docs(changelog): weekly digest 2026-08-31–2026-09-07

[jrusso1020]

What

Weekly digest for 2026-08-31 through the end of 2026-09-07, covering 111 commits on main.

Generated with bun run changelog:weekly, then rewritten to publish quality:

• Grouped by theme rather than the generator's Highlights / Also notable split.
• Every entry keeps its commit and PR links. Full SHAs were resolved with git rev-parse rather than typed by hand.
• The TODO: review marker is removed.
• Short declarative sentences.

Why this shape

The generator surfaced 10 of 111 commits, and 1 of those 10 was already published in last week's entry. Its picks were two lint rules and three capture nits, which is not what the week was.

This was a hardening week, and the entry now leads with it. Three arcs account for 21 commits:

1. File reads pinned to what was checked (fix(catalog): bind asset reads to checked project files #3735, fix(cli): read caption images through checked file descriptors #3724, fix(cli): pin Studio bundle, signature and runtime file reads #3728, fix(producer): pin lint entry reads to checked descriptors #3734, fix(render): serve engine and producer files through checked descriptors #3725) plus a symlink upload escape (fix(studio-server): block dangling symlink upload escapes #3661) and SRI fail-closed (fix(engine): fail closed on blocked SRI scripts #3664). Several cite CodeQL alerts directly.
2. Bounded parser scans across core, engine, studio, studio-server and producer (fix(core): avoid grade stats regex backtracking #3706, fix(core): bound inert region scans in timing compiler #3717, fix(core): bound timing compiler opening tag scans #3719, fix(engine): avoid transform regex backtracking #3704, fix(studio): avoid inline style regex backtracking #3708, fix(studio): match style attributes with explicit quote boundaries #3712, fix(studio-server): bound preview variable insertion scans #3715, fix(producer): bound existing font-face recognition scans #3718).
3. Isolated and atomic writes so concurrent runs stop colliding (fix(engine): isolate WAV staging in a private directory #3709, fix(engine): isolate chunked encode temporary files #3680, fix(producer): isolate font cache temporary writes #3669, fix(studio-server): publish waveform caches atomically #3731, fix(cli): publish capture metadata without overwriting files #3720, fix(cli): preserve concurrent scaffold config creation #3721).

Studio agent control (#3520, #3581) and site capture (#3727, #3598, #3606, #3607, #3726) continued from last week.

Items are worded as what is now true rather than what used to be exploitable. The underlying PRs are public and linked, so nothing is hidden; the digest just isn't the place for the repro.

Window and counts

• The window is inclusive of 2026-09-07. 113 raw non-merge commits since 2026-08-31T00:00:00Z.
• 2 were already published in the Aug 24-31 entry (5b45bcc16, f84b4c23d), so 111 are genuinely new. Found by set-subtracting the 34 SHAs that entry cites, not by guessing a date cut.
• Releases v0.8.21 through v0.8.31, 11 tags, endpoint dates confirmed from /tags. No gaps in the sequence.

Test plan

• mint validate passes from docs/.
• All 76 cited SHAs resolve to 40 chars, prefix-match, are ancestors of origin/main, and fall inside the window. All 76 cited PRs resolve and are merged. Each SHA to PR pairing comes from the commit subject's own inline (#N), not from merge ancestry.
• Every feature cited was checked for canary gating and for still existing at HEAD. The only two canaries at HEAD are calibration-10 and calibration-50, both inert, so nothing this week is gated off.

Scope

Only docs/weekly-updates.mdx is touched. The generator also writes updates/weekly/ and updates/social/; those are left untracked, matching prior weeks.

The video embed is not in this commit. It gets added once the video is rendered and uploaded, which is blocked on an expired AWS SSO session.

Just leave comments if you want anything reworded.

Drafted by Rames

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟢 Ready	View Preview	Sep 7, 2026, 4:46 PM

💡 Tip: Enable Automations to automatically generate PRs for you.