Release Notes
All releases
| Version | Date | Highlights |
|---|---|---|
| v0.1.92 | 19 Aug 2026 | Security: relational-only updates now enforce the row-level permission filter (previously bypassable on every collection via payloads with no scalar columns); non-admin self-PATCH can no longer self-assign admin roles/policies; two schema/bootstrap endpoints no longer answer anonymous callers. Scope missing_uri_mode='reject' enforced on updates, deletes, nested relational writes, and embedded reads; every daas_users write path now pairs with its Supabase Auth account (working logins, no orphaned auth users, email/password sync); Users detail/create page rebuilt on CollectionForm; data-model choice authoring emits typed values with per-choice icon/color and a zero-choices guard; /api/roles supports filter query params; server-side enforceModuleAccess() helper; item writes cut from 11 to ~7–9 Supabase calls; Playwright suite hard failures 1192 → 36 |
| v0.1.91 | 12 Aug 2026 | App tier now runs as a multi-process cluster — one worker per core, cross-worker cache/cron/extension coordination, and a leader-elected cron scheduler (review WEB_CONCURRENCY if your container memory is tight); permission resolution collapsed to one cached fetch per collection (9 → 2 Supabase round trips per request, p50 360 ms → 94 ms); optional local JWT verification via SUPABASE_JWT_SECRET; root-scope requests no longer resolve permissions from the unscoped policy set (multi-tenant isolation fix); list-o2m saved-parent “Add Existing” and paginated list-m2a saves no longer mass-unlink existing linked items; Buildpad UI interface components synced to 1.10.0 with upstream audit fixes |
| v0.1.90 | 10 Aug 2026 | Module-Level Access: application capability flags in Policies — new daas_module_access_keys registry, module_access column on daas_policies, Module-Level Access tab in the policy editor, moduleAccess in /api/permissions/me, and module_access_keys on workflow commands; the Logs page is delegable via system:logs; /api/permissions/me and workflow transition gates resolve policies at the caller’s scope; last_access records every login and displays as “Last Login”; list-o2m “Add Existing” defers to Save; permission badges show custom DELETE/SHARE rules and the permissions modal no longer opens blank for them |
| v0.1.89 | 5 Aug 2026 | Behaviour change: meta.total is estimated by default — exact on small results, the planner’s estimate on large ones (139 ms → 0.15 ms per request on a 5M-row collection); pass ?count=exact where the number must be precise; internal reads that discarded the row count no longer request one; Claude Code agents and skills added under .claude/ for repo development |
| v0.1.88 | 27 Jul 2026 | Breaking: ?search= no longer scans json/jsonb columns by default — opt back in per field with meta.searchable; migration must be applied before deploy; ?search= combined with a filter no longer drops valid matches; search terms and primary keys containing , ( ) " no longer corrupt the query; readByQuery stopped requesting an exact row count; collection-item-dropdown renders as a badge in collection lists; collection-list upgraded to v1.9.3 to fix table empty space and pagination style under horizontal scroll |
| v0.1.87 | 23 Jul 2026 | Add native support for _in and _nin filter operators in aggregate queries; Comprehensive OpenAPI/Swagger spec updates; Removed custom table/list styling in favor of microbuild-ui/ui; Dynamic related collection dropdown selection; Automatic M2O interface option & relationship config synchronization |
| v0.1.86 | 17 Jul 2026 | Fix table and collection-list scrolling issues; Upgrade input-code to fix scroll syncing |
| v0.1.85 | 15 Jul 2026 | Rich Text Markdown field now stores real Markdown; Logs pagination and load more button; Application logs sorted from newest to oldest |
| v0.1.84 | 12 Jul 2026 | Platform Studio now supports non-id primary keys; Save split-button gap; explicit Group spacing now honored; Platform Studio components synced with Buildpad UI 1.6.0 |
| v0.1.83 | 2 Jul 2026 | JSONB/JSON column search and flexible primary key support |
| v0.1.82 | 25 Jun 2026 | Eliminated redundant Supabase calls per API request |
| v0.1.80 | 12 Jun 2026 | Content Detail forms now handle numeric, non-PK M2O, and input-code values correctly |
| v0.1.79 | 12 Jun 2026 | Cookie-based SSR auth now works when internal and public Supabase URLs differ |
| v0.1.78 | 11 Jun 2026 | Added SUPABASE_INTERNAL_URL support for server-side Supabase connections; Docs site hard reload no longer breaks due to early widget script execution |
| v0.1.77 | 28 May 2026 | Nested M2M relations now resolve correctly at arbitrary depth |
| v0.1.76 | 25 May 2026 | Cron jobs triggered from extensions now execute the current code; Timeout field now accepts any value above the minimum |
| v0.1.75 | 22 May 2026 | Filter extensions on daas_users now correctly block user creation via POST /api/users; POST /api/utils/import/[collection] now enforces permissions and runs extension filters |
| v0.1.74 | 20 May 2026 | Platform Studio is now usable on mobile; Dark mode is now consistent and legible; Datetime picker arrows render at the correct size; Documentation — Major accuracy pass across every public docs section; Documentation site — Feedback widget on every page |
| v0.1.73 | 15 May 2026 | MCP-created collections now have RLS and permission policies applied; services.custom(name, { elevated: true }) now correctly elevates permissions in nested services |
| v0.1.72 | 14 May 2026 | Logout now properly invalidates Bearer token sessions |
Last updated on