Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide.
Changelog
New features, architectural changes and improvements to the template.
AI assistant and one tool catalog
The assistant, MCP and agent-readable pages now share the application’s authorized operations.
The web assistant adds persisted Threads, streamed responses and explicit approval for mutating tools. Tool execution uses one server catalog shared with MCP, preserving current Session and Organization authorization. Provider configuration and the ai.assistant flag jointly control availability.
Agent discovery now exposes public instructions and Markdown pages alongside OAuth connection metadata. The supported transport keeps TanStack AI’s Promise/SSE lifecycle separate from the Effect job boundary.
Dependency round, i18next fix and ReUI controls
Eligible packages advance under the two-day quarantine, a reachable i18next ReDoS is patched and six free ReUI controls join the UI package.
i18next 26.4.4 fixes GHSA-5jr9-983r-c8x4, a ReDoS reachable through the intl package. The expired TanStack quarantine exceptions were removed, so the workspace keeps its 2880-minute minimumReleaseAge with no exclusions. Vulnerable transitive ranges such as hono, qs, undici and @modelcontextprotocol/sdk were re-resolved within their declared ranges.
Direct pins advance for zod, vitest, TanStack Query and Table, evlog, lucide-react, the AWS S3 clients and Takumi 2.15.1. files-sdk 2.6.2 drops the error-identity workaround; the rebased patch keeps upload authorization, Organization prefix, declared size/type and conditional-create checks. Wrangler, the Vite plugin, oxlint and turbo stayed on their previous versions until their releases qualify.
The UI package adds free ReUI time-picker, color-picker, signature-pad, file-type, emoji-picker and cascader components with explicit exports. The cascader brings @tanstack/react-virtual. EmojiPicker loads emojibase-data from jsDelivr unless local data is passed.
Sources: security fix, package bumps, transitive ranges, ReUI controls.
Developer documentation and changelog
The Worker now serves searchable developer guides, imported ADRs and a curated changelog at /docs.
/docs renders guides for setup, architecture, features and every workspace package, plus the original ADRs and the agent connection guide. Fumadocs runs headless: fumadocs-core and fumadocs-mdx compile MDX at build time, articles render on the server and search uses the existing command palette. Every page also has a Markdown version and is listed in llms.txt and the sitemap.
The changelog backfills curated releases from June to October 2026, with individual pages and an RSS feed. scripts/changelog-draft.mjs prints candidate commits since the latest entry for human curation.
Sources: developer docs, changelog.
Earlier releases
- Documents and large uploads
- Landing page redesign
- Trace and code block primitives
- TanStack Start 1.0, OG images and durable imports
- Payments, native screens and a new landing page
- Runtime and recovery hardening
- Authentication foundations and performance
- Platform dependency alignment
- oRPC and Drizzle upgrades
- Typed domain operations and a real dashboard
- Agent connections and native account security
- Cloudflare email and shared UI
- An enforced client/server boundary
- Native interface foundations
- Administration and data workflows
- Setup, storage and localization
Edit on GitHubDocumentation is in English.