutable /pro asset caching, lazy preview + on-demand Turnstile, WebP blog covers (#5013) (#5015)
• feat(agents): Web Bot Auth key directory + /agent/auth WWW-Authenticate challenge (orank) (#5009)
• fix(forecast): resolution-spec emission amendment — horizon-commensurable count + resolvable supply/gps windows (#5010) (#5012)
• fix(health): no-store on the compact status response so uptime monitors never read a stale verdict (#5008)
• feat(forecast): resolvability contract — machine-checkable resolution spec per forecast (#4976) (#5004)
• fix(forecast): reserve run-budget for the full provider chain so market_implications' groq fallback isn't stranded (#4978 follow-up) (#5003)
• feat(content): free-vs-paid comparison post + fix never-firing FAQPage JSON-LD (#4998, #5001) (#5002)
• fix(seo): self-canonicalize variant subdomain dashboards + canonical Link headers for sitemap .md pages (#4996, #4999) (#5000)
• fix(seo): restore WIRED/2M+ meta description — sync VARIANT_META.full with hand-tuned index.html + drift guard (#5005) (#5006)
• fix(seed-bigmac): parallelize 50-country EXA loop to stop 240s-deadline crashes (#4994) (#4995)
• feat(llm): never serve OpenRouter inference from China-hosted providers (#4993)
• fix(payments): reconcile missed Dodo renewals (#4794)
• fix(portwatch): prioritize never-cached countries in the cold-fetch cap so coverage reaches 174 (health COVERAGE_PARTIAL) (#4992)
• perf(brief): route whyMatters to deepseek-v4-flash, decouple from the reasoning tier (#4983 follow-up) (#4991)
• feat(payments): reconcile stuck pending payments (#4795)
• fix(fred): pipeline batch seed reads (#4989)
• fix(notifications): coalesce repeated alert events (#4985)
• fix(gpsjam): restore the free gpsjam.org source, retire the Wingbits quota dependency (#4987)
• feat(iran-events): flag-gate the whole Iran-events domain, default OFF (war-ended sunset) (#4982)
• fix(middleware): stop bot-gating /favico/* — public brand assets must be world-readable (#4988)
• fix(llm): reasoning-off for short brief stages — v4-pro empty-content 80% (#4983) (#4984)
• fix(forecast): stop false SEED_ERROR when market_implications is starved of the shared LLM run budget (#4978) (#4980)
• fix(widget): persist Pro widget HTML across reloads (#4981)
• docs(mcp): mcp-remote bridge setup + Cloudflare apex-redirect exemption contract (#4951)
• fix(llm): pin regions on the two unpinned LLM edge routes + log provider error bodies (#4944 U7) (#4966)
• feat(llm): core chain to OpenRouter DeepSeek V4 Flash + output-shape hardening (#4944 U1+U2) (#4950)
• feat(llm): seeder narrative tiers to DeepSeek V4 Flash; pin probability-coupled critical_signals (#4944 U6) (#4977)
• feat(telemetry): llm_call events for the telemetry-dark seeder transports (#4944 U5) (#4954)
• fix(pricing): remove the phantom "XLSX exports" claim from API Business (#4974) (#4975)
• fix(forecast): stable semantic-slot ids for military and state-derived forecasts (#4933) (#4973)
• feat(pricing): publish the API Business tier — visible, priced, self-serve (#4945) (#4946)
• feat(analytics): restore Umami on canonical www host + end-to-end checkout funnel events (#4931) (#4934)
• feat(billing): dunning + winback email lifecycle for failed payments and cancellations (#4932) (#4935)
