fiberpath 0.7.1__tar.gz → 0.7.2__tar.gz

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/actions/setup-node/action.yml

@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: ${{ inputs.node-version }}
         cache: npm

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/actions/setup-python/action.yml

@@ -24,13 +24,13 @@ runs:
         python-version: ${{ inputs.python-version }}
 
     - name: Set up uv
-      uses: astral-sh/setup-uv@v3
+      uses: astral-sh/setup-uv@v8.2.0
       with:
         enable-cache: true
         cache-dependency-glob: "pyproject.toml"
 
     - name: Cache Python virtual environment
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: .venv
         key: venv-${{ runner.os }}-${{ inputs.python-version }}-${{ hashFiles('pyproject.toml') }}-${{ inputs.cache-key-suffix }}

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/actions/setup-rust/action.yml

@@ -18,7 +18,7 @@ runs:
       uses: dtolnay/rust-toolchain@stable
 
     - name: Cache cargo artifacts
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.cargo/bin

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/backend-ci.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -39,7 +39,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -52,7 +52,7 @@ jobs:
 
       - name: Upload coverage
         if: matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           files: ./coverage.xml
           flags: backend

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/ci-check.yml

@@ -15,6 +15,7 @@ on:
       - "setup.cfg"
       - "mkdocs.yml"
       - "README.md"
+      - "CHANGELOG.md"
       - "scripts/**"
       - ".github/workflows/**"
       - ".github/actions/**"
@@ -32,6 +33,7 @@ on:
       - "setup.cfg"
       - "mkdocs.yml"
       - "README.md"
+      - "CHANGELOG.md"
       - "scripts/**"
       - ".github/workflows/**"
       - ".github/actions/**"
@@ -50,7 +52,7 @@ jobs:
       docs: ${{ steps.filter.outputs.docs }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Detect changed areas
         id: filter

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/dependency-audit.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python
@@ -46,7 +46,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js environment
         uses: ./.github/actions/setup-node
@@ -69,7 +69,7 @@ jobs:
         working-directory: fiberpath_gui/src-tauri
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup-rust

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/docs-ci.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/docs-deploy.yml

@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Configure GitHub Pages
         id: pages

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/gui-ci.yml

@@ -16,7 +16,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js environment
         uses: ./.github/actions/setup-node
@@ -44,7 +44,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js environment
         uses: ./.github/actions/setup-node
@@ -56,7 +56,7 @@ jobs:
         run: npm run test:coverage
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           files: ./fiberpath_gui/coverage/lcov.info
           flags: gui

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/gui-e2e-smoke.yml

@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download packaged GUI artifact
         uses: actions/download-artifact@v8

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/gui-packaging.yml

@@ -51,7 +51,7 @@ jobs:
         os: [windows-latest, macos-latest, ubuntu-latest]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python (no cache for freeze)
         uses: actions/setup-python@v6
@@ -130,7 +130,7 @@ jobs:
         working-directory: fiberpath_gui
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download frozen CLI artifact
         uses: actions/download-artifact@v8

{fiberpath-0.7.1 → fiberpath-0.7.2}/.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
       tag: ${{ steps.check.outputs.tag }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Create SBOM output directory
         run: mkdir -p sbom
@@ -109,7 +109,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download SBOM artifacts
         uses: actions/download-artifact@v8
@@ -249,7 +249,7 @@ jobs:
       url: https://pypi.org/project/fiberpath/
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-python

{fiberpath-0.7.1 → fiberpath-0.7.2}/CHANGELOG.md

@@ -8,6 +8,50 @@ The format is based on Keep a Changelog, and this project follows semantic versi
 
