📚 Update changelog

🐛 Add sandbox runtime

CHANGES.md

@@ -1,6 +1,22 @@
 # CHANGELOG
 
-## 2.7.0 (Unreleased)
+
+## 2.7.2 (Unreleased)
+
+### :bug: Bugs fixed
+
+- Update plugins runtime [Github #6604](https://github.com/penpot/penpot/pull/6604)
+
+
+## 2.7.1
+
+### :bug: Bugs fixed
+
+- Fix incorrect handling of strokes with images on importing files
+- Fix tokens disappearing after manual additions [Taiga #11063](https://tree.taiga.io/project/penpot/issue/11063)
+
+
+## 2.7.0
 
 ### :rocket: Epics and highlights
 

common/deps.edn

@@ -28,7 +28,7 @@
   integrant/integrant {:mvn/version "0.13.1"}
 
   funcool/tubax {:mvn/version "2021.05.20-0"}
-  funcool/cuerdas {:mvn/version "2023.11.09-407"}
+  funcool/cuerdas {:mvn/version "2025.05.26-411"}
   funcool/promesa
   {:git/sha "0c5ed6ad033515a2df4b55addea044f60e9653d0"
    :git/url "https://github.com/funcool/promesa"}

common/src/app/common/files/helpers.cljc

@@ -626,6 +626,9 @@
               (map? (:fill-image form))
               (update-in [:fill-image :id] lookup-index)
 
+              (map? (:stroke-image form))
+              (update-in [:stroke-image :id] lookup-index)
+
               ;; This covers old shapes and the new :fills.
               (uuid? (:fill-color-ref-file form))
               (update :fill-color-ref-file lookup-index)

frontend/resources/plugins-runtime/index.js

@@ -5086,7 +5086,8 @@ class zc extends HTMLElement {
       "allow-modals",
       "allow-popups",
       "allow-popups-to-escape-sandbox",
-      "allow-storage-access-by-user-activation"
+      "allow-storage-access-by-user-activation",
+      "allow-same-origin"
     ), o && l.sandbox.add("allow-downloads"), l.addEventListener("load", () => {
       var d;
       (d = this.shadowRoot) == null || d.dispatchEvent(