From ff1ba6b953a65ef87ea7c52e7e5a6ba816edd055 Mon Sep 17 00:00:00 2001
From: Elena Torro <elenatorro@gmail.com>
Date: Mon, 16 Mar 2026 12:05:24 +0100
Subject: [PATCH 1/5] :wrench: Ignore render_wasm shared.js autogenerated file

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index d0a13534b4..5d718c3363 100644
--- a/.gitignore
+++ b/.gitignore
@@ -57,6 +57,7 @@
 /frontend/package-lock.json
 /frontend/resources/fonts/experiments
 /frontend/resources/public/*
+/frontend/src/app/render_wasm/api/shared.js
 /frontend/storybook-static/
 /frontend/target/
 /frontend/test-results/

From efd6d19a1255623d01c6a10a2ae16af1d7af50c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?andr=C3=A9s=20gonz=C3=A1lez?= <andres.gonzalez79@gmail.com>
Date: Mon, 16 Mar 2026 16:58:08 +0100
Subject: [PATCH 2/5] :books: Remove link to sales form from the Help Center
 (#8643)

---
 docs/_includes/layouts/base.njk | 8 +++++---
 docs/index.njk                  | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/docs/_includes/layouts/base.njk b/docs/_includes/layouts/base.njk
index a4ecabe2e7..8bc9f9f663 100644
--- a/docs/_includes/layouts/base.njk
+++ b/docs/_includes/layouts/base.njk
@@ -70,9 +70,11 @@
     </main>
 
     <div class="pre-footer">
-      <a href="https://github.com/penpot/penpot/blob/main/docs/{{ page.inputPath }}">Edit this page on GitHub</a> 
-               &nbsp;or ask a&nbsp;
-               <a href="https://penpot.app/talk-to-us" target="_blank">question</a>.
+      <div>Found an issue or want to improve this page?<br><br>
+        <a href="https://github.com/penpot/penpot/blob/main/docs/{{ page.inputPath }}">Edit this page on GitHub</a> 
+        &nbsp; · &nbsp;
+        <a href="https://github.com/penpot/penpot/issues/new/choose" target="_blank">Open an issue</a>
+      </div>
     </div>
     <footer class="footer">
       <div class="footer-inside">
diff --git a/docs/index.njk b/docs/index.njk
index ae0b36043a..ef15854588 100644
--- a/docs/index.njk
+++ b/docs/index.njk
@@ -57,5 +57,5 @@ eleventyNavigation:
 
 <div class="contact-block">
   <h2>Contact us</h2>
-  <p>Need help? <a href="https://penpot.app/talk-to-us" target="_blank">Talk to us</a> or join our <a href="https://community.penpot.app/" target="_blank">community</a>.</p>
+  <p>Write us at <a href="mailto:support@penpot.app" target="_blank">support@penpot.app</a> or join our <a href="https://community.penpot.app/" target="_blank">Community</a>.</p>
 </div>

From 0779c9ca615b50167b4f10e988c699b636b9deed Mon Sep 17 00:00:00 2001
From: Andrey Antukh <niwi@niwi.nz>
Date: Tue, 17 Mar 2026 09:31:10 +0100
Subject: [PATCH 3/5] :bug: Fix TypeError in get-points when content is not
 PathData (#8634)

The with-cache macro in impl.cljc assumed the target was always a
PathData instance (which has a cache field). When content was a plain
vector, (.-cache content) returned undefined in JS, causing:

  TypeError: Cannot read properties of undefined (reading 'get')

Fix:
- path/get-points (app.common.types.path) is now the canonical safe
  entry point: converts non-PathData content via impl/path-data and
  handles nil safely before delegating to segment/get-points
- segment/get-points remains a low-level function that expects a
  PathData instance (no defensive logic at that level)
- streams.cljs: replace direct call to path.segm/get-points with
  path/get-points so the safe conversion path is always used
- with-cache macro: guards against nil/undefined cache, falling back
  to direct evaluation for non-PathData targets

