Skip to Content
Release NotesOverview

Release Notes

All releases

VersionDateHighlights
v0.1.982 Oct 2026Security release. The anon key was able to call database functions: remove_rls_from_collection disabled row-level security on any table and execute_aggregate read any column — the anon key now reaches no data; direct PostgREST calls with it get 401/403. Policies apply to signed-in users only. Aggregates ignored tenant scope, field permissions and concealed fields (static tokens came back unmasked). Administrator access now comes only from root grants — a user who was admin only through a tenant grant loses it. The URL file import refuses private addresses; new optional STORAGE_IMPORT_ALLOWED_NETWORKS. Database functions get a fixed search_path, clearing the Supabase advisor warnings. A new column no longer answers PGRST204 right after creation; self-referential M2M reads and MCP-created M2O fields fixed; Next.js 16.3.6
v0.1.9718 Sep 2026Security release. Code stored in the database (custom services, cron jobs, extensions) ran in the server’s own realm and could reach process — usable by anyone with create permission on those collections, not just admins. Saving a custom service ran its code, before permissions applied. Stored code could reach any host when EXTENSION_ALLOWED_DOMAINS was unset — that variable is now required for outbound requests from stored code. Write policies using _has or a relation path were enforced on reads and ignored on updates and deletes. Studio pages move to locale-prefixed URLs (/en/users; unprefixed links redirect, /api/* unchanged) and ship Bahasa Indonesia. New optional Valkey shared cache, off unless configured. Presentation-only fields and users holding two filtered policies no longer return 500
v0.1.9611 Sep 2026Action needed: exports made before this release are unreadable — run scripts/repair-export-storage-bucket.mjs (dry run, then --apply). Security: GET /api/files reported the file count of every team in meta.total_count instead of the filtered total (14 matching files reported as 665). New environment migration: snapshot, diff, and apply a data model between environments, with a transactional apply, merge by default, and a hash check against a changed target — existing callers keep working. Replacing a file inside a folder or another bucket kept serving the old version while the request answered 200 — replace those files again. The Add Existing picker no longer shows pages that hold nothing. A failed delete no longer shows a success message
v0.1.954 Sep 2026Action needed: SSO auto-login now signs its handoff token with a dedicated BUILDPAD_SSO_SECRET — give the BuildPad platform the same secret before deploying, or POST /api/auth/sso answers 500. New POST /api/auth/sso exchanges a short-lived platform token for a session, rate limited per IP, capped at 5 minutes, single use, and refused for users with a verified MFA factor. Schema introspection no longer times out on large schemas (9.79 s → 0.35 s on 51 tables and ~1,200 columns), and foreign key reporting is fixed for composite and cross-schema keys. New Multi-Factor Authentication documentation page
v0.1.944 Sep 2026Multi-factor authentication: users can enroll a TOTP app, and a user with a verified factor must reach assurance level 2 — level 1 requests get 403 MFA_REQUIRED so a client can prompt for step-up instead of a full sign-in. MFA_FORCE_ENABLED=true requires MFA for everyone (not listed in docker-compose.yml — add it yourself). The activity log now records logins and logouts, and POST /api/activity/event records actions that are not database writes, rate limited to 60 per minute per caller. A replaced file no longer serves the old bytes from cache, and the image editor can no longer overwrite a replacement with edits of the old image. Long field names silently produced M2O fields with no foreign key — check relation fields on collections with long names. JSON fields accept typed text again. Buildpad UI components upgraded to 2.1.0
v0.1.9326 Aug 2026Pagination no longer offers pages that hold nothing: the estimated meta.total from v0.1.89 is now checked against the page it accompanies and corrected where the page proves it wrong — a 5M-row collection offered ~32,000 empty pages, and filtered sets hid matches behind a pager that stopped early. New meta.total_estimated says whether a total is exact. You can now upload large files directly to storage with a signed URL, so the file does not pass through the API server. /api/health is deprecated and now tests the database — move liveness probes to /api/server/ping. /api/server/info and /api/server/health show full detail to administrators only. New collections link user_created and user_updated to daas_users, so a query can expand them
