# Changelog New features, architectural changes and improvements to the template. Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide. ## AI assistant and one tool catalog 2026-10-15 The assistant, MCP and agent-readable pages now share the application’s authorized operations. The web assistant adds persisted Threads, streamed responses and explicit approval for mutating tools. Tool execution uses one server catalog shared with MCP, preserving current Session and Organization authorization. Provider configuration and the `ai.assistant` flag jointly control availability. Agent discovery now exposes public instructions and Markdown pages alongside OAuth connection metadata. The supported transport keeps TanStack AI’s Promise/SSE lifecycle separate from the Effect job boundary. - [AI assistant and approvals](/docs/features/assistant) - [MCP server](/docs/features/mcp) and [connecting an agent](/docs/connect-your-agent) - [Agent-readable pages](/docs/features/agent-pages) [Source: assistant integration](https://github.com/CarlosZiegler/doro/commit/63e36e6) ## Dependency round, i18next fix and ReUI controls 2026-10-15 Eligible packages advance under the two-day quarantine, a reachable i18next ReDoS is patched and six free ReUI controls join the UI package. i18next 26.4.4 fixes [GHSA-5jr9-983r-c8x4](https://github.com/advisories/GHSA-5jr9-983r-c8x4), a ReDoS reachable through the intl package. The expired TanStack quarantine exceptions were removed, so the workspace keeps its 2880-minute `minimumReleaseAge` with no exclusions. Vulnerable transitive ranges such as `hono`, `qs`, `undici` and `@modelcontextprotocol/sdk` were re-resolved within their declared ranges. Direct pins advance for zod, vitest, TanStack Query and Table, evlog, lucide-react, the AWS S3 clients and Takumi 2.15.1. files-sdk 2.6.2 drops the error-identity workaround; the rebased patch keeps upload authorization, Organization prefix, declared size/type and conditional-create checks. Wrangler, the Vite plugin, oxlint and turbo stayed on their previous versions until their releases qualify. The UI package adds free ReUI `time-picker`, `color-picker`, `signature-pad`, `file-type`, `emoji-picker` and `cascader` components with explicit exports. The cascader brings `@tanstack/react-virtual`. EmojiPicker loads `emojibase-data` from jsDelivr unless local `data` is passed. - [Libraries and version policy](/docs/libraries) - [UI package](/docs/packages/ui) Sources: [security fix](https://github.com/CarlosZiegler/doro/commit/bea0767), [package bumps](https://github.com/CarlosZiegler/doro/commit/40e1390), [transitive ranges](https://github.com/CarlosZiegler/doro/commit/9c59445), [ReUI controls](https://github.com/CarlosZiegler/doro/commit/8fc6177). ## Developer documentation and changelog 2026-10-15 The Worker now serves searchable developer guides, imported ADRs and a curated changelog at /docs. `/docs` renders guides for setup, architecture, features and every workspace package, plus the original ADRs and the agent connection guide. Fumadocs runs headless: `fumadocs-core` and `fumadocs-mdx` compile MDX at build time, articles render on the server and search uses the existing command palette. Every page also has a Markdown version and is listed in `llms.txt` and the sitemap. The changelog backfills curated releases from June to October 2026, with individual pages and an RSS feed. `scripts/changelog-draft.mjs` prints candidate commits since the latest entry for human curation. - [Writing documentation](/docs/development/docs) - [Libraries and version policy](/docs/libraries) - [Architectural decisions](/docs/adr) Sources: [developer docs](https://github.com/CarlosZiegler/doro/commit/0247631), [changelog](https://github.com/CarlosZiegler/doro/commit/a165f29). ## Earlier updates - 2026-10-15: [Documents and large uploads](/docs/changelog/2026-10-15-documents-and-large-uploads) - 2026-10-15: [Landing page redesign](/docs/changelog/2026-10-15-landing-redesign) - 2026-10-14: [Trace and code block primitives](/docs/changelog/2026-10-14-trace-and-code-blocks) - 2026-10-13: [TanStack Start 1.0, OG images and durable imports](/docs/changelog/2026-10-13-start-og-and-imports) - 2026-10-12: [Payments, native screens and a new landing page](/docs/changelog/2026-10-12-payments-and-native-experience) - 2026-10-03: [Runtime and recovery hardening](/docs/changelog/2026-10-03-runtime-and-recovery) - 2026-09-25: [Authentication foundations and performance](/docs/changelog/2026-09-25-auth-and-performance) - 2026-09-24: [Platform dependency alignment](/docs/changelog/2026-09-24-platform-dependencies) - 2026-09-03: [oRPC and Drizzle upgrades](/docs/changelog/2026-09-03-typed-api-upgrade) - 2026-08-25: [Typed domain operations and a real dashboard](/docs/changelog/2026-08-25-typed-domain-and-dashboard) - 2026-08-24: [Agent connections and native account security](/docs/changelog/2026-08-24-agent-connections-and-account-security) - 2026-08-13: [Cloudflare email and shared UI](/docs/changelog/2026-08-13-email-and-ui) - 2026-07-30: [An enforced client/server boundary](/docs/changelog/2026-07-30-client-boundary) - 2026-07-24: [Native interface foundations](/docs/changelog/2026-07-24-native-foundation) - 2026-07-13: [Administration and data workflows](/docs/changelog/2026-07-13-admin-and-data-workflows) - 2026-06-10: [Setup, storage and localization](/docs/changelog/2026-06-10-setup-storage-and-i18n)