• fix(forecast): non-finite probability guards — NaN can no longer enter or anchor the probability spine (#4933) (#4969)
• fix(feeds): allowlist war.gov + thenationalnews.com + trumpstruth.org — unblock feed-health activation (#4970) (#4971)
• feat(ux): persistent read-state — NEW tags survive reload (#4923, slice a) (#4926)
• feat(markets): macro-print actuals, earnings in the daily brief, finance-demotion seam (#4922) (#4929)
• feat(brief): the brief contract — top-8 synthesis, verified citations, enforce-mode gate, shared grounding spine (#4921) (#4928)
• feat(news): completeness measurement — feed health w/ silent zeros, coverage ledger + provenance, GDELT recall benchmark (#4920) (#4927)
• feat(news): unified story-identity service — one similarity definition for clustering, dedup, corroboration (#4919) (#4924)
• fix(forecast): word-boundary term matching — stop substring country false positives corrupting probabilities (#4933) (#4939)
• feat(content): global-intelligence glossary — 20 crawlable DefinedTerm pages (#4960) (#4968)
• feat(agent-readiness): advertise the live docs MCP server + real /agent.txt (#4958) (#4964)
• feat(agent-readiness): three-tier AI-crawler policy in robots.txt + real /agents.md (#4952) (#4955)
• fix(sentry): CSP noise filters — Doubao KaTeX fonts, injected Google Fonts CSS, content-filter frame vendors (#4942) (#4943)
• feat(ci): live MCP smoke — 6-hourly anonymous strict-client walk of prod (apex+www) — #4937/#4938 regression net (#4941)
• fix(mcp): serve ping + prompts/* + logging/setLevel anonymously — gated 401 hangs Claude Desktop via mcp-remote (#4937) (#4940)
• chore(digest): reuse prior envelope prose on non-due compose ticks (#4917) (#4918)
• chore(llm): cache-identity churn batch 2 — summary pair-dedup v7, market-brief context quantization, forecast prompt-hash cache, whyMatters v8 cross-read (#4914) (#4916)
• fix(summarization): entitlement-gate the summarize provider chain — stop the anon 401 flood + 3x fan-out (#4913) (#4915)
• chore(llm): regional hygiene — narrative prompt-hash cache + brief retry-budget cap (#4911)
• fix(health-freshness): revalidate every poll — CF browser-TTL rewrite would oscillate synthesized-OK sources to stale (#4910) (#4912)
• chore(digest): flip BRIEF_WHY_MATTERS_SHADOW to opt-in — default-on doubled gemini spend (#4909)
• perf(health): collapse health polling cost — CDN-cache compact health, 5-min cadence, idle-deferred first hydration (#4907) (#4908)
• feat(observability): emit llm_call events from callForecastLLM — the seeder path #4901 missed (#4906)
• fix(health-freshness): read the keyless compact health endpoint — stop the anon 401-per-minute flood (#4902) (#4905)
• fix(intelligence): stop ISO stopword-codes (IN/US/AT/NO) over-matching shared brief grounding (#4904)
• perf(CLS): attribute field shift classes — hiddenAtLoad/scrollY/viewport env on CLS reports (#4580) (#4903)
• feat(observability): emit llm_call usage events from every server-side LLM path (#4901)
• perf(forecasts): input-hash cache guard for the market_implications LLM stage (#4900)
• perf(pwa): keep blog OG covers out of the dashboard SW precache (#4891) (#4899)
• fix(intelligence): share the anon country-brief cache per country+lang — stop hashing caller context into the key (#4898)
• perf(map): time-box marker pulse animations — settle to static after 6s (#4669) (#4897)

