Changelog