Merge branch 'develop' into docs/redesigned-landing

Author: CodeDoctorDE

.github/workflows/build.yml

@@ -10,9 +10,16 @@ on:
   release:
     types: [published]
   pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.ref_type == 'branch' }}
+
 jobs:
   build-apk:
-    concurrency: ci-${{ github.ref }}
     defaults:
       run:
         working-directory: app
@@ -23,7 +30,7 @@ jobs:
       - name: 🔧 Setup java
         uses: actions/setup-java@v5
         with:
-          java-version: "17"
+          java-version: "21"
           distribution: "temurin"
       - name: 🦀 Setup Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
@@ -561,6 +568,8 @@ jobs:
   deploy:
     runs-on: ubuntu-24.04
     if: github.event_name != 'pull_request'
+    permissions:
+      contents: write
     outputs:
       version: ${{ steps.setup.outputs.BUTTERFLY_VERSION }}
       build_number: ${{ steps.setup.outputs.BUTTERFLY_BUILD_NUMBER }}
@@ -891,7 +900,7 @@ jobs:
       - name: 🔧 Setup java
         uses: actions/setup-java@v5
         with:
-          java-version: "17"
+          java-version: "21"
           distribution: "temurin"
       - uses: subosito/flutter-action@v2.23.0
         with:

.github/workflows/calibreapp-image-actions.yml

@@ -8,18 +8,28 @@ on:
       - '**.jpeg'
       - '**.png'
       - '**.webp'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: compress-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   build:
     # Only run on Pull Requests within the same repository, and not from forks.
     if: github.event.pull_request.head.repo.full_name == github.repository
     name: calibreapp/image-actions
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v7
 
       - name: Compress Images
-        uses: calibreapp/image-actions@main
+        uses: calibreapp/image-actions@2a254d926beda392b8c36e1be95252aa3d534405 # main
         with:
           # The `GITHUB_TOKEN` is automatically generated by GitHub and scoped only to the repository that is currently running the action. By default, the action can’t update Pull Requests initiated from forked repositories.
           # See https://docs.github.com/en/actions/reference/authentication-in-a-workflow and https://help.github.com/en/articles/virtual-environments-for-github-actions#token-permissions

.github/workflows/compress-images.yml

@@ -5,16 +5,26 @@ on:
   workflow_dispatch:
   schedule:
     - cron: "00 23 * * 0"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: compress-images
+  cancel-in-progress: false
+
 jobs:
   build:
     name: calibreapp/image-actions
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v7
       - name: Compress Images
         id: calibre
-        uses: calibreapp/image-actions@main
+        uses: calibreapp/image-actions@2a254d926beda392b8c36e1be95252aa3d534405 # main
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           compressOnly: true

.github/workflows/dart.yml

@@ -1,11 +1,20 @@
-name: Dart
+name: Dart quality
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: dart-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     strategy:
+      fail-fast: false
       matrix:
         projects: [app, api, tools]
     defaults:
@@ -14,6 +23,8 @@ jobs:
     steps:
       - name: ⬆️ Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: subosito/flutter-action@v2.23.0
         with:
           flutter-version-file: app/pubspec.yaml
@@ -23,8 +34,7 @@ jobs:
           dart --version
           flutter --version
       - name: Install dependencies
-        run: |
-          flutter pub get
+        run: flutter pub get
       - name: Run flutter gen-l10n
         if: matrix.projects == 'app'
         run: |
@@ -35,8 +45,7 @@ jobs:
         run: dart format --output=none --set-exit-if-changed lib
       # Consider passing '--fatal-infos' for slightly stricter analysis.
       - name: Analyze project source
-        run: |
-          flutter analyze --fatal-infos
+        run: flutter analyze --fatal-infos
       - name: Run build_runner
         if: matrix.projects != 'tools'
         run: dart run build_runner build --delete-conflicting-outputs