Full Changelog: sdk/go/v0.1.1...v2.10.0

What's Changed

• fix(world-clock): make drag handles always visible (#715)
• fix(world-clock): merge duplicate .wc-row CSS rules (#714)
• feat(world-clock): add drag-to-reorder city rows (#712)
• fix(csp): allow localhost in media-src for proxied HLS & remove CNN HLS (#711)
• fix(panel): redesign World Clock with proper layout and working settings (#710)
• fix(desktop): resolve sidecar 401s, variant lock, and registration form (#v2.5.23) (#709)
• fix(panel): live news fullscreen now renders above all UI elements (#708)
• Add Czech (cs) translation (#701)
• chore: bump version to 2.5.22 & comprehensive README update (#706)
• feat(panel): add World Clock panel with live financial city times (#705)
• fix(i18n): add 12 missing translation keys across all 18 locales (#703)
• fix(sentry): add noise filters for 7 unresolved issues (#698)
• feat(feeds): reduce default-enabled sources & add locale-aware boost (#699)
• fix(oref): sanitize Hebrew Unicode control chars for reliable translation (#694)
• fix(live-news): remove LiveNOW from FOX channel (YouTube error 150) (#693)
• feat(i18n): backfill missing translations for 17 locales (#692)
• fix(web): improve mobile responsiveness — collapsible map, panel sizing, font bump (#688)
• feat(live-news): add Fox News HLS stream & fullscreen toggle (#689)
• feat(breaking-news): click banner to scroll to source panel (#690)
• feat(i18n): add 104 missing translation keys for Italian and Spanish (#687)
• fix(pwa): stop auto-reload on service worker update (#686)
• perf(web): lazy-load DeductionPanel to exclude dompurify from web bundle (#685)
• feat(feeds): add Asharq News & Business to Middle East (#683)
• feat(live-news): add CNN & CNBC HLS streams via sidecar proxy (#682)
• fix(sentry): triage 10 unresolved issues — 2 code fixes + 8 noise filters (#681)
• feat: implement deduct situation feature (#636) (#642)
• feat(rag): worker-side vector store with opt-in Headline Memory (#675)
• fix(country-intel): align strike/aviation matching with CII bounds fallback (#677)
• feat(settings): badge pulse animation with settings toggle (#676)
• feat: persist OREF history to Redis + retry bootstrap (#674)
• fix(market): replace dead Yahoo Finance Gulf index tickers (#672)
• feat(market): add Gulf Economies panel with GCC indices, currencies & oil (#667)
• fix(ci): strip bundled GPU/Wayland libs from AppImage to fix black screen on non-Ubuntu distros (#666)
• fix(map): stabilize deck.gl layer IDs to prevent interleaved-mode null crash (#664)
• ui(investments): redesign panel with card layout and collapsible filters (#663)
• feat(oref): add 1,478 Hebrew→English location translations + wire sirens into breaking news banner (#661)
• feat: expand live channels with HLS support, Oceania region, and YouTube fallbacks (#660)
• feat(api): add cache-purge edge function for admin Redis cache invalidation (#657)
• fix(oref): add static Hebrew→English translations for common alert types (#655)
• fix(finance): restore 6 missing news categories + add finance favicons (#654)
• fix(oref): grab newest history records and preserve bootstrap data (#653)
• fix(server): cache hardening across 27 RPC handlers (#651)
• feat: add Oman Observer and NDTV feeds + NDTV live TV (#650)
• perf(map): optimize DeckGLMap pan/zoom by deferring work off hot path (#620)
• fix(oref): show history count in badge and stop swallowing fetch errors (#648)
• feat: add Redis caching for GPS jamming data (#646)
• fix: remove accidental intelhq submodule entry (#640)
• Cost/traffic hardening, runtime fallback controls, and PostHog removal (#638)
• fix(desktop): route register-interest to cloud when sidecar lacks CONVEX_URL (#639)
• fix(sentry): null guards for classList teardown crashes + noise filters + regex fix (#637)
• fix(desktop): backoff on errors to stop CPU abuse + shrink settings window (#633)
• fix(linux): sanitize env for xdg-open in AppImage (#631)
• fix(sidecar): add AVIATIONSTACK_API and ICAO_API_KEY to env allowlist (#632)
• fix(military): narrow ICAO hex ranges to stop civilian false positives (#627)
• chore(cache): bump all sub-5min cache TTLs and polling intervals (#626)
• fix(map): sync layer toggles to URL for shareable links (#576) (#621)
• feat(rss): add conditional GET (ETag/If-Modified-Since) to Railway relay (#625)
• feat(news): server-side feed aggregation to reduce edge invocations by ~95% (#622)
• fix(aviation): prevent AviationStack API quota blowout (#623)
• fix(sentry): guard pauseVideo optional chaining + add 4 noise filters (#624)
• feat(map): native mobile map experience with location detection and full feature parity (#619)
• feat(oref): show history waves timeline with translation and NaN fix (#618)
• fix(aviation): increase cache TTL from 30min to 2h to reduce API quota usage (#617)
• docs(changelog): add v2.5.21 entry covering 86 merged PRs (#616)
• fix(api): harden cache-control headers for polymarket and rss-proxy (#613)
• perf(rss): raise news refresh interval to 10min and cache TTL to 20min (#612)