 ## [Unreleased]
 
+## [0.7.2] - 2026-06-24
+
+### Security
+
+- Hardened API path policy (`enforce_input_path_policy`) to reject absolute paths (POSIX `/`, Windows drive `C:\`, UNC `\\`), NUL bytes, `..` traversal segments, and empty/whitespace inputs with 400 before any filesystem access. Resolved CodeQL alert #9 ("Uncontrolled data used in path expression").
+- Patched `starlette` CVE-2026-48710 (BadHost) by upgrading to a fixed release.
+- Cleared the GUI dev-tree advisories `js-yaml` (GHSA-h67p-54hq-rp68, merge-key DoS → 4.2.0) and `undici` (GHSA-vmh5-mc38-953g and related → 7.28.0). Both are dev-only; the shipped application is unaffected.
+- Bumped `rand` to 0.8.6 (GHSA-cq8v-f236-94qc). A residual, build-time-only `rand` 0.7.3 is pinned upstream in the Tauri toolchain with no available fix and is tracked in `TODO.md`.
+
+### Changed
+
+- API file endpoints now require relative paths; the configured `FIBERPATH_API_ALLOWED_ROOTS` controls which directories they resolve against.
+- Rebuilt user-supplied paths from validated components (`Path(*parts)`) instead of passing raw input to `Path()`, breaking the taint chain for static analysis.
+- API plan/simulate routes map core-engine input errors (`PlanningError`, `SimulationError`) to HTTP 400 via centralized exception handlers instead of surfacing them as 500s, and `/stream` caps the G-code payload at 10 MB.
+- Routed streaming `[DEBUG]`/`[ERROR]` output through the `logging` module instead of `print(..., file=sys.stderr)`, so a normal run is quiet by default while the stdout JSON protocol is unchanged.
+- Upgraded Tauri to 2.11 (Cargo + npm aligned) and refreshed CI actions.
+
+### Fixed
+
+- `MarlinStreamer` transport guards now raise `StreamError` instead of `assert`, so they behave identically under `python -O` rather than degrading to a `None` dereference.
+- Tauri `plot_definition`, `plot_preview`, and `validate_wind_definition` no longer leak temporary `.wind`/`.gcode`/`.png` files on error paths; an RAII guard removes them on every exit.
+
+### Removed
+
+- Removed the unused `fiberpath/geometry/` stub module (dead code advertising non-cylindrical capability that does not exist; the roadmap is documented instead).
+- Removed dead branches in `planning/layer_strategies.py` (a no-op `build_layer_summary` conditional and an unreachable circuit-divisibility guard superseded by upstream validation).
+
+### Added
+
+- `tests/api/test_path_policy.py` — 18 dedicated tests covering all rejected input classes (NUL bytes, POSIX absolute, Windows drive/UNC, `..` traversal with forward and backslash separators, empty/whitespace, absolute-inside-root) and accepted cases (bare filename, nested relative, multiple roots, single-dot normalisation).
+- Integration-level rejection tests in `test_plan_route.py` and `test_simulate_route.py` for absolute-path and traversal inputs.
+- Tests for API error-to-4xx mapping, `MarlinStreamer` transport guards (including a `python -O` subprocess check), streaming logging staying quiet by default, and the Tauri temp-file cleanup guard.
+
+### Documentation
+
+- Aligned the README and architecture docs with the implemented scope (cylindrical mandrels; hoop/helical/skip layers), framed geodesic/curved-surface support as roadmap, and removed the stale `examples/complex_surface/` placeholder.
+
+### Dependencies
+
+- Tooling/CI: `astral-sh/setup-uv` v8.2.0 (Node 24), `codecov/codecov-action` v7, `actions/checkout` v7.
+- Python (uv): `starlette` 1.3.1, `urllib3` 2.7.0, `idna` 3.15, `pymdown-extensions` 10.21.3.
+- npm: `@types/node` 26, `lucide-react`, `fast-uri` 3.1.2, plus the npm prod and dev minor-patch dependency groups.
+- Cargo: the cargo minor-patch dependency groups.
+
 ## [0.7.1] - 2026-04-16
 
 ### Added

{fiberpath-0.7.1 → fiberpath-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fiberpath
-Version: 0.7.1
+Version: 0.7.2
 Summary: Modern filament winding planner, simulator, and G-code toolkit.
 Author: Cameron K. Brooks
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
@@ -680,6 +680,7 @@ Requires-Dist: rich>=13.7
 Requires-Dist: typer>=0.12
 Provides-Extra: api
 Requires-Dist: fastapi>=0.110; extra == 'api'
+Requires-Dist: starlette>=1.0.1; extra == 'api'
 Requires-Dist: uvicorn[standard]>=0.24; extra == 'api'
 Provides-Extra: cli
 Requires-Dist: rich>=13.7; extra == 'cli'
@@ -708,7 +709,7 @@ Description-Content-Type: text/markdown
 
