mirror of
https://github.com/penpot/penpot.git
synced 2026-09-18 09:27:45 -04:00
The anonymous get-view-only-bundle RPC merged each linked library whole, exposing library pages the share link never granted. For share-link permissions, each library is now reduced to the narrow data keys with its own pages dropped and only the components referenced by the allowed pages kept (nested references followed); membership bundles are unchanged. Closes #11617 AI-assisted-by: muse-spark-1.3-contributor