• Expand country brief and CII signal coverage (#611)
• fix(docs): add blank lines after CHANGELOG headings for markdownlint (#608)
• fix: RT channel HLS-only recovery, test shim, and LiveNOW fallback (#610)
• fix(relay): increase OREF curl maxBuffer to prevent ENOBUFS (#609)
• fix(aviation): invalidate stale IndexedDB cache + reduce CDN TTL (#607)
• chore: bump version to 2.5.21 (#605)
• docs(readme): comprehensive update for Telegram, OREF, GPS jamming, airports, and more (#606)
• fix(webcams): fix broken live news channels — eNCA handle, remove VTC NOW, fix CTI News (#604)
• fix(aviation): always show all monitored airports on flight delays map (#603)
• fix(sentry): guard YT player methods + filter GM/InvalidState noise (#602)
• chore(telegram): update channel list — remove nexta_live, air_alert_ua; add wfwitness (#600)
• fix(aviation): route NOTAM through relay + improve intl logging (#599)
• fix(webcams): add 4th Iran Attacks feed to fill 2x2 grid (#601)
• fix(polymarket): add queue backpressure and response limit slicing (#593)
• fix(relay): stop Polymarket cache stampede from concurrent limit + CDN bypass (#592)
• fix(aviation): replace broken lock mechanism with direct cache, add cancellation tiers (#591)
• fix(telegram): add missing relay auth headers to telegram-feed edge function (#590)
• feat(live-news): add RT channel via HLS + enable HLS on web (#586)
• feat(feeds): add RT (Russia Today) RSS feeds (#585)
• fix(relay): delay Telegram connect 60s on startup to prevent AUTH_KEY_DUPLICATED (#587)
• feat(risk): wire theater posture + breaking news into strategic risk score (#584)
• feat(aviation): add NOTAM closure detection via ICAO API (#583)
• feat: add GPS/GNSS jamming map layer + CII integration (#570)
• feat(aviation): add comprehensive logging to flight delay pipeline (#581)
• feat(relay): bootstrap OREF 24h history on startup (#582)
• fix(sentry): guard setView against invalid preset + filter translateNotifyError (#580)
• feat(cii): hook security advisories into CII scoring & country briefs (#579)
• fix(relay): add timeouts and logging to Telegram poll loop (#578)
• fix(webcams): replace duplicate Tehran feed with Tel Aviv, rename Iran tab (#572)
• fix(relay): replace nixpacks.toml with railpack.json for curl (#571)
• feat(webcams): add Iran tab to live webcams panel (#569)
• fix(relay): increase Polymarket cache TTL to 10 minutes (#568)
• fix(relay): install curl in Railway container for OREF polling (#567)
• fix(relay): upstreamWs → upstreamSocket in graceful shutdown (#565)
• fix(cii): resolve Gulf country strike misattribution via multi-match bbox disambiguation (#564)
• fix(relay): replace smart quotes crashing relay on startup (#563)
• fix(aviation): query all airports instead of rotating batch (#557)
• fix(relay): add graceful shutdown + poll concurrency guard for Telegram (#562)
• feat(cii): wire OREF sirens into CII score & country brief (#559)
• fix(sentry): add noise filters and fix beforeSend null-filename leak (#561)
• fix(live-news): annotate empty catches and sanitize error output (#560)
• fix(i18n): rename OREF Sirens panel to Israel Sirens (#556)
• fix(live-news): align YouTube edge function with relay auth pattern (#555)
• fix(live-news): use correct relay auth header for YouTube proxy (#554)
• feat(settings): add AVIATIONSTACK_API to desktop settings page (#553)
• feat(live-news): move YouTube proxy scraping to Railway relay
• feat(aviation): integrate AviationStack API for non-US airport delays (#552)
• fix(live-news): lazy-load node modules + proxy fallback to direct fetch
• fix(live-news): set explicit runtime: 'nodejs' for proxy support
• debug(live-news): add debug param to diagnose proxy env var on Vercel
• feat(live-news): add residential proxy + gzip decompression for YouTube detection (#551)
• feat(telegram): add Telegram Intel panel (#550)
• feat(conflict): enhance Iran events popup with severity badge and related events (#549)
• fix(alerts): add compound escalation for military action + geopolitical target (#548)
• feat(cii): integrate Iran strike events into CII scoring, country brief & timeline (#547)
• gave the user freedom to resize panels "fixes issue #426" (#489)
• fix(relay): use execFileSync for OREF curl to avoid shell injection (#546)
• feat(oref): add OREF sirens panel with Hebrew-to-English translation (#545)
• fix(live-news): fix broken Europe channel handles + add fallback video IDs (#541)
• fix(telegram): latch AUTH_KEY_DUPLICATED to stop retry spam (#543)
• fix(telegram): fix ESM import path in session-auth script (#542)
• fix(iran): bump CDN cache-bust to v4 for fresh event data (#544)
• fix(live-news): add fallback video ID for LiveNOW from FOX channel (#538)
• fix(relay): auto-reconnect on Telegram AUTH_KEY_DUPLICATED and fix IranIntl handle (#539)
• feat: add day/night solar terminator overlay to map (#529)
• Revert "Revert "fix(relay): fix telegram ESM import path and broaden latch regex"" (#537)
• Revert "fix(relay): fix telegram ESM import path and broaden latch regex"
• fix(ui): move download banner to bottom-right (#536)