.github/workflows/deploy.yml

@@ -1,20 +1,30 @@
 name: Deploy documentation
 
 on:
-  # Trigger the workflow every time you push to the `main` branch
-  # Using a different branch name? Replace `main` with your branch’s name
   push:
-  # Allows you to run this workflow manually from the Actions tab on GitHub.
+    branches:
+      - develop
+      - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     defaults:
       run:
         working-directory: docs
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -26,7 +36,7 @@ jobs:
           cache: "pnpm"
           cache-dependency-path: docs/pnpm-lock.yaml
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - name: Build
         run: pnpm build
       - name: Deploy to SFTP
@@ -44,12 +54,15 @@ jobs:
           rsync -avz --delete -e "ssh -i sftp_key -o UserKnownHostsFile=known_hosts" dist/ $SFTP_USERNAME@$SFTP_HOST:/var/www/butterfly.linwood
   web:
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     defaults:
       run:
         working-directory: app
     steps:
       - name: ⬆️ Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: subosito/flutter-action@v2.23.0
         with:
           flutter-version-file: app/pubspec.yaml
@@ -65,7 +78,7 @@ jobs:
         working-directory: .
         run: dart run tools/build_onenote_web.dart
       - name: Get Git Commit Hash
-        run: echo "GIT_HASH=$(git rev-parse HEAD)" >> $GITHUB_ENV
+        run: echo "GIT_HASH=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
       - name: Set flavor
         if: github.ref != 'refs/heads/main'
         run: |

.github/workflows/release.yml

@@ -13,6 +13,13 @@ on:
         type: boolean
         required: false
 
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   update-changelog:
     runs-on: ubuntu-24.04

.github/workflows/update-screenshots.yml

@@ -10,9 +10,14 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  group: update-screenshots
+  cancel-in-progress: false
+
 jobs:
   update-screenshots:
     runs-on: ubuntu-24.04
+    timeout-minutes: 60
     steps:
       - name: Checkout repo
         uses: actions/checkout@v7
@@ -41,7 +46,7 @@ jobs:
 
       - name: Compress generated screenshots
         id: calibre
-        uses: calibreapp/image-actions@main
+        uses: calibreapp/image-actions@2a254d926beda392b8c36e1be95252aa3d534405 # main
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           compressOnly: true

CHANGELOG.md

@@ -1,6 +1,26 @@
 # Changelog
 
-<!--ENTER CHANGELOG HERE-->
+<!--ENTER CHANGELOG HERE-->
+
+## 2.6.0-beta.3 (2026-07-27)
+
+* Add shear property for elements
+* Add camera rotation support ([#977](https://github.com/LinwoodDev/Butterfly/issues/977))
+* Add custom fonts to label ([#1011](https://github.com/LinwoodDev/Butterfly/issues/1011))
+* Add option to customize default file name globally and in template ([#1041](https://github.com/LinwoodDev/Butterfly/issues/1041))
+* Add flip horizontal and vertical to all elements ([#1058](https://github.com/LinwoodDev/Butterfly/issues/1058))
+* Improve negative scaling
+* Improve rotated elements transformtion ([#1099](https://github.com/LinwoodDev/Butterfly/issues/1099))
+* Improve rendering reliability if baking fails
+* Fix embed/web loading errors ([#1167](https://github.com/LinwoodDev/Butterfly/issues/1167))
+* Fix file previews resetting the language to the system locale
+* Fix filename preview appearing when renaming existing documents
+* Fix navigation menus broken on mobile layout ([#1177](https://github.com/LinwoodDev/Butterfly/issues/1177))
+* Fix creating packs from the selection menu ([#1178](https://github.com/LinwoodDev/Butterfly/issues/1178))
+* Fix moving collection elements to layers ([#1176](https://github.com/LinwoodDev/Butterfly/issues/1176))
+* Fix unreliable keyboard shortcuts after loading toolbars ([#1186](https://github.com/LinwoodDev/Butterfly/issues/1186))
+
+Read more here: https://linwood.dev/butterfly/2.6.0-beta.3
 
 ## 2.6.0-beta.2 (2026-07-13)
 

SECURITY.md

@@ -4,7 +4,7 @@
 
 | Version                    | Supported          |                                                                               |
 | -------------------------- | ------------------ | ----------------------------------------------------------------------------- |
-| 2.6-dev (Dreamy Duskywing) | :warning:          | [Release](https://github.com/LinwoodDev/butterfly/releases/tag/v2.6.0-beta.2) |
+| 2.6-dev (Dreamy Duskywing) | :warning:          | [Release](https://github.com/LinwoodDev/butterfly/releases/tag/v2.6.0-beta.3) |
 | 2.5.4 (Crimson Red)        | :white_check_mark: | [Release](https://github.com/LinwoodDev/butterfly/releases/tag/v2.5.4)        |
 | 2.4.4 (Black Hairstreak)   | :x:                | [Release](https://github.com/LinwoodDev/butterfly/releases/tag/v2.4.4)        |
 | 2.3.4 (Adonis Blue)        | :x:                | [Release](https://github.com/LinwoodDev/butterfly/releases/tag/v2.3.4)        |