Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide.
Changelog
New features, architectural changes and improvements to the template.
Authentication rate limits
Credential endpoints are rate limited in production.
Credential endpoints are now rate limited in production. The Worker previously left the limiter off because it does not set NODE_ENV. get-session and jwks remain free of rate-limit database writes. See Rate limits and PR #196.
Server session cache
Ordinary server requests use Better Auth's signed session snapshot.
Server requests use the signed Session snapshot for up to 60 seconds, avoiding one session statement on a todo.list cache hit. The scenario B latency change was within local noise. Revocation on another device can take up to a minute for ordinary data. Membership removal remains immediate. Webhook endpoint changes and OAuth connection revocation read the current database session. The files gateway reads the membership directly. See Session reads and PR #195.
Bklit is the only chart library, Stageshow the only way to draw product UI
The unused shadcn chart wrapper and Recharts are gone, a test refuses any other chart library on the web, and faux product UI on landing, marketing and docs pages is built with Stageshow.
Two design defaults are now rules, stated in AGENTS.md, CODING_STANDARDS.md and on Design patterns. Every chart, sparkline and KPI or stat card on the web comes from Bklit UI, through the @bklit registry and the bklit-ui, bklit-ui-design and bklit-ui-migrate skills. Faux product UI on landing, marketing and docs pages (stills, feature cards, cursor demos, bento grids) is built with Stageshow and ships only after its loop passes film.mjs --gate.
The shadcn chart wrapper in packages/ui and the recharts dependency of apps/web and packages/ui are removed. Nothing imported them, so the built client and Worker are byte-identical, and an install fetches 35 fewer packages. scripts/web-chart-library.test.mjs runs in pnpm test and fails when apps/web/src or packages/ui/src imports Recharts, Chart.js, Nivo, Victory, visx, ECharts, ApexCharts, Highcharts, Tremor or a similar library, or when their package.json lists one. It is a test rather than a lint rule because an oxlint entry would replace the client boundary; see Enforcement. The Stageshow rule is held in review, with a new item in the Review checklist.
Bklit renders for React on the web only, so the Expo app is outside the rule. Its charts use victory-native, or Swift Charts through @expo/ui on an iOS-only screen. The dashboard KPI cards and the hand-built fragments of the landing feature board predate the rules and move to Bklit and Stageshow when they are reworked.
Earlier releases
- Signed-in navigation no longer waits on the session read
- Skullet is the only way to draw a loading skeleton
- Agent skills from upstream, Expo's renamed skills, and three updates held back
- Code is written in English
- The consent banner paints from the HTML, repeat visits skip revalidation, and real Web Vitals
- Dates in your time zone, without a hydration error
- Public pages paint before any JavaScript arrives
- Better Auth 1.7.16 security fix and dependency round
- Animated assistant approval on the landing, and a design patterns page
- Loading skeletons drawn from the real components
- Invitations are not a mail relay
- MCP Apps widget, approval status and plugin marketplaces
- One URL per language
- Account emails in React Email, in English, German and French
- Share cards, Markdown negotiation and one site identity
- TanStack AI 1.0, password forms and iPhone Duo
- Agent skills from upstream and the /pr template
- Ponytail from the official plugin
- One folder per backend feature, tagged errors and written rules
- One folder per mobile feature, and the API aliases are gone
- The web app is organized by feature, like the backend
- Auth and tenant security fixes
- Database, Worker and web performance
- Row-level security per Organization
- AI assistant and one tool catalog
- Dependency round, i18next fix and ReUI controls
- Developer documentation and changelog
- Documents and large uploads
- Landing page redesign
- Landing sections and project skills
- Trace and code block primitives
- TanStack Start 1.0, OG images and durable imports
- Payments, native screens and a new landing page
- Runtime and recovery hardening
- Authentication foundations and performance
- Platform dependency alignment
- oRPC and Drizzle upgrades
- Typed domain operations and a real dashboard
- Agent connections and native account security
- Cloudflare email and shared UI
- An enforced client/server boundary
- Native interface foundations
- Administration and data workflows
- Setup, storage and localization
Edit on GitHubDocumentation is in English.