• fix(relay): fix telegram ESM import path and broaden latch regex
• fix(live-news): replace 7 stale YouTube fallback video IDs (#535)
• fix(relay): Telegram + OOM + memory cleanup (#531)
• fix(alerts): remove SESSION_START gate that blocked pre-existing breaking news (#533)
• fix(iran): bust CDN cache to serve updated Gulf-geocoded events (#532)
• fix(geo): expand geo hub index with 60+ missing world locations (#528)
• feat(map): prioritize Iran Attacks layer (#527)
• fix(relay): block rsshub.app requests with 410 Gone (#526)
• fix(focal-points): attribute theater military activity to target nations (#525)
• fix(iran): bypass stale CDN cache for iran-events endpoint (#524)
• fix(relay): regenerate package-lock.json with telegram dependency (#522)
• fix(breaking-news): fill keyword gaps missing real Iran attack headlines (#521)
• fix(relay): add POLYMARKET_ENABLED env flag kill switch (#523)
• Revert "fix(relay): regenerate package-lock.json with telegram dependency"
• chore: trigger deploy to flush CDN cache for iran-events endpoint
• fix(relay): regenerate package-lock.json with telegram dependency
• fix(threat-classifier): stagger AI classification requests to avoid Groq 429 (#520)
• fix(relay): Polymarket circuit breaker + concurrency limiter (OOM fix) (#519)
• fix: make iran-events handler read-only from Redis (#518)
• fix(breaking-news): fix fake pubDate fallback and filter noisy think-tank alerts (#517)
• fix(rate-limit): increase sliding window to 300 req/min (#515)
• fix(breaking-news): let critical alerts bypass global cooldown and replace HIGH alerts (#516)
• fix(threat-classifier): add military/conflict keyword gaps and news-to-conflict bridge (#514)
• fix(relay): prevent Polymarket OOM via request deduplication (#513)
• fix: resolve bootstrap 401 and 429 rate limiting on page init (#512)
• feat(conflict): add Iran Attacks map layer + strip debug logs (#511)
• chore: add validated telegram channels list (global + ME + Iran + cyber) (#249)
• fix(sentry): filter Android OEM WebView bridge injection errors (#510)
• feat(breaking-news): add active alert banner with audio for critical/high RSS items (#508)
• fix(relay): guard proxy handlers against ERR_HTTP_HEADERS_SENT crash (#509)
• fix(prediction): filter stale/expired markets from Polymarket panel (#507)
• fix: generalize Vercel preview origin regex + include filters in bases cache key (#506)
• chore: strip 61 debug console.log calls from 20 service files (#501)
• fix(geo): tokenization-based keyword matching to prevent false positives (#503)
• fix(bootstrap): harden hydration cache + polling review fixes (#504)
• feat(live-news): add CBC News to optional North America channels (#502)
• fix: use cross-env for Windows-compatible npm scripts (#499)
• fix(cyber): make GeoIP centroid fallback jitter deterministic (#498)
• perf(military): debounce base fetches + upgrade edge cache to static tier (#497)
• feat(military): server-side military bases 125K + rate limiting (#496)
• perf: bootstrap endpoint + polling optimization (#495)
• feat(rss): add Axios (api.axios.com/feed) as US news source (#494)
• feat: add Polish tv livestreams (#488)
• feat(i18n): add Korean (한국어) localization (#487)
• fix(rss): remove stale indianewsnetwork.com from proxy allowlist (#486)
• chore: bump version to 2.5.20 + changelog
• feat(gateway): complete edge cache tier coverage + degraded-response policy (#484)
• fix(markets): commodities panel showing stocks instead of commodities (#483)
• perf(proxy): increase AIS snapshot edge TTL from 2s to 10s (#482)
• fix(analytics): use greedy regex in PostHog ingest rewrites (#481)
• feat: configurable VITE_WS_API_URL + harden POST→GET shim (#480)
• fix(sentry): add noise filters for 4 unresolved issues (#479)
• feat(proxy): add Cloudflare edge caching for proxy.worldmonitor.app (#478)
• fix(gateway): convert stale POST requests to GET for backwards compat (#477)
• fix(desktop): enable click-to-play YouTube embeds + CISA feed fixes (#476)
• fix(tech): use rss() for CISA feed, drop build from pre-push hook (#475)
• feat(cache): tiered edge Cache-Control aligned to upstream TTLs (#474)
• fix(security-advisories): route feeds through RSS proxy to avoid CORS blocks (#473)
• fix: move 5 path-param endpoints to query params for Vercel routing (#472)
• fix(beta): eagerly load T5-small model when beta mode is enabled
• feat: add Cloudflare edge caching infrastructure for api.worldmonitor.app (#471)
• feat: convert 52 API endpoints from POST to GET for edge caching (#468)
• feat(cache): add negative-result caching to cachedFetchJson (#466)
• Add Security Advisories panel with government travel alerts (#460)
• feat(settings): redesign settings window with VS Code-style sidebar layout (#461)
• fix(scripts): handle escaped apostrophes in feed name regex (#455)
• fix(wingbits): add 5-minute backoff on Wingbits /v1/flights failures (#459)
• fix(ollama): strip thinking tokens, raise max_tokens, fix panel summary cache (#456)
• fix+feat: RSS feed repairs, HLS native playback, summarization cache fix, embed improvements (#452)

