v2.5.9

## What's Changed

- chore: bump v2.5.9 and update README for recent features (#398)
- fix: sort supply chain chokepoints by disruption score descending (#399)
- fix: sort tariff datapoints newest-first and fix cachedFetchJson test (#400)
- fix: restore Linux AppImage updater routing and fallback port reporting (#397)
- feat: add global streaming video quality setting (#365) (#396)
- fix: Linux AppImage crashes, RSS proxy 403s, and console noise (#395)
- ci: add TypeScript type-check workflow on PRs (#394)
- feat: add Ransomware.live RSS feed to cyber/security sources (#392)
- fix: restore FilterSpecification type annotation on country highlight filters (#393)
- fix: keep flat news on cluster failure and fix deckgl filter typing (#382)
- fix: supply chain panel bugs — invalid FRED series, global banner, feature gate (#391)
- fix: respect Browser Local Model toggle — skip ML worker init when disabled (#390)
- feat: dynamic sidecar port with EADDRINUSE fallback  + let scoping bug (#375)
- feat: add Supply Chain Disruption Intelligence service (#387)
- fix: eliminate cache stampede across all server handlers (#389)
- fix: trade policy panel visual overhaul and false unavailable banner (#385)
- fix: economic panel showing wrong values and unresponsive tabs (#384)
- fix: correct trade policy panel data display issues (#383)
- fix: add diagnostic logging to WTO API fetch for silent failures (#376)
- fix: use cachedFetchJson for WTO endpoints + add 10-min refresh schedule (#373)
- fix: WTO API indicator codes, disable giving panel, update README (#371)
- Add WTO trade policy intelligence service with tariffs, flows, and barriers (#364)
- Add BIS central bank data integration (policy rates, exchange rates, credit) (#363)
- fix: filter deck.gl Uint8Array WebGL pick noise in Sentry (#362)
- fix: improve API key signup link discoverability in settings (#361)
- fix: RSS proxy allowlist + add 9 new positive news feeds (#360)
- chore: bump version to 2.5.8 and align README with recent features (#359)
- feat: add trade route & chokepoint visualization layer (#358)
- fix: add redirect target domains to RSS proxy allowlist (#357)
- chore: remove .claudedocs + tighten Sentry noise filters (#356)
- feat: country commands + command palette UX improvements (#355)
- fix: guard data-loader against post-destroy work (#353)
- perf: reduce OpenSky API calls from 4 to 2 via merged query regions (#352)
- fix: desktop updater toast notification + XSS hardening (#351)
- feat: add command palette to Cmd+K search modal (#350)
- fix: narrow markdown lint scope to product docs only (#349)
- security: harden IPC, gate DevTools, isolate external windows, exempt /api/version (#348)
- feat: HappyMonitor — positive news dashboard (happy.worldmonitor.app) (#229)
- fix: suppress notification sound when alerts disabled + bump v2.5.7 (#346)
- perf: defer YouTube/map init and stagger data loads to reduce blocking time (#287) (#345)
- Security hardening: SSRF protection, auth gating, and token generation (#343)
- feat: universal country detection — CII scoring for all countries (#344)
- fix: prevent entity conflation in pane summarization (#341)
- fix: prevent entity conflation in pane summarization (#339)
- fix: add Mexico to COUNTRY_BOUNDS and COUNTRY_ALIASES for brief news/geo matching (#338)
- fix: add Mexico to CII scoring (TIER1, keywords, ports, mappings) (#337)
- fix: make OpenSky cache TTLs env-configurable, bump positive to 60s (#333)
- fix: serialize OpenSky requests with global 429 cooldown (#332)
- fix: replace RSSHub feeds with native/Google News alternatives (#331)
- fix: OpenSky auth resilience — retry, IPv4, no negative cache on auth fail (#329)
- Harden Railway relay auth, caching, and proxy routing (#320)
- feat: add Mexico as CII hotspot for cartel/security monitoring (#327)
- feat: add Mexico and LatAm security feeds for instability coverage (#325)
- fix: add CARTO and OpenStreetMap attribution to map (#323)
- feat: add category pills and search filter to Panels tab (#322)
- feat: consolidate settings into unified tabbed modal with variant-aware source regions (#319)
- chore: remove unused WORLDPOP_API_KEY from .env.example (#318)
- feat: add Island Times (Palau) RSS feed for Asia Pacific coverage (#317)
- Add AI Flow settings popup for web-only AI provider control (#314)
- fix: add Sentry noise filters and extend deck.gl crash suppression (#316)
- fix: add drag cleanup handlers and suppress click after drag-drop (#315)
- fix: replace HTML5 drag API with mouse events for WKWebView compatibility (#313)
- feat: add Bild RSS feed scoped to German locale (#312)
- fix: open channel settings as inline modal instead of separate window (#311)
- fix: add missing country brief i18n keys and export PDF option (#308)
- fix: add Greek flag mapping to language selector (#307)
- fix: add Greek flag mapping to language selector (#305)
- fix: add missing country brief i18n keys and export PDF option (#306)
- Build/runtime hardening and dependency security updates (#286)
- fix: harden embed postMessage origin check and add channel validation (#302)
- fix: increase live channels window size to fit channel grid (#301)
- test: add Playwright e2e tests for flushStaleRefreshes (#280)
- fix: sync YouTube live panel mute state with native player controls (#285)
- fix: strip Ollama reasoning tokens and plain-text thinking from summaries (#299)
- fix: open external links in system browser on Tauri desktop (#297)
- fix: add User-Agent and Cloudflare 403 detection to all secret validation probes (#296)
- feat(live): optional channels with tab-based region browse UI (#295)
- fix: infra cost optimizations round 2 — polling, TTLs, ACLED dedup (#275)
- fix: enforce military bbox filtering and add behavioral cache tests (#284)
- fix: infrastructure cost optimizations across caching, polling, and batching (#283)
- feat(live): custom channel management with review fixes (#282)
- fix: circuit breaker persistent cache with safety fixes (#281)
- fix: immediately refresh stale services when tab regains focus (#277)
- chore: bump version to 2.5.6 with changelog (#272)
- feat: add Nigeria feeds and Greek locale feeds (#271)
- fix: add negative caching + cascade-resistant dedup to RSS proxy (#270)
- Add Brasil Paralelo source (#260)
- Fix GLib symbol mismatch when running as AppImage on newer distros (#263)
- Optimize AIS relay: backpressure queue, spatial indexing, response caching (#266)
- fix: allow http:// origin from tauri.localhost for Windows CORS (#262)
- feat: add Greek (Ελληνικά) locale (#256)
- fix: whitelist social preview bots + restrict SW routes to same-origin (#251)
- fix: restrict SW route patterns to same-origin only (#247)

**Full Changelog**: https://github.com/koala73/worldmonitor/compare/v2.5.5...v2.5.9