The empty assignee placeholder circle was h-5/w-5 (20px) while the
Identity avatar at size="sm" uses size-6 (24px). Bumped to h-6/w-6
and scaled the inner icon proportionally to h-3.5/w-3.5.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Two issues fixed:
1. Issue page inherited the inbox scroll position — now scrolls to top
on forward (PUSH/REPLACE) navigation, skipped on POP so browser
back restores naturally.
2. Back button used navigate(href) (PUSH) which lost inbox scroll —
now uses navigate(-1) (browser back) to restore inbox scroll
position, with a fallback to PUSH for deep-link edge cases.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The useEffect that set the mobile toolbar JSX had unstable deps
(useMutation results and non-memoized callbacks) causing setState
on every render. Extract InboxMobileToolbar as a standalone component
with its own popover state, and use a ref to hold callbacks so the
effect dep array contains only stable primitives.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
When viewing an issue from the inbox on mobile, replace the standard
breadcrumb bar with a Gmail-style toolbar: back arrow (left), archive
button, and three-dots menu (copy, properties, hide). The regular
breadcrumb bar continues to show when navigating from the issues list.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
## Summary
- Adds release notes for v2026.410.0 security release covering
GHSA-68qg-g8mg-6pr7
- Required before triggering the stable release workflow to publish
2026.410.0 to npm
## Context
The security advisory GHSA-68qg-g8mg-6pr7 was published on 2026-04-10
listing 2026.410.0 as the patched version, but only canary builds exist
on npm. The authz fix (PR #3315) is already merged to master. This PR
adds release notes so the stable release workflow can be triggered.
## Test plan
- Verify release notes content is accurate
- Merge, then trigger release.yml workflow_dispatch with
source_ref=master, stable_date=2026-04-10, dry_run=false
- Confirm npm view paperclipai version returns 2026.410.0
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Summary
- Adds comprehensive release notes for `v2026.410.0`, the security
release that patches GHSA-68qg-g8mg-6pr7 (unauthenticated RCE via import
authorization bypass)
- Required before triggering the stable release workflow to publish
`2026.410.0` to npm and create the GitHub Release
## Context
The security fix (PR #3315) is already merged to master. The GHSA
advisory references `2026.410.0` as the patched version, but only canary
builds exist on npm. This PR unblocks the stable release.
## Test plan
- [x] Release notes file is valid markdown
- [ ] Merge and trigger `release.yml` workflow with `source_ref=master`,
`stable_date=2026-04-10`
- [ ] Verify `npm view paperclipai version` returns `2026.410.0`
- [ ] Verify GitHub Release `v2026.410.0` exists
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-authored-by: Paperclip <noreply@paperclip.ing>
Dotta