Full Changelog: v2.5.19...v2.5.23

What's Changed

• feat(map): native mobile map experience with location detection and full feature parity (#619)
• feat(oref): show history waves timeline with translation and NaN fix (#618)
• fix(aviation): increase cache TTL from 30min to 2h to reduce API quota usage (#617)
• docs(changelog): add v2.5.21 entry covering 86 merged PRs (#616)
• fix(api): harden cache-control headers for polymarket and rss-proxy (#613)
• perf(rss): raise news refresh interval to 10min and cache TTL to 20min (#612)
• Expand country brief and CII signal coverage (#611)
• fix(docs): add blank lines after CHANGELOG headings for markdownlint (#608)
• fix: RT channel HLS-only recovery, test shim, and LiveNOW fallback (#610)
• fix(relay): increase OREF curl maxBuffer to prevent ENOBUFS (#609)
• fix(aviation): invalidate stale IndexedDB cache + reduce CDN TTL (#607)
• chore: bump version to 2.5.21 (#605)
• docs(readme): comprehensive update for Telegram, OREF, GPS jamming, airports, and more (#606)
• fix(webcams): fix broken live news channels — eNCA handle, remove VTC NOW, fix CTI News (#604)
• fix(aviation): always show all monitored airports on flight delays map (#603)
• fix(sentry): guard YT player methods + filter GM/InvalidState noise (#602)
• chore(telegram): update channel list — remove nexta_live, air_alert_ua; add wfwitness (#600)
• fix(aviation): route NOTAM through relay + improve intl logging (#599)
• fix(webcams): add 4th Iran Attacks feed to fill 2x2 grid (#601)
• fix(polymarket): add queue backpressure and response limit slicing (#593)
• fix(relay): stop Polymarket cache stampede from concurrent limit + CDN bypass (#592)
• fix(aviation): replace broken lock mechanism with direct cache, add cancellation tiers (#591)
• fix(telegram): add missing relay auth headers to telegram-feed edge function (#590)
• feat(live-news): add RT channel via HLS + enable HLS on web (#586)
• feat(feeds): add RT (Russia Today) RSS feeds (#585)
• fix(relay): delay Telegram connect 60s on startup to prevent AUTH_KEY_DUPLICATED (#587)
• feat(risk): wire theater posture + breaking news into strategic risk score (#584)
• feat(aviation): add NOTAM closure detection via ICAO API (#583)
• feat: add GPS/GNSS jamming map layer + CII integration (#570)
• feat(aviation): add comprehensive logging to flight delay pipeline (#581)
• feat(relay): bootstrap OREF 24h history on startup (#582)
• fix(sentry): guard setView against invalid preset + filter translateNotifyError (#580)
• feat(cii): hook security advisories into CII scoring & country briefs (#579)
• fix(relay): add timeouts and logging to Telegram poll loop (#578)
• feat(scripts): add Iran events seed script and latest data (#575)
• fix(webcams): replace duplicate Tehran feed with Tel Aviv, rename Iran tab (#572)
• fix(relay): replace nixpacks.toml with railpack.json for curl (#571)
• feat(webcams): add Iran tab to live webcams panel (#569)
• fix(relay): increase Polymarket cache TTL to 10 minutes (#568)
• fix(relay): install curl in Railway container for OREF polling (#567)
• fix(relay): upstreamWs → upstreamSocket in graceful shutdown (#565)
• fix(cii): resolve Gulf country strike misattribution via multi-match bbox disambiguation (#564)
• fix(relay): replace smart quotes crashing relay on startup (#563)
• fix(aviation): query all airports instead of rotating batch (#557)
• fix(relay): add graceful shutdown + poll concurrency guard for Telegram (#562)
• feat(cii): wire OREF sirens into CII score & country brief (#559)
• fix(sentry): add noise filters and fix beforeSend null-filename leak (#561)
• fix(live-news): annotate empty catches and sanitize error output (#560)
• fix(i18n): rename OREF Sirens panel to Israel Sirens (#556)
• fix(live-news): align YouTube edge function with relay auth pattern (#555)
• fix(live-news): use correct relay auth header for YouTube proxy (#554)
• feat(settings): add AVIATIONSTACK_API to desktop settings page (#553)
• feat(live-news): move YouTube proxy scraping to Railway relay
• feat(aviation): integrate AviationStack API for non-US airport delays (#552)
• fix(live-news): lazy-load node modules + proxy fallback to direct fetch
• fix(live-news): set explicit runtime: 'nodejs' for proxy support
• debug(live-news): add debug param to diagnose proxy env var on Vercel
• feat(live-news): add residential proxy + gzip decompression for YouTube detection (#551)
• feat(telegram): add Telegram Intel panel (#550)