v0.1.9219 Aug 2026Security: relational-only updates now enforce the row-level permission filter (previously bypassable on every collection via payloads with no scalar columns); non-admin self-PATCH can no longer self-assign admin roles/policies; two schema/bootstrap endpoints no longer answer anonymous callers. Scope missing_uri_mode='reject' enforced on updates, deletes, nested relational writes, and embedded reads; every daas_users write path now pairs with its Supabase Auth account (working logins, no orphaned auth users, email/password sync); Users detail/create page rebuilt on CollectionForm; data-model choice authoring emits typed values with per-choice icon/color and a zero-choices guard; /api/roles supports filter query params; server-side enforceModuleAccess() helper; item writes cut from 11 to ~7–9 Supabase calls; Playwright suite hard failures 1192 → 36
v0.1.9112 Aug 2026App tier now runs as a multi-process cluster — one worker per core, cross-worker cache/cron/extension coordination, and a leader-elected cron scheduler (review WEB_CONCURRENCY if your container memory is tight); permission resolution collapsed to one cached fetch per collection (9 → 2 Supabase round trips per request, p50 360 ms → 94 ms); optional local JWT verification via SUPABASE_JWT_SECRET; root-scope requests no longer resolve permissions from the unscoped policy set (multi-tenant isolation fix); list-o2m saved-parent “Add Existing” and paginated list-m2a saves no longer mass-unlink existing linked items; Buildpad UI interface components synced to 1.10.0 with upstream audit fixes
v0.1.9010 Aug 2026Module-Level Access: application capability flags in Policies — new daas_module_access_keys registry, module_access column on daas_policies, Module-Level Access tab in the policy editor, moduleAccess in /api/permissions/me, and module_access_keys on workflow commands; the Logs page is delegable via system:logs; /api/permissions/me and workflow transition gates resolve policies at the caller’s scope; last_access records every login and displays as “Last Login”; list-o2m “Add Existing” defers to Save; permission badges show custom DELETE/SHARE rules and the permissions modal no longer opens blank for them
v0.1.895 Aug 2026Behaviour change: meta.total is estimated by default — exact on small results, the planner’s estimate on large ones (139 ms → 0.15 ms per request on a 5M-row collection); pass ?count=exact where the number must be precise; internal reads that discarded the row count no longer request one; Claude Code agents and skills added under .claude/ for repo development
v0.1.8827 Jul 2026Breaking: ?search= no longer scans json/jsonb columns by default — opt back in per field with meta.searchable; migration must be applied before deploy; ?search= combined with a filter no longer drops valid matches; search terms and primary keys containing , ( ) " no longer corrupt the query; readByQuery stopped requesting an exact row count; collection-item-dropdown renders as a badge in collection lists; collection-list upgraded to v1.9.3 to fix table empty space and pagination style under horizontal scroll
v0.1.8723 Jul 2026Add native support for _in and _nin filter operators in aggregate queries; Comprehensive OpenAPI/Swagger spec updates; Removed custom table/list styling in favor of microbuild-ui/ui; Dynamic related collection dropdown selection; Automatic M2O interface option & relationship config synchronization
v0.1.8617 Jul 2026Fix table and collection-list scrolling issues; Upgrade input-code to fix scroll syncing
v0.1.8515 Jul 2026Rich Text Markdown field now stores real Markdown; Logs pagination and load more button; Application logs sorted from newest to oldest
v0.1.8412 Jul 2026Platform Studio now supports non-id primary keys; Save split-button gap; explicit Group spacing now honored; Platform Studio components synced with Buildpad UI 1.6.0
v0.1.832 Jul 2026JSONB/JSON column search and flexible primary key support
v0.1.8225 Jun 2026Eliminated redundant Supabase calls per API request
v0.1.8012 Jun 2026Content Detail forms now handle numeric, non-PK M2O, and input-code values correctly
v0.1.7912 Jun 2026Cookie-based SSR auth now works when internal and public Supabase URLs differ
v0.1.7811 Jun 2026Added SUPABASE_INTERNAL_URL support for server-side Supabase connections; Docs site hard reload no longer breaks due to early widget script execution
v0.1.7728 May 2026Nested M2M relations now resolve correctly at arbitrary depth
v0.1.7625 May 2026Cron jobs triggered from extensions now execute the current code; Timeout field now accepts any value above the minimum
v0.1.7522 May 2026Filter extensions on daas_users now correctly block user creation via POST /api/users; POST /api/utils/import/[collection] now enforces permissions and runs extension filters
v0.1.7420 May 2026Platform Studio is now usable on mobile; Dark mode is now consistent and legible; Datetime picker arrows render at the correct size; Documentation — Major accuracy pass across every public docs section; Documentation site — Feedback widget on every page
v0.1.7315 May 2026MCP-created collections now have RLS and permission policies applied; services.custom(name, { elevated: true }) now correctly elevates permissions in nested services
v0.1.7214 May 2026Logout now properly invalidates Bearer token sessions
v0.1.98