 **Plan, simulate, and manufacture composite parts with precision fiber winding.**
 
-[![Version](https://img.shields.io/badge/version-0.7.0-4c7284)](https://github.com/CameronBrooks11/fiberpath/releases)
+[![Version](https://img.shields.io/badge/version-0.7.2-4c7284)](https://github.com/CameronBrooks11/fiberpath/releases)
 [![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-00695C.svg)](LICENSE)
 [![Backend CI](https://img.shields.io/github/actions/workflow/status/CameronBrooks11/fiberpath/backend-ci.yml?branch=main&label=Backend%20CI&logo=python&logoColor=white)](https://github.com/CameronBrooks11/fiberpath/actions/workflows/backend-ci.yml)
 [![GUI CI](https://img.shields.io/github/actions/workflow/status/CameronBrooks11/fiberpath/gui-ci.yml?branch=main&label=GUI%20CI&logo=react&logoColor=white)](https://github.com/CameronBrooks11/fiberpath/actions/workflows/gui-ci.yml)
@@ -729,12 +730,12 @@ Description-Content-Type: text/markdown
 
 FiberPath automates the complex process of **filament winding**—wrapping fiber-reinforced composites around mandrels to create lightweight, high-strength cylindrical parts like pressure vessels, pipes, and aerospace structures.
 
-Design multi-layer winding patterns in a visual interface, simulate the full manufacturing process, and stream G-code directly to Marlin-based hardware. FiberPath handles the mathematics of geodesic paths, fiber tension calculations, and machine kinematics so you can focus on part design.
+Design multi-layer winding patterns in a visual interface, simulate the full manufacturing process, and stream G-code directly to Marlin-based hardware. FiberPath handles the winding mathematics — hoop and helical path generation, tow coverage, and machine kinematics for cylindrical mandrels — so you can focus on part design.
 
 ### Features
 
 - **Visual Layer Editor** – Design winding patterns with live preview
-- **Geodesic Path Planning** – Automatic computation of stable fiber trajectories
+- **Winding Path Planning** – Automatic hoop, helical, and skip pattern generation for cylindrical mandrels
 - **Hardware Simulation** – Validate motion before manufacturing
 - **Direct Machine Control** – Stream G-code to Marlin controllers with pause/resume
 - **XAB-Native Axis Output** – Standardized rotational-axis output with clear logical axis mapping
@@ -742,6 +743,8 @@ Design multi-layer winding patterns in a visual interface, simulate the full man
 - **Command-Line Tools** – Scriptable workflows for automation and CI/CD
 - **Comprehensive Documentation** – Architecture guides, examples, and API reference
 
+> **Scope & roadmap:** FiberPath currently plans **cylindrical mandrels** with hoop, helical, and skip layers. Non-cylindrical (geodesic) surface support — including tapered and custom mandrels — is planned but not yet implemented.
+
 ## Quick Start
 
 ### Option 1: Desktop GUI (Recommended)
@@ -902,10 +905,9 @@ FiberPath consists of four coordinated components:
                 ▼
 ┌─────────────────────────────────────────────────┐
 │           Core Engine (Python)                  │
-│  • Geodesic path planning                       │
+│  • Winding path planning (hoop/helical/skip)    │
 │  • Layer strategies                             │
 │  • G-code generation                            │
-│  • Geometry utilities                           │
 └─────────────────────────────────────────────────┘
                 ▲
                 │ imports

{fiberpath-0.7.1 → fiberpath-0.7.2}/README.md

@@ -4,7 +4,7 @@
 
 **Plan, simulate, and manufacture composite parts with precision fiber winding.**
 
-[![Version](https://img.shields.io/badge/version-0.7.0-4c7284)](https://github.com/CameronBrooks11/fiberpath/releases)
+[![Version](https://img.shields.io/badge/version-0.7.2-4c7284)](https://github.com/CameronBrooks11/fiberpath/releases)
 [![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-00695C.svg)](LICENSE)
 [![Backend CI](https://img.shields.io/github/actions/workflow/status/CameronBrooks11/fiberpath/backend-ci.yml?branch=main&label=Backend%20CI&logo=python&logoColor=white)](https://github.com/CameronBrooks11/fiberpath/actions/workflows/backend-ci.yml)
 [![GUI CI](https://img.shields.io/github/actions/workflow/status/CameronBrooks11/fiberpath/gui-ci.yml?branch=main&label=GUI%20CI&logo=react&logoColor=white)](https://github.com/CameronBrooks11/fiberpath/actions/workflows/gui-ci.yml)
@@ -25,12 +25,12 @@
 
 FiberPath automates the complex process of **filament winding**—wrapping fiber-reinforced composites around mandrels to create lightweight, high-strength cylindrical parts like pressure vessels, pipes, and aerospace structures.
 
