# Changelog

New features, architectural changes and improvements to the template.

Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide.


## Security and backend quick wins

2026-11-13

Cross-site writes to the API are refused, production stops trusting the development app scheme, purge needs an owner or admin, and jobs and migrations fail more safely.

- **Cross-site writes to `/api/rpc` are refused.** A write whose `Origin` is neither the request's origin nor `BETTER_AUTH_URL`'s now gets HTTP 403. So does a write with no `Origin` that `Sec-Fetch-Site` marks as `cross-site` or `same-site`. This covers the OpenAPI mirror. A PR preview on a sibling subdomain can no longer write with a production cookie. The native app, scripts and server-to-server calls send neither header and are unaffected. See [API](/docs/features/api).
- **Production no longer trusts `<scheme>-dev://`.** No production app registers the development build's scheme, so any app could claim a password-reset token sent there. The scheme is trusted in development, and on previews through the new preview-only switch `NATIVE_DEV_SCHEME=1`. Set it in `apps/web/.dev.vars` to sign a development build into a local built Worker. See [Runtime switches](/docs/development/environments#runtime-switches).
- **Only owners and admins can purge the trash,** and purge now checks the database session. The files gateway also no longer reuses a snapshot-authorized tenant where it asked for the database session. See [Files](/docs/features/files).
- **`BETTER_AUTH_SECRET` must be at least 32 characters.** `pnpm setup` already generates 44. A shorter secret now fails the production deploy before migrations, and the preview secrets step refuses it, so the running Worker is never replaced by one that refuses to boot. Changing a short secret signs every user out.
- **The cron tick is observable.** Each failed job logs one `jobs.step_failed` line with the type and code of its cause, never a message. Every tick logs one `jobs.tick` line: settled with counts, interrupted by the deadline, or failed. See [Scheduled jobs](/docs/features/scheduled-jobs).
- **Job and migration lock waits end on the server.** The job pool's `lock_timeout` (1 s) and `statement_timeout` (1.5 s) now fire before its 2 s client timeout. A claim reported as failed can no longer commit later. The migration runner takes a transaction-scoped advisory lock per folder, which is safe on a pooled connection, and gives up a table lock after 5 seconds instead of queueing traffic behind it. See [Database](/docs/features/database).

[PR #201](https://github.com/CarlosZiegler/bjj-travel/pull/201)


## Authentication rate limits

2026-11-09

Credential endpoints are rate limited in production.

Credential endpoints are now rate limited in production. The Worker previously left the limiter off because it does not set `NODE_ENV`. `get-session` and `jwks` remain free of rate-limit database writes. See [Rate limits](/docs/features/auth#rate-limits) and [PR #196](https://github.com/CarlosZiegler/bjj-travel/pull/196).


## Server session cache

2026-11-09

Ordinary server requests use Better Auth's signed session snapshot.

Server requests use the signed Session snapshot for up to 60 seconds, avoiding one session statement on a `todo.list` cache hit. The scenario B latency change was within local noise. Revocation on another device can take up to a minute for ordinary data. Membership removal remains immediate. Webhook endpoint changes and OAuth connection revocation read the current database session. The files gateway reads the membership directly. See [Session reads](/docs/features/auth#session-reads) and [PR #195](https://github.com/CarlosZiegler/bjj-travel/pull/195).


