This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
Summary
AI summaryFixed silent schema stripping, validation cheat‑sheet mismatches, and tool description errors; added numeric string coercion, reference integrity checks, and security filter notes.
Full changelog
Model-facing DX release: every repair in this version targets the round-trips an AI wastes while talking to nakkas.
Fixed
- The slim registration schema silently stripped valid fields (such as
canvas.preserveAspectRatio) before the handler ran. Every object in it is now passthrough; the full schema in the handler is the single validation authority. - Validation cheat sheets taught field names that do not exist (
spacingX,size,freqX). They now match the real schemas, new hints cover arc-group, scatter-group and path-group, and a test cross-checks every hint against the schema shape. - Tool description corrections: hex-only applies to gradient stops and filter colors, not element fill/stroke; grid-group takes
cols/rows;epitrochoidadded to the parametric list; parametric size is set viascale.
Added
- Numeric string coercion on all number fields:
letterSpacing: "6"orstrokeWidth: "2.5"converts instead of failing, so CSS habits no longer cost a retry. - Reference integrity checks before rendering: dangling
url(#id)in fill/stroke/filter/clipPath/mask,use.hrefwith no target,textPath.pathIdmissing from defs, dangling gradienthrefinheritance and duplicate IDs are rejected with the exact field path and the list of defined IDs. - Attribute values blocked by the security filter now surface as a design note naming the omitted attribute instead of an stderr-only line.
Dogfood: pelican test (2026-07-07) — PASS
Releases now close with a pelican-on-a-bicycle run through the real MCP stdio layer against the fresh build: render, preview, critique, revise for at least three iterations, result saved dated into assets/. This round took 4 iterations and verified the repairs above live.
316 tests passing (20 new).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About arikusi/nakkas
MCP server that turns AI into an SVG artist. One rendering engine with JSON config, AI controls all design parameters. CSS @keyframes + SMIL animations, 16+ element types, parametric curves, filters, gradients, PNG preview.
Beta — feedback welcome: [email protected]