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
---
 common/src/app/common/types/path.cljc           | 10 +++++++---
 common/src/app/common/types/path/impl.cljc      | 17 +++++++++--------
 .../test/common_tests/types/path_data_test.cljc |  6 ++++++
 .../app/main/data/workspace/path/changes.cljs   |  2 +-
 .../app/main/data/workspace/path/streams.cljs   |  4 ++--
 5 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/common/src/app/common/types/path.cljc b/common/src/app/common/types/path.cljc
index be0e15b1aa..67d8031efb 100644
--- a/common/src/app/common/types/path.cljc
+++ b/common/src/app/common/types/path.cljc
@@ -190,10 +190,14 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 (defn get-points
-  "Returns points for the given segment, faster version of
-  the `content->points`."
+  "Returns points for the given content. Accepts PathData instances or
+  plain segment vectors. Returns nil for nil content."
   [content]
-  (some-> content segment/get-points))
+  (when (some? content)
+    (let [content (if (impl/path-data? content)
+                    content
+                    (impl/path-data content))]
+      (segment/get-points content))))
 
 (defn calc-selrect
   "Calculate selrect from a content. The content can be in a PathData
diff --git a/common/src/app/common/types/path/impl.cljc b/common/src/app/common/types/path/impl.cljc
index 8b2ed4a315..959a11bf6f 100644
--- a/common/src/app/common/types/path/impl.cljc
+++ b/common/src/app/common/types/path/impl.cljc
@@ -52,14 +52,15 @@
   [target key & expr]
   (if (:ns &env)
     (let [target (with-meta target {:tag 'js})]
-      `(let [~'cache  (.-cache ~target)
-             ~'result (.get ~'cache ~key)]
-         (if ~'result
-           (do
-             ~'result)
-           (let [~'result (do ~@expr)]
-             (.set ~'cache ~key ~'result)
-             ~'result))))
+      `(let [~'cache (.-cache ~target)]
+         (if (some? ~'cache)
+           (let [~'result (.get ~'cache ~key)]
+             (if ~'result
+               ~'result
+               (let [~'result (do ~@expr)]
+                 (.set ~'cache ~key ~'result)
+                 ~'result)))
+           (do ~@expr))))
     `(do ~@expr)))
 
 (defn- impl-transform-segment
diff --git a/common/test/common_tests/types/path_data_test.cljc b/common/test/common_tests/types/path_data_test.cljc
index 5e6298191e..672df228d8 100644
--- a/common/test/common_tests/types/path_data_test.cljc
+++ b/common/test/common_tests/types/path_data_test.cljc
@@ -279,6 +279,12 @@
       (t/is (some? points))
       (t/is (= 3 (count points))))))
 
+(t/deftest path-get-points-plain-vector-safe
+  (t/testing "path/get-points does not throw for plain vector content"
+    (let [points (path/get-points sample-content)]
+      (t/is (some? points))
+      (t/is (= 3 (count points))))))
+
 (defn calculate-extremities
   "Calculate extremities for the provided content.
   A legacy implementation used mainly as reference for testing"
diff --git a/frontend/src/app/main/data/workspace/path/changes.cljs b/frontend/src/app/main/data/workspace/path/changes.cljs
index fc43b61fd5..c2bc293da3 100644
--- a/frontend/src/app/main/data/workspace/path/changes.cljs
+++ b/frontend/src/app/main/data/workspace/path/changes.cljs
@@ -68,7 +68,7 @@
        (let [content (st/get-path state :content)
              content (if (and (not preserve-move-to)
                               (= (-> content last :command) :move-to))
-                       (into [] (take (dec (count content)) content))
+                       (path/content (take (dec (count content)) content))
                        content)]
          (st/set-content state content)))
 
diff --git a/frontend/src/app/main/data/workspace/path/streams.cljs b/frontend/src/app/main/data/workspace/path/streams.cljs
index b6028eec11..907d50ab24 100644
--- a/frontend/src/app/main/data/workspace/path/streams.cljs
+++ b/frontend/src/app/main/data/workspace/path/streams.cljs
@@ -8,7 +8,7 @@
   (:require
    [app.common.data.macros :as dm]
    [app.common.geom.point :as gpt]
-   [app.common.types.path.segment :as path.segm]
+   [app.common.types.path :as path]
    [app.main.data.workspace.path.state :as pst]
    [app.main.snap :as snap]
    [app.main.store :as st]
@@ -167,7 +167,7 @@
         ranges-stream
         (->> content-stream
              (rx/filter some?)
-             (rx/map path.segm/get-points)
+             (rx/map path/get-points)
              (rx/map snap/create-ranges))]
 