-Design multi-layer winding patterns in a visual interface, simulate the full manufacturing process, and stream G-code directly to Marlin-based hardware. FiberPath handles the mathematics of geodesic paths, fiber tension calculations, and machine kinematics so you can focus on part design.
+Design multi-layer winding patterns in a visual interface, simulate the full manufacturing process, and stream G-code directly to Marlin-based hardware. FiberPath handles the winding mathematics — hoop and helical path generation, tow coverage, and machine kinematics for cylindrical mandrels — so you can focus on part design.
 
 ### Features
 
 - **Visual Layer Editor** – Design winding patterns with live preview
-- **Geodesic Path Planning** – Automatic computation of stable fiber trajectories
+- **Winding Path Planning** – Automatic hoop, helical, and skip pattern generation for cylindrical mandrels
 - **Hardware Simulation** – Validate motion before manufacturing
 - **Direct Machine Control** – Stream G-code to Marlin controllers with pause/resume
 - **XAB-Native Axis Output** – Standardized rotational-axis output with clear logical axis mapping
@@ -38,6 +38,8 @@ Design multi-layer winding patterns in a visual interface, simulate the full man
 - **Command-Line Tools** – Scriptable workflows for automation and CI/CD
 - **Comprehensive Documentation** – Architecture guides, examples, and API reference
 
+> **Scope & roadmap:** FiberPath currently plans **cylindrical mandrels** with hoop, helical, and skip layers. Non-cylindrical (geodesic) surface support — including tapered and custom mandrels — is planned but not yet implemented.
+
 ## Quick Start
 
 ### Option 1: Desktop GUI (Recommended)
@@ -198,10 +200,9 @@ FiberPath consists of four coordinated components:
                 ▼
 ┌─────────────────────────────────────────────────┐
 │           Core Engine (Python)                  │
-│  • Geodesic path planning                       │
+│  • Winding path planning (hoop/helical/skip)    │
 │  • Layer strategies                             │
 │  • G-code generation                            │
-│  • Geometry utilities                           │
 └─────────────────────────────────────────────────┘
                 ▲
                 │ imports

{fiberpath-0.7.1 → fiberpath-0.7.2}/TODO.md

@@ -18,4 +18,6 @@
 
 - [ ] Track Dependabot moderate alert #3 (GHSA-wrw7-89jp-8q8g / glib). Current Tauri GTK stack pins `glib` 0.18.x (`^0.18` via `gtk`), so patched `glib` 0.20.0 cannot be adopted yet. Do not block a release solely for this; re-check after upstream Tauri/GTK dependency line moves to non-vulnerable glib.
 
+- [ ] Track Dependabot low alert (GHSA-cq8v-f236-94qc / `rand`). The `rand 0.8.x` instance was patched to 0.8.6; a residual `rand 0.7.3` remains, pinned via `phf_generator 0.8.0` (`^0.7`) in Tauri's `tauri-build` → `kuchikiki` → `selectors`/`cssparser` chain. It is a **build-time-only** dependency (CSS-parser codegen), not in the shipped runtime, and the advisory (runtime `rand::rng()` soundness) does not apply to it — effectively zero risk. No 0.7.x fix exists; re-check after the Tauri `tauri-utils`/`kuchikiki` dependency line moves off `phf 0.8`. Do not block a release for this.
+
 - [ ] Manual cross-platform validation (waived for v0.6.0, required before v1.0 or first public release): Linux `.deb`/`.AppImage` (Ubuntu 22.04, Debian 12, Fedora 39) and macOS `.dmg` (Intel + Apple Silicon) install, bundled CLI discovery, full workflow (validate → plan → simulate → visualize), serial port, file ops, upgrade, and uninstall. See `planning/roadmap-v6.md` Phases 1 & 2 for the full checklist.

{fiberpath-0.7.1 → fiberpath-0.7.2}/docs/architecture/overview.md

@@ -24,7 +24,7 @@ together and where to extend them.
 └──────────────────────┘
 ```
 
-- **Core Engine (`fiberpath/`)** – Immutable planners, geometry helpers, machine abstractions, and
+- **Core Engine (`fiberpath/`)** – Immutable planners, machine abstractions, and
   G-code emitters. The modules are designed to run without side effects so they can be imported from both CLI and API layers.
 - **Interface Layer** – `fiberpath_cli` hosts the Typer commands, while `fiberpath_api` turns the
   same operations into REST endpoints. The desktop GUI wraps the CLI and communicates via Tauri IPC
@@ -35,7 +35,6 @@ together and where to extend them.
 | Module                 | Responsibility                                                                         | Notes                                                                                            |
 | ---------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
 | `fiberpath.planning`   | Parses `.wind` files, validates machine/layer constraints, produces command sequences. | `PlanOptions` governs verbosity and optional advanced dialect override.                          |
-| `fiberpath.geometry`   | Curve/surface math shared between planner and simulator.                               | Pure functions make it safe for reuse.                                                           |
 | `fiberpath.gcode`      | Dialects and writers for Marlin-style controllers.                                     | Extend here when adding custom headers or commands. Axis mapping configured via `MarlinDialect`. |
 | `fiberpath.simulation` | Time/distance estimations based on planned feed rates.                                 | Feeds CLI `simulate` summaries. Axis-aware for proper rotational calculations.                   |
 | `fiberpath.execution`  | PySerial streaming, pause/resume, and progress tracking.                               | Used by CLI streaming and API `/stream`.                                                         |

{fiberpath-0.7.1 → fiberpath-0.7.2}/docs/guides/wind-format.md

@@ -178,7 +178,7 @@ A helical layer winds at a specified angle, creating a spiral pattern around the
 
 - Pressure vessel cylindrical sections
 - Angled reinforcement (±45° for shear resistance)
-- Complex geodesic patterns
+- Angled helical reinforcement patterns
 
 ### Skip Layer
 
@@ -202,7 +202,7 @@ A skip layer rotates the mandrel without winding, allowing for pattern repositio
 
 - Pattern alignment between layers
 - Creating intentional gaps
-- Repositioning for non-geodesic patterns
+- Repositioning between layers
 
 ## Validation Rules
 

{fiberpath-0.7.1 → fiberpath-0.7.2}/docs/index.md

@@ -36,7 +36,7 @@ hide:
 
     ---
 
-    **Latest Release:** [v0.7.0](https://github.com/CameronBrooks11/fiberpath/releases/latest){ target=_blank }
+    **Latest Release:** [v0.7.2](https://github.com/CameronBrooks11/fiberpath/releases/latest){ target=_blank }
 
     - **Desktop GUI** – Windows, macOS, Linux installers (no Python required)
     - **Python Package** – `pip install fiberpath`
@@ -44,18 +44,18 @@ hide:
 
     [:octicons-arrow-right-24: Installation Guide](getting-started.md)
 
--   :material-new-box:{ .lg .middle } **What's New in v0.7.0**
+-   :material-new-box:{ .lg .middle } **What's New in v0.7.2**
 
     ---
 
-    XAB cutover and production-readiness hardening:
+    Code-quality, hardening, and dependency-refresh pass:
 
-    - Removed legacy XYZ axis-format paths; built-in planning, API, and GUI export now target XAB output
-    - Simplified GUI surfaces further by removing dead style/component residue and tightening editor/layout boundaries
-    - Added bundle-budget CI enforcement and refreshed contributor tooling standards for cleaner release gates
-    - Expanded regression coverage for axis mapping, layer strategy fixtures, and visualization signatures
+    - API plan/simulate errors now return clear 4xx responses instead of 500s, and streaming diagnostics moved to the `logging` module
+    - Hardened Marlin streaming guards (`StreamError` instead of `assert`) and fixed temporary-file cleanup in the desktop backend
+    - Removed dead code (unused geometry module, redundant planner branches) and aligned docs with the cylindrical planning scope
+    - Security & dependency refresh: starlette BadHost CVE, js-yaml/undici/rand advisories, and Tauri 2.11
 
-    Builds on the v0.6.x cleanup track and establishes the v0.7 baseline.
+    Builds on the v0.7 baseline with reliability and maintainability fixes.
 
     [:octicons-arrow-right-24: Marlin Streaming Guide](guides/marlin-streaming.md)