3.9.0
Highlights
- 🛡️ SECURITY: Stored XSS in sticky header button messages
Fix the vulnerability where an evil user with interface message rights can inject arbitrary HTML into the sticky header button messages. (
CVE-2025-62508/GHSA-g955-vw6w-v6pp) - 📖 Improve emphasis styles for East Asian scripts clreq: dots are used in both horizontal and vertical writing modes. mlreq: wavy lines are used instead of dots.
- 🔍 Search shortcuts are now keyboard layout-independent
Search shortcuts such as
/andCtrl+Know work regardless of the keyboard layout.
Many thanks to those who contributed to the recent releases! Citizen is a better skin thanks to you! 🎉
Changelog
Features
- icon: ✨ add microinteraction for configure icon
8f55d2d - search: ✨ make search shortcuts keyboard layout-independent (by @Vonavy)
6c806b5 - typography: ✨ improve emphasis styles for East Asian scripts (by @AmeroHan) (#1165)
4e82bdc
Bug Fixes
- layout: 🐛 fix page tools center alignment on main page (by @Vonavy) (#1167)
e72c859 - menu: 🐛 language card goes off-screen when page title is too long (by @dringsim)
70181e4 - SECURITY: 🐛 fix stored XSS in sticky header button messages (by @SomeMWDev)
e006923 - tokens: 🐛 fix layout issues with fractional viewport sizes (by @AmeroHan)
7ae0f48



