# Changelog

New features, architectural changes and improvements to the template.

Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide.


## Better Auth 1.7.16 security fix and dependency round

2026-11-04

Better Auth 1.7.16 closes a critical account takeover through the Expo authorization proxy, the iPhone Duo tab bar becomes a rail, and the dependency round brings Effect 4.1, Takumi 2.19, oRPC beta.48 and Expo SDK 58.0.23 patches.

Better Auth moves to 1.7.16. Its `expo()` plugin, which the template registers for the native app, exposed an authorization proxy that signed a value taken from the request with the application secret (GHSA-4wq4-2ppv-q3hg, critical): anyone who knew an account's email address could forge a verification link and sign in as that user. The same release stops an organization admin from inviting an owner through a role name with extra whitespace (GHSA-c85h-5mrr-mgx4). The other ten advisories of that release need plugins or options the template does not use. The release was under two days old, so its exact versions sit in `minimumReleaseAgeExclude` until 2026-11-05 21:24 UTC. A project created from the template that has been deployed should upgrade and then rotate `BETTER_AUTH_SECRET`; with users and two-factor enabled, pass the new secret in `secrets` and keep the old one as `BETTER_AUTH_SECRET`, so stored TOTP secrets still decrypt.

On iPhone Duo, built with the iOS 27.1 SDK, the native tabs become a vertical rail beside the content when the device is folded or open in landscape. Screens read the rail from the side safe-area insets and stop reserving space for a bottom bar, the bar is no longer cleared twice when the safe area already reaches it, and the app imports `NativeTabs` from the stable `expo-router/native-tabs` path.

The dependency round moves Expo to the SDK 58.0.23 patches, Effect to 4.1.2 (the ADR-0006 fault gate gives the same result as 4.0.6), Takumi to 2.19.0 with a new `OG_VERSION`, oRPC to 2.0.0-beta.48, TanStack AI to 1.0.1, TanStack Query to 5.105.3, wrangler to 4.156.1 and a set of patch releases. The Worker is 78 KiB gzip larger.

- [Libraries](/docs/libraries)
- [Mobile app](/docs/features/mobile)

Sources: [Better Auth 1.7.16](https://github.com/CarlosZiegler/template-cloudflare/commit/26675533), [Expo patches](https://github.com/CarlosZiegler/template-cloudflare/commit/18dafe6c), [iPhone Duo rail](https://github.com/CarlosZiegler/template-cloudflare/commit/d16fe38d), [Effect 4.1.2](https://github.com/CarlosZiegler/template-cloudflare/commit/e0bb5fb8), [Takumi 2.19](https://github.com/CarlosZiegler/template-cloudflare/commit/21f5903f).


## Animated assistant approval on the landing, and a design patterns page

2026-11-04

The landing's in-app assistant tile now plays a short approval: the todo_create card asks, the cursor approves, the answer streams. It is built with the stageshow skill. A new page maps each design job to its source and agent skill, and the Bklit UI chart skills join the template.

The In-app assistant tile on the landing's feature board now shows the assistant asking before a write. The `todo_create` approval card drops into the thread, the cursor presses Approve, the trace turns to Completed and the answer streams in. The strings are the assistant's own locale keys in en, de and fr, and a note under the tile says it is an illustration, not a screen capture. The scene plays once when most of it is in view, pauses off screen, and shows its last frame under reduced motion. Phones get a tighter crop of the same thread.

The scene is built with the [stageshow](https://github.com/benjitaylor/skills) skill, now in `.agents/skills/stageshow`, for faux product UI on marketing pages. The kit parts the landing uses are vendored in `apps/web/src/platform/stageshow/`, trimmed to the arrow cursor, the default window chrome and the light and dark looks. The landing route grows by 13.4 KiB of gzip JS and 5.6 KiB of gzip CSS. Each trimmed file names what it left out, so a later scene can copy the rest back from the skill.

[Design patterns](/docs/development/design) is new: the three registers (Operate, Persuade, docs), which source each job uses and the rules that keep a rebrand cheap. Charts now come from [Bklit UI](https://bklit.com), whose `@bklit` registry is in `packages/ui/components.json`; its agent skills `bklit-ui`, `bklit-ui-design` and `bklit-ui-migrate` are installed, and `ui-catalog` routes chart work to them. No screen draws a chart yet, and the unused Recharts wrapper stays until one does.

- [Design patterns](/docs/development/design)

Sources: [assistant demo](https://github.com/CarlosZiegler/template-cloudflare/commit/9a10af15), [kit trim](https://github.com/CarlosZiegler/template-cloudflare/commit/2e35d00b).


## Loading skeletons drawn from the real components

2026-11-04

The web app's hand-built loading boxes are replaced by skullet: each loading state is measured from a sample of the component it stands in for, so nothing moves when the data arrives.

Every loading state in the authenticated web app is now drawn from the component it stands in for. [skullet](https://skullet.lochie.me) lays a sample of the real content out unseen, measures it and draws a bar for every line of text, a block for every control, in exactly the space the content will take; when the data lands the content crossfades into place and nothing moves. The sessions and passkeys cards in settings, the App Update form, the todo board and calendar, the dashboard KPI cards and activity feed, the files gallery, the sidebar account button and the billing page all use it. The shadcn `Skeleton` box stays only where `packages/ui` needs it internally.

