ChemAudit

1.8.0 (2026-08-06)

⚠ BREAKING CHANGES

• deps: upgrade to React 19 + react-router 8 to clear remaining router CVE

Features

• analytics: make Butina clustering molecule cap deployment-configurable (d84c3fd)
• Glass logo (27b11b3)
• profiler: enable SCScore via vendored weights + self-contained inference (009d221)
• security: add opt-in HMAC-signed admin tokens for replay resistance (360ef54)
• theme: add shared theme-aware chart color module (4f25f2c)
• ui: replace native window.prompt/confirm with accessible, testable React modals (0df42d0)

Bug Fixes

• a11y: add dialog semantics and close-button label to ExportDialog (0bb1bd2)
• a11y: distinguish success/warning badges by icon and hue, not color alone (ed66a07)
• a11y: keyboard-operable switch, modal semantics, tooltip associations (497b703)
• a11y: raise text-muted contrast to WCAG AA in both themes (41b7760)
• about: address adversarial review of the distill pass (646d48d)
• accessibility P0, palette stragglers, and responsive corners from re-audit (e2cb165)
• address adversarial review findings from remediation pass (c9c49a2)
• batch: make ProgressTracker lazy Redis init thread-safe (a06f400)
• batch: narrow Celery autoretry_for to transient errors only (693ff3b)
• celery: add global task time limits to prevent worker starvation (5bce2c1)
• deps: bump dompurify >=3.4.11 and patch frontend audit findings (c86bc0f)
• deps: bump dompurify >=3.4.11 and patch frontend audit findings (a16142c)
• deps: bump joi to >=18.2.1 in docs-site (CVE-2026-48038) (5324d8e)
• deps: bump joi to >=18.2.1 in docs-site (CVE-2026-48038) (e4e7a4a)
• deps: cap fastapi <0.137 to avoid instrumentator route crash (053ff43)
• deps: cap fastapi <0.137 to avoid instrumentator route crash (937b7f0)
• deps: cap mcp <2 so the backend imports again (605e96e)
• deps: cap mcp <2 so the backend imports again (3c0a3b7)
• deps: force esbuild >=0.28.1 in frontend (GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr) (35c8b41)
• deps: force esbuild >=0.28.1 in frontend (GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr) (d78ce28)
• deps: fully resolve js-yaml alert by moving gray-matter to js-yaml 4 (0a347c1)
• deps: patch docs-site Dependabot alerts via npm overrides (f74abf4)
• deps: resolve all open Dependabot alerts (frontend + docs-site) (29b0080)
• deps: resolve all open Dependabot alerts in frontend and docs-site (86ce708)
• deps: resolve Dependabot security alerts in frontend and docs-site (f81646a)
• deps: resolve Dependabot security alerts in frontend and docs-site (236dfbd)
• deps: resolve open Dependabot alerts (postcss, js-yaml, brace-expansion, react-router) (d8e7b3a)
• deps: sync frontend lockfile after vitest 4 bump (00f17c0)
• deps: sync frontend lockfile after vitest 4 bump (9c155dc)
• deps: upgrade to React 19 + react-router 8 to clear remaining router CVE (b36cef5)
• frontend audit remediation (a11y, performance, responsive, theming) (e1e71ff)
• iupac: skip OPSIN re-init after failure to avoid inconsistent JVM state (03b6708)
• profiler: make SCScore unavailability observable + document NumPy 2.x enablement (11abdc6)
• profiler: validate SYBA SMILES input and make subprocess shell=False explicit (982e9cd)
• redis: bound memory and use volatile-lru so broker messages are never evicted (1f0ec2e)
• regressions found by adversarial sweep of the cleanup branch (bdf0b75)
• responsive: add mobile breakpoints to stat and comparison grids (daf3d0b)
• responsive: enforce 44px touch target on mobile menu button (0ea6ed8)
• responsive: mobile-safe dropdown and SMILES column, intermediate grid breakpoints (b84d09e)
• scoring: guard module-level sascorer imports against missing RDKit Contrib (e1afd70)
• security: escalate insecure-default warnings and add ALLOW_INSECURE_DEFAULTS gate (7f4a1cf)
• security: stop logging secret-named settings; document HMAC-SHA256 intent (b547823)
• theme: AlertGroupCard severity colors use status tokens with dark variants (ded142c)
• theme: batch and shared components use tokens; success is amber not green (b449847)
• theme: batch score histogram uses warm brand scale, not green (df65c6e)
• theme: integrations panels use surface/border tokens (e4c2fe0)
• theme: legible molecule renderings in dark mode via inversion filter (bb17acc)
• theme: NP-likeness reads red (synthetic) to green (natural) (ad44bb7)
• theme: replace decorative purple/indigo with brand palette (database identity colors kept) (1a66ea8)
• theme: retire green-for-success and cool score palettes; badge contrast to AA (2d2148b)
• theme: standardization components use surface/border tokens (d48c311)
• theme: warm gauge tracks and on-palette chart reference colors (cb62e41)
• ui: anchor auto-compare knob to the track's left edge (f7028ec)
• ui: inline delete confirmation, lucide icon swaps, copy and asset cleanup (01ae4c8)
• ux: scroll to top on link navigation app-wide (a7063c3)
• websockets: prevent duplicate broadcasts from superseded subscriber + add WS test suite (4cbfb5e)
• websockets: use redis aclose() instead of deprecated close() (b6ca465)

Performance Improvements

• analytics: isolate expensive analytics on dedicated queue + worker with time limits (dc82cd1)
• batch: store results as Redis list for range-query pagination without full deserialize (f75fcc0)
• clustering: vectorize Tanimoto distance matrix with BulkTanimotoSimilarity (b6107bc)
• lazy-load scoring and standardization result panels on home page (c7bb63d)
• opacity-only ambient orbs, capped blur radii, reduced-motion support (ad5d20c)
• profiler: replace per-call SYBA subprocess with persistent worker (JSON pipe, restart, timeout) (24057f5)
• redis: use pooled singleton clients instead of per-call connections (30f0898)
• route-gate RDKit WASM init; skip splash on structure-free pages (ec20890)
• security: pin RDKit loader version, add SRI, defer parsing (29d627b)
• serve resized logo variants instead of 764KB original (8be0f74)
• skip offscreen row rendering in batch results table (3ead8ec)
• split recharts, framer-motion, gsap, and react vendor chunks (b0c9a10)
• validation: run blocking Celery task.get in executor to free event loop (a7a082a)

Documentation

• add frontend audit remediation plan (224fa7d)
• plan: mark 2.5 SCScore done; all audit items now resolved (c790061)
• plan: mark 4.1 complete; reconcile 2.6/3.3/3.5 as done (were stale 'deferred') (e611777)
• plan: record #7 documented + #21 made configurable (gaps closed) (7affa7d)
• plan: record Wave 3 + Wave 4.3 completion and remaining-item status (2654fa0)
• plan: record Wave 4.2/4.4/4.5 completion + real-stack validation (c88f583)
• plan: record WS fail-open decision and Wave 2 completion status (91e6e1f)
• ws: document deliberate fail-open WebSocket ownership posture (b644e5a)