1.8.0 (2026-08-06) ⚠ BREAKING CHANGES deps: upgrade to React 19 + react-router 8 to clear remaining router CVE Features analytics: make Butina clustering molecule cap deployment-configurable (d84c3fd) Glass logo (27b11b3) profiler: enable SCScore via vendored weights + self-contained inference (009d221) security: add opt-in HMAC-signed admin tokens for replay resistance (360ef54) theme: add shared theme-aware chart color module (4f25f2c) ui: replace native window.prompt/confirm with accessible, testable React modals (0df42d0) Bug Fixes a11y: add dialog semantics and close-button label to ExportDialog (0bb1bd2) a11y: distinguish success/warning badges by icon and hue, not color alone (ed66a07) a11y: keyboard-operable switch, modal semantics, tooltip associations (497b703) a11y: raise text-muted contrast to WCAG AA in both themes (41b7760) about: address adversarial review of the distill pass (646d48d) accessibility P0, palette stragglers, and responsive corners from re-audit (e2cb165) address adversarial review findings from remediation pass (c9c49a2) batch: make ProgressTracker lazy Redis init thread-safe (a06f400) batch: narrow Celery autoretry_for to transient errors only (693ff3b) celery: add global task time limits to prevent worker starvation (5bce2c1) deps: bump dompurify >=3.4.11 and patch frontend audit findings (c86bc0f) deps: bump dompurify >=3.4.11 and patch frontend audit findings (a16142c) deps: bump joi to >=18.2.1 in docs-site (CVE-2026-48038) (5324d8e) deps: bump joi to >=18.2.1 in docs-site (CVE-2026-48038) (e4e7a4a) deps: cap fastapi <0.137 to avoid instrumentator route crash (053ff43) deps: cap fastapi <0.137 to avoid instrumentator route crash (937b7f0) deps: cap mcp <2 so the backend imports again (605e96e) deps: cap mcp <2 so the backend imports again (3c0a3b7) deps: force esbuild >=0.28.1 in frontend (GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr) (35c8b41) deps: force esbuild >=0.28.1 in frontend (GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr) (d78ce28) deps: fully resolve js-yaml alert by moving gray-matter to js-yaml 4 (0a347c1) deps: patch docs-site Dependabot alerts via npm overrides (f74abf4) deps: resolve all open Dependabot alerts (frontend + docs-site) (29b0080) deps: resolve all open Dependabot alerts in frontend and docs-site (86ce708) deps: resolve Dependabot security alerts in frontend and docs-site (f81646a) deps: resolve Dependabot security alerts in frontend and docs-site (236dfbd) deps: resolve open Dependabot alerts (postcss, js-yaml, brace-expansion, react-router) (d8e7b3a) deps: sync frontend lockfile after vitest 4 bump (00f17c0) deps: sync frontend lockfile after vitest 4 bump (9c155dc) deps: upgrade to React 19 + react-router 8 to clear remaining router CVE (b36cef5) frontend audit remediation (a11y, performance, responsive, theming) (e1e71ff) iupac: skip OPSIN re-init after failure to avoid inconsistent JVM state (03b6708) profiler: make SCScore unavailability observable + document NumPy 2.x enablement (11abdc6) profiler: validate SYBA SMILES input and make subprocess shell=False explicit (982e9cd) redis: bound memory and use volatile-lru so broker messages are never evicted (1f0ec2e) regressions found by adversarial sweep of the cleanup branch (bdf0b75) responsive: add mobile breakpoints to stat and comparison grids (daf3d0b) responsive: enforce 44px touch target on mobile menu button (0ea6ed8) responsive: mobile-safe dropdown and SMILES column, intermediate grid breakpoints (b84d09e) scoring: guard module-level sascorer imports against missing RDKit Contrib (e1afd70) security: escalate insecure-default warnings and add ALLOW_INSECURE_DEFAULTS gate (7f4a1cf) security: stop logging secret-named settings; document HMAC-SHA256 intent (b547823) theme: AlertGroupCard severity colors use status tokens with dark variants (ded142c) theme: batch and shared components use tokens; success is amber not green (b449847) theme: batch score histogram uses warm brand scale, not green (df65c6e) theme: integrations panels use surface/border tokens (e4c2fe0) theme: legible molecule renderings in dark mode via inversion filter (bb17acc) theme: NP-likeness reads red (synthetic) to green (natural) (ad44bb7) theme: replace decorative purple/indigo with brand palette (database identity colors kept) (1a66ea8) theme: retire green-for-success and cool score palettes; badge contrast to AA (2d2148b) theme: standardization components use surface/border tokens (d48c311) theme: warm gauge tracks and on-palette chart reference colors (cb62e41) ui: anchor auto-compare knob to the track's left edge (f7028ec) ui: inline delete confirmation, lucide icon swaps, copy and asset cleanup (01ae4c8) ux: scroll to top on link navigation app-wide (a7063c3) websockets: prevent duplicate broadcasts from superseded subscriber + add WS test suite (4cbfb5e) websockets: use redis aclose() instead of deprecated close() (b6ca465) Performance Improvements analytics: isolate expensive analytics on dedicated queue + worker with time limits (dc82cd1) batch: store results as Redis list for range-query pagination without full deserialize (f75fcc0) clustering: vectorize Tanimoto distance matrix with BulkTanimotoSimilarity (b6107bc) lazy-load scoring and standardization result panels on home page (c7bb63d) opacity-only ambient orbs, capped blur radii, reduced-motion support (ad5d20c) profiler: replace per-call SYBA subprocess with persistent worker (JSON pipe, restart, timeout) (24057f5) redis: use pooled singleton clients instead of per-call connections (30f0898) route-gate RDKit WASM init; skip splash on structure-free pages (ec20890) security: pin RDKit loader version, add SRI, defer parsing (29d627b) serve resized logo variants instead of 764KB original (8be0f74) skip offscreen row rendering in batch results table (3ead8ec) split recharts, framer-motion, gsap, and react vendor chunks (b0c9a10) validation: run blocking Celery task.get in executor to free event loop (a7a082a) Documentation add frontend audit remediation plan (224fa7d) plan: mark 2.5 SCScore done; all audit items now resolved (c790061) plan: mark 4.1 complete; reconcile 2.6/3.3/3.5 as done (were stale 'deferred') (e611777) plan: record #7 documented + #21 made configurable (gaps closed) (7affa7d) plan: record Wave 3 + Wave 4.3 completion and remaining-item status (2654fa0) plan: record Wave 4.2/4.4/4.5 completion + real-stack validation (c88f583) plan: record WS fail-open decision and Wave 2 completion status (91e6e1f) ws: document deliberate fail-open WebSocket ownership posture (b644e5a)