     (->> ms/mouse-position

From e730e9ee646bd50882b0421a146fa02ff5cc5e92 Mon Sep 17 00:00:00 2001
From: Andrey Antukh <niwi@niwi.nz>
Date: Tue, 17 Mar 2026 10:06:16 +0100
Subject: [PATCH 4/5] :bug: Fix subscribe to undefined stream error in
 use-stream hook (#8633)

Add a nil guard before subscribing to the stream in the use-stream
hook. When a nil/undefined stream is passed (e.g., from a conditional
expression or timing edge case during React rendering), the subscribe
call on undefined causes a TypeError. The guard ensures we only
subscribe when the stream is defined.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
---
 frontend/src/app/main/ui/hooks.cljs | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/frontend/src/app/main/ui/hooks.cljs b/frontend/src/app/main/ui/hooks.cljs
index a7ba644c8c..b4ad8fe616 100644
--- a/frontend/src/app/main/ui/hooks.cljs
+++ b/frontend/src/app/main/ui/hooks.cljs
@@ -214,10 +214,11 @@
    (mf/use-effect
     deps
     (fn []
-      (let [sub (->> stream (rx/subs! on-subscribe))]
-        #(do
-           (rx/dispose! sub)
-           (when on-dispose (on-dispose))))))))
+      (when stream
+        (let [sub (->> stream (rx/subs! on-subscribe))]
+          #(do
+             (rx/dispose! sub)
+             (when on-dispose (on-dispose)))))))))
 
 ;; https://reactjs.org/docs/hooks-faq.html#how-to-get-the-previous-props-or-state
 ;; FIXME: replace with rumext

From c6f8356847c2bc914badd19e39c6b2493ee4bd54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Elena=20Torr=C3=B3?= <elenatorro@gmail.com>
Date: Tue, 17 Mar 2026 11:49:14 +0100
Subject: [PATCH 5/5] :books: Improve docs on feature flags (#8641)

---
 docs/technical-guide/developer/devenv.md | 49 +++++++++++++++++++++++-
 1 file changed, 48 insertions(+), 1 deletion(-)

diff --git a/docs/technical-guide/developer/devenv.md b/docs/technical-guide/developer/devenv.md
index 3c98df3484..facb810dd8 100644
--- a/docs/technical-guide/developer/devenv.md
+++ b/docs/technical-guide/developer/devenv.md
@@ -187,7 +187,54 @@ python3 manage.py create-profile --skip-tutorial --skip-walkthrough
 python3 manage.py create-profile -n "Jane Doe" -e jane@example.com -p secretpassword --skip-tutorial --skip-walkthrough
 ```
 
-## Team Feature Flags
+## Feature Flags
+
+### Frontend flags via config.js
+
+You can enable or disable feature flags on the frontend by creating (or editing) a
+`config.js` file at `frontend/resources/public/js/config.js`. This file is
+**gitignored**, so it has to be created manually. Your local flags won't affect other developers.
+
+Set the `penpotFlags` variable with a space-separated list of flags:
+
+```js
+var penpotFlags = "enable-mcp enable-webhooks enable-access-tokens";
+```
+
+Each flag entry uses the format `enable-<flag>` or `disable-<flag>`. They are
+merged on top of the built-in defaults, so you only need to list the flags you want
+to change.
+
+Some examples of commonly used flags:
+
+- `enable-access-tokens` — enables the Access Tokens section under profile settings.
+- `enable-mcp` — enables the MCP server configuration section.
+- `enable-webhooks` — enables webhooks configuration.
+- `enable-login-with-ldap` — enables LDAP login.
+
+The full list of available flags can be found in `common/src/app/common/flags.cljc`.
+
+After creating or modifying this file, **reload the browser** (no need to restart anything).
+
+### Backend flags via PENPOT_FLAGS
+
+Backend feature flags are controlled through the `PENPOT_FLAGS` environment
+variable using the same `enable-<flag>` / `disable-<flag>` format. You can set
+this in the `docker/devenv/docker-compose.yaml` file under the `main` service
+`environment` section:
+
+```yaml
+environment:
+  - PENPOT_FLAGS=enable-access-tokens enable-mcp
+```
+
+This requires **restarting the backend** to take effect.
+
+> **Note**: Some features (e.g., access tokens, webhooks) need both frontend and
+> backend flags enabled to work end-to-end. The frontend flag enables the UI, while
+> the backend flag enables the corresponding API endpoints.
+
+### Team Feature Flags
 
 To test a Feature Flag, you can enable or disable them by team through the `dbg` page: