stupleb.xyz--:--:-- [ en | es ]

← blog

Penpot joins the registry

2026-10-05 · 2.18.2:0

Open-source design and prototyping for teams

# about

$ man penpot

Penpot is a browser-based design and prototyping tool. Lay out screens, link them into clickable prototypes, and share view links where collaborators leave comments on the design. Files, comments and uploads stay on your server.

upstream → website → package → MPL-2.0

# install

$ install penpot

startos
  1. In StartOS, open System → Registries, click Add registry and enter https://startos.stupleb.xyz.
  2. StartOS trusts the signing key the registry offers for installing packages.
  3. Pick StuPleb Registry in the Marketplace's registry selector and look for Penpot.

# releases

$ git log --oneline penpot

  • 2.19.1:02026-11-12Updated Penpot to 2.19.1, which fixes four security flaws: a team editor could get the link of any pending invitation, a share link could reveal who commented on pages it leaves out, any signed-in user could mark comment threads in other teams as read, and an uploaded SVG could run a script. Full release notes: https://github.com/penpot/penpot/releases/tag/2.19.1
  • 2.19.0:02026-11-10Updated Penpot to 2.19.0, with configurable keyboard shortcuts and many fixes. Requires StartOS 0.4.2 or later. Full release notes: https://github.com/penpot/penpot/releases/tag/2.19.0
  • 2.18.7:02026-11-09Updated Penpot to 2.18.7, which fixes a security flaw that let an imported file link to a library from another team. Existing links between a file and a library in another team are removed. Full release notes: https://github.com/penpot/penpot/releases/tag/2.18.7
  • 2.18.6:02026-11-06Updated Penpot to 2.18.6, which fixes a security flaw that let any signed-in user read files from the server. Requires StartOS 0.4.1 or later. Full release notes: https://github.com/penpot/penpot/releases/tag/2.18.6
  • 2.18.4:02026-10-25Updated Penpot to 2.18.4. Includes the October 2026 Node.js security fixes and the Brotli security fix (CVE-2026-111497). Fixes storage cleanup that deleted nothing or left files behind, and saving a version taking seconds. Full release notes: https://github.com/penpot/penpot/releases/tag/2.18.4
  • 2.18.3:12026-10-22Stops trusting certificates from a compromised certificate authority (eMudhra). Adds Forward Email to the SMTP provider presets.
  • 2.18.3:02026-10-10Penpot 2.18.3, with security fixes for SVG imports and team access (https://github.com/penpot/penpot/releases/tag/2.18.3). StartOS opens Penpot at its primary URL, and backups and restores of large databases run to completion.
  • 2.18.2:02026-10-05Initial release of Penpot 2.18.2 for StartOS.