• feat(conflict): enhance Iran events popup with severity badge and related events (#549)
• fix(alerts): add compound escalation for military action + geopolitical target (#548)
• feat(cii): integrate Iran strike events into CII scoring, country brief & timeline (#547)
• gave the user freedom to resize panels "fixes issue #426" (#489)
• fix(relay): use execFileSync for OREF curl to avoid shell injection (#546)
• feat(oref): add OREF sirens panel with Hebrew-to-English translation (#545)
• fix(live-news): fix broken Europe channel handles + add fallback video IDs (#541)
• fix(telegram): latch AUTH_KEY_DUPLICATED to stop retry spam (#543)
• fix(telegram): fix ESM import path in session-auth script (#542)
• fix(iran): bump CDN cache-bust to v4 for fresh event data (#544)
• fix(live-news): add fallback video ID for LiveNOW from FOX channel (#538)
• fix(relay): auto-reconnect on Telegram AUTH_KEY_DUPLICATED and fix IranIntl handle (#539)
• feat: add day/night solar terminator overlay to map (#529)
• Revert "Revert "fix(relay): fix telegram ESM import path and broaden latch regex"" (#537)
• Revert "fix(relay): fix telegram ESM import path and broaden latch regex"
• fix(ui): move download banner to bottom-right (#536)
• fix(relay): fix telegram ESM import path and broaden latch regex
• fix(live-news): replace 7 stale YouTube fallback video IDs (#535)
• fix(relay): Telegram + OOM + memory cleanup (#531)
• fix(alerts): remove SESSION_START gate that blocked pre-existing breaking news (#533)
• fix(iran): bust CDN cache to serve updated Gulf-geocoded events (#532)
• fix(geo): expand geo hub index with 60+ missing world locations (#528)
• feat(map): prioritize Iran Attacks layer (#527)
• fix(relay): block rsshub.app requests with 410 Gone (#526)
• fix(focal-points): attribute theater military activity to target nations (#525)
• fix(iran): bypass stale CDN cache for iran-events endpoint (#524)
• fix(relay): regenerate package-lock.json with telegram dependency (#522)
• fix(breaking-news): fill keyword gaps missing real Iran attack headlines (#521)
• fix(relay): add POLYMARKET_ENABLED env flag kill switch (#523)
• Revert "fix(relay): regenerate package-lock.json with telegram dependency"
• chore: trigger deploy to flush CDN cache for iran-events endpoint
• fix(relay): regenerate package-lock.json with telegram dependency
• fix(threat-classifier): stagger AI classification requests to avoid Groq 429 (#520)
• fix(relay): Polymarket circuit breaker + concurrency limiter (OOM fix) (#519)
• fix: make iran-events handler read-only from Redis (#518)
• fix(breaking-news): fix fake pubDate fallback and filter noisy think-tank alerts (#517)
• fix(rate-limit): increase sliding window to 300 req/min (#515)
• fix(breaking-news): let critical alerts bypass global cooldown and replace HIGH alerts (#516)
• fix(threat-classifier): add military/conflict keyword gaps and news-to-conflict bridge (#514)
• fix(relay): prevent Polymarket OOM via request deduplication (#513)
• fix: resolve bootstrap 401 and 429 rate limiting on page init (#512)
• feat(conflict): add Iran Attacks map layer + strip debug logs (#511)
• chore: add validated telegram channels list (global + ME + Iran + cyber) (#249)
• fix(sentry): filter Android OEM WebView bridge injection errors (#510)
• feat(breaking-news): add active alert banner with audio for critical/high RSS items (#508)
• fix(relay): guard proxy handlers against ERR_HTTP_HEADERS_SENT crash (#509)
• fix(prediction): filter stale/expired markets from Polymarket panel (#507)
• fix: generalize Vercel preview origin regex + include filters in bases cache key (#506)
• chore: strip 61 debug console.log calls from 20 service files (#501)
• fix(geo): tokenization-based keyword matching to prevent false positives (#503)
• fix(bootstrap): harden hydration cache + polling review fixes (#504)
• feat(live-news): add CBC News to optional North America channels (#502)
• fix: use cross-env for Windows-compatible npm scripts (#499)
• fix(cyber): make GeoIP centroid fallback jitter deterministic (#498)
• perf(military): debounce base fetches + upgrade edge cache to static tier (#497)
• feat(military): server-side military bases 125K + rate limiting (#496)
• perf: bootstrap endpoint + polling optimization (#495)
• feat(rss): add Axios (api.axios.com/feed) as US news source (#494)
• feat: add Polish tv livestreams (#488)
• feat(i18n): add Korean (한국어) localization (#487)
• fix(rss): remove stale indianewsnetwork.com from proxy allowlist (#486)

