The retry logic in proxy_request is changed from a finite loop with max_retries to an infinite while loop that only retries on 5xx server errors or exceptions, removing the max_retries parameter and the fallback 503 error response.
Implement saveScrollState, restoreScrollState, and clearScrollState methods in RantFeed component, storing anchor rant ID and scroll offset per page. Wire up initFeed calls in CollabsPage, HomePage, StoriesPage, WeeklyPage, and SearchPage to set unique state keys (feed_state_collabs, feed_state_home, etc.) enabling seamless scroll restoration on navigation back.
Introduce an 'external' attribute on the image-preview component to bypass the devrant image URL builder when the source is an external link. Update the component's observed attributes, rendering logic, and lightbox initialization to conditionally use the raw src URL. Modify rant-content to detect external images via the presence of links and pass the external flag accordingly.
Move the '..' detection to operate on the raw path string before normalization, ensuring path traversal attempts are caught even when normpath would collapse them. Also apply the same early check to api_parsed_url.path in proxy_request, preventing bypass via normalized path segments.
The notification item component was incorrectly accessing `notif.username` directly instead of `notif.username.name`, causing undefined values to appear in the notification display when the username field contained an object with a `name` property. Added a console.info statement for debugging and corrected the property chain to properly extract the display name from nested object structures.
- Add notifyAuthChange() call after successful token validation in setAuthFromToken
- Fetch user profile during login to obtain canonical username instead of using raw input
- Update both authData and currentUser objects with resolved username from profile API
- Handle profile fetch failure gracefully by falling back to provided username