The wrapper lives in `apps/web/src/platform/skeleton/`: `MeasuredSkeleton` adds the translated accessibility label, and one provider in the signed-in layout sets the reveal and the theme. The colours are tokens (`--skullet-base`, `--skullet-highlight` in `globals.css`), so dark mode follows the app's `.dark` class rather than the OS scheme, and the shimmer holds still under `prefers-reduced-motion`. Each feature keeps its sample in a `<feature>.samples.ts` file with filler text and clearly fake values; it is never read, only laid out. The library is a 19.6 KiB gzip chunk that only signed-in pages load, plus a few hundred bytes on each route that uses it; the landing and the other public pages do not download it. See [Design patterns](/docs/development/design) for where it sits among the other sources.


## Earlier updates

- 2026-10-29: [Invitations are not a mail relay](/docs/changelog/2026-10-29-invitation-relay)
- 2026-10-29: [MCP Apps widget, approval status and plugin marketplaces](/docs/changelog/2026-10-29-mcp-apps-widget-approval-status)
- 2026-10-29: [One URL per language](/docs/changelog/2026-10-29-path-locales)
- 2026-10-29: [Account emails in React Email, in English, German and French](/docs/changelog/2026-10-29-react-email)
- 2026-10-29: [Share cards, Markdown negotiation and one site identity](/docs/changelog/2026-10-29-seo-agent-readiness)
- 2026-10-27: [TanStack AI 1.0, password forms and iPhone Duo](/docs/changelog/2026-10-27-deps-password-forms-iphone-duo)
- 2026-10-19: [Agent skills from upstream and the /pr template](/docs/changelog/2026-10-19-agent-skills-update)
- 2026-10-19: [Ponytail from the official plugin](/docs/changelog/2026-10-19-ponytail-plugin)
- 2026-10-17: [One folder per backend feature, tagged errors and written rules](/docs/changelog/2026-10-17-backend-structure)
- 2026-10-17: [One folder per mobile feature, and the API aliases are gone](/docs/changelog/2026-10-17-mobile-structure)
- 2026-10-17: [The web app is organized by feature, like the backend](/docs/changelog/2026-10-17-web-structure)
- 2026-10-16: [Auth and tenant security fixes](/docs/changelog/2026-10-16-auth-and-security-fixes)
- 2026-10-16: [Database, Worker and web performance](/docs/changelog/2026-10-16-performance-and-placement)
- 2026-10-16: [Row-level security per Organization](/docs/changelog/2026-10-16-row-level-security)
- 2026-10-15: [AI assistant and one tool catalog](/docs/changelog/2026-10-15-assistant-and-agent-tools)
- 2026-10-15: [Dependency round, i18next fix and ReUI controls](/docs/changelog/2026-10-15-dependency-round-and-reui)
- 2026-10-15: [Developer documentation and changelog](/docs/changelog/2026-10-15-developer-docs-and-changelog)
- 2026-10-15: [Documents and large uploads](/docs/changelog/2026-10-15-documents-and-large-uploads)
- 2026-10-15: [Landing page redesign](/docs/changelog/2026-10-15-landing-redesign)
- 2026-10-15: [Landing sections and project skills](/docs/changelog/2026-10-15-landing-sections-and-project-skills)
- 2026-10-14: [Trace and code block primitives](/docs/changelog/2026-10-14-trace-and-code-blocks)
- 2026-10-13: [TanStack Start 1.0, OG images and durable imports](/docs/changelog/2026-10-13-start-og-and-imports)
- 2026-10-12: [Payments, native screens and a new landing page](/docs/changelog/2026-10-12-payments-and-native-experience)
- 2026-10-03: [Runtime and recovery hardening](/docs/changelog/2026-10-03-runtime-and-recovery)
- 2026-09-25: [Authentication foundations and performance](/docs/changelog/2026-09-25-auth-and-performance)
- 2026-09-24: [Platform dependency alignment](/docs/changelog/2026-09-24-platform-dependencies)
- 2026-09-03: [oRPC and Drizzle upgrades](/docs/changelog/2026-09-03-typed-api-upgrade)
- 2026-08-25: [Typed domain operations and a real dashboard](/docs/changelog/2026-08-25-typed-domain-and-dashboard)
- 2026-08-24: [Agent connections and native account security](/docs/changelog/2026-08-24-agent-connections-and-account-security)
- 2026-08-13: [Cloudflare email and shared UI](/docs/changelog/2026-08-13-email-and-ui)
- 2026-07-30: [An enforced client/server boundary](/docs/changelog/2026-07-30-client-boundary)
- 2026-07-24: [Native interface foundations](/docs/changelog/2026-07-24-native-foundation)
- 2026-07-13: [Administration and data workflows](/docs/changelog/2026-07-13-admin-and-data-workflows)
- 2026-06-10: [Setup, storage and localization](/docs/changelog/2026-06-10-setup-storage-and-i18n)