Full Changelog: v2.5.20...v2.5.21

What's Changed

• chore: bump version to 2.5.20 + changelog
• feat(gateway): complete edge cache tier coverage + degraded-response policy (#484)
• fix(markets): commodities panel showing stocks instead of commodities (#483)
• perf(proxy): increase AIS snapshot edge TTL from 2s to 10s (#482)
• fix(analytics): use greedy regex in PostHog ingest rewrites (#481)
• feat: configurable VITE_WS_API_URL + harden POST→GET shim (#480)
• fix(sentry): add noise filters for 4 unresolved issues (#479)
• feat(proxy): add Cloudflare edge caching for proxy.worldmonitor.app (#478)
• fix(gateway): convert stale POST requests to GET for backwards compat (#477)
• fix(desktop): enable click-to-play YouTube embeds + CISA feed fixes (#476)
• fix(tech): use rss() for CISA feed, drop build from pre-push hook (#475)
• feat(cache): tiered edge Cache-Control aligned to upstream TTLs (#474)
• fix(security-advisories): route feeds through RSS proxy to avoid CORS blocks (#473)
• fix: move 5 path-param endpoints to query params for Vercel routing (#472)
• fix(beta): eagerly load T5-small model when beta mode is enabled
• feat: add Cloudflare edge caching infrastructure for api.worldmonitor.app (#471)
• feat: convert 52 API endpoints from POST to GET for edge caching (#468)
• feat(cache): add negative-result caching to cachedFetchJson (#466)
• Add Security Advisories panel with government travel alerts (#460)
• feat(settings): redesign settings window with VS Code-style sidebar layout (#461)
• fix(scripts): handle escaped apostrophes in feed name regex (#455)
• fix(wingbits): add 5-minute backoff on Wingbits /v1/flights failures (#459)
• fix(ollama): strip thinking tokens, raise max_tokens, fix panel summary cache (#456)
• fix+feat: RSS feed repairs, HLS native playback, summarization cache fix, embed improvements (#452)

Full Changelog: v2.5.19...v2.5.20

What's Changed

• fix(linux): detect NVIDIA GPU and work around EGL_BAD_ALLOC on Wayland (#446)

Full Changelog: v2.5.18...v2.5.19

What's Changed

• chore: bump v2.5.18 (#445)
• fix(linux): stop mixing host GStreamer plugins with bundled AppImage plugins (#444)

Full Changelog: v2.5.17...v2.5.18

What's Changed

• chore: bump v2.5.17 (#443)
• fix(linux): disable WebKitGTK compositing in VMs to fix black iframes (#441)

Full Changelog: v2.5.16...v2.5.17

What's Changed

• chore: bump v2.5.16 (#440)
• feat: add India, military, and maritime RSS feeds (#437)
• fix: add security headers to Vercel deployment (#439)
• feat: YouTube URL support in custom channels + Middle East region (#435)
• fix(linux): bundle full GStreamer codec suite for YouTube playback (#434)

Full Changelog: v2.5.15...v2.5.16

What's Changed

• chore: bump v2.5.15 (#432)
• fix(ci): deduplicate smoke test artifact name for dual Linux builds (#431)
• fix: reduce upstream API pressure with cache TTL optimization (#430)
• fix(sentry): tighten noise filters for deck.gl/maplibre and WebView errors (#429)

Full Changelog: v2.5.14...v2.5.15

See changelog below.