## Earlier updates

- 2026-11-07: [Bklit is the only chart library, Stageshow the only way to draw product UI](/docs/changelog/2026-11-07-bklit-and-stageshow-only)
- 2026-11-07: [Signed-in navigation no longer waits on the session read](/docs/changelog/2026-11-07-session-reads)
- 2026-11-07: [Skullet is the only way to draw a loading skeleton](/docs/changelog/2026-11-07-skullet-only-skeletons)
- 2026-11-06: [Agent skills from upstream, Expo's renamed skills, and three updates held back](/docs/changelog/2026-11-06-agent-skills-update)
- 2026-11-06: [Code is written in English](/docs/changelog/2026-11-06-code-in-english)
- 2026-11-06: [The consent banner paints from the HTML, repeat visits skip revalidation, and real Web Vitals](/docs/changelog/2026-11-06-web-quick-wins)
- 2026-11-05: [Dates in your time zone, without a hydration error](/docs/changelog/2026-11-05-dates-in-your-time-zone)
- 2026-11-05: [Public pages paint before any JavaScript arrives](/docs/changelog/2026-11-05-first-paint)
- 2026-11-04: [Better Auth 1.7.16 security fix and dependency round](/docs/changelog/2026-11-04-better-auth-security-dependency-round)
- 2026-11-04: [Animated assistant approval on the landing, and a design patterns page](/docs/changelog/2026-11-04-landing-assistant-demo)
- 2026-11-04: [Loading skeletons drawn from the real components](/docs/changelog/2026-11-04-skullet-skeletons)
- 2026-10-29: [Invitations are not a mail relay](/docs/changelog/2026-10-29-invitation-relay)
- 2026-10-29: [MCP Apps widget, approval status and plugin marketplaces](/docs/changelog/2026-10-29-mcp-apps-widget-approval-status)
- 2026-10-29: [One URL per language](/docs/changelog/2026-10-29-path-locales)
- 2026-10-29: [Account emails in React Email, in English, German and French](/docs/changelog/2026-10-29-react-email)
- 2026-10-29: [Share cards, Markdown negotiation and one site identity](/docs/changelog/2026-10-29-seo-agent-readiness)
- 2026-10-27: [TanStack AI 1.0, password forms and iPhone Duo](/docs/changelog/2026-10-27-deps-password-forms-iphone-duo)
- 2026-10-19: [Agent skills from upstream and the /pr template](/docs/changelog/2026-10-19-agent-skills-update)
- 2026-10-19: [Ponytail from the official plugin](/docs/changelog/2026-10-19-ponytail-plugin)
- 2026-10-17: [One folder per backend feature, tagged errors and written rules](/docs/changelog/2026-10-17-backend-structure)
- 2026-10-17: [One folder per mobile feature, and the API aliases are gone](/docs/changelog/2026-10-17-mobile-structure)
- 2026-10-17: [The web app is organized by feature, like the backend](/docs/changelog/2026-10-17-web-structure)
- 2026-10-16: [Auth and tenant security fixes](/docs/changelog/2026-10-16-auth-and-security-fixes)
- 2026-10-16: [Database, Worker and web performance](/docs/changelog/2026-10-16-performance-and-placement)
- 2026-10-16: [Row-level security per Organization](/docs/changelog/2026-10-16-row-level-security)
- 2026-10-15: [AI assistant and one tool catalog](/docs/changelog/2026-10-15-assistant-and-agent-tools)
- 2026-10-15: [Dependency round, i18next fix and ReUI controls](/docs/changelog/2026-10-15-dependency-round-and-reui)
- 2026-10-15: [Developer documentation and changelog](/docs/changelog/2026-10-15-developer-docs-and-changelog)
- 2026-10-15: [Documents and large uploads](/docs/changelog/2026-10-15-documents-and-large-uploads)
- 2026-10-15: [Landing page redesign](/docs/changelog/2026-10-15-landing-redesign)
- 2026-10-15: [Landing sections and project skills](/docs/changelog/2026-10-15-landing-sections-and-project-skills)
- 2026-10-14: [Trace and code block primitives](/docs/changelog/2026-10-14-trace-and-code-blocks)
- 2026-10-13: [TanStack Start 1.0, OG images and durable imports](/docs/changelog/2026-10-13-start-og-and-imports)
- 2026-10-12: [Payments, native screens and a new landing page](/docs/changelog/2026-10-12-payments-and-native-experience)
- 2026-10-03: [Runtime and recovery hardening](/docs/changelog/2026-10-03-runtime-and-recovery)
- 2026-09-25: [Authentication foundations and performance](/docs/changelog/2026-09-25-auth-and-performance)
- 2026-09-24: [Platform dependency alignment](/docs/changelog/2026-09-24-platform-dependencies)
- 2026-09-03: [oRPC and Drizzle upgrades](/docs/changelog/2026-09-03-typed-api-upgrade)
- 2026-08-25: [Typed domain operations and a real dashboard](/docs/changelog/2026-08-25-typed-domain-and-dashboard)
- 2026-08-24: [Agent connections and native account security](/docs/changelog/2026-08-24-agent-connections-and-account-security)
- 2026-08-13: [Cloudflare email and shared UI](/docs/changelog/2026-08-13-email-and-ui)
- 2026-07-30: [An enforced client/server boundary](/docs/changelog/2026-07-30-client-boundary)
- 2026-07-24: [Native interface foundations](/docs/changelog/2026-07-24-native-foundation)
- 2026-07-13: [Administration and data workflows](/docs/changelog/2026-07-13-admin-and-data-workflows)
- 2026-06-10: [Setup, storage and localization](/docs/changelog/2026-06-10-setup-storage-and-i18n)