fix(studio): server-side DOM patching, render CSS scoping, and resilience#986

Merged

miguel-heygen merged 9 commits into

mainfrom

fix/studio-edit-persistence-and-render-css

May 21, 2026

Commits on May 20, 2026

fix(studio): server-side DOM patching, render CSS scoping, and resilience
miguel-heygen
committed
fix: address review — PostHog key comment, flushTimer cleanup, TOCTOU, type guard
miguel-heygen
committed
fix: allowlist html-attribute names to prevent stored XSS surface
miguel-heygen
committed
fix(core): harden html-attribute allowlist with on* prefix block, data:text/html URI rejection
miguel-heygen
committed
test(producer): add wysiwyg-subcomp-css regression baseline video
miguel-heygen
committed
fix(studio): guard __STUDIO_VERSION__ reference for dev server without restart
miguel-heygen
committed
ci: add studio load smoke test — catches runtime errors on first page load
miguel-heygen
committed
fix(ci): resolve puppeteer from producer package in studio smoke test
miguel-heygen
committed

Commits on May 21, 2026

test(producer): regenerate sub-composition-video baseline for Chrome frame-timing drift
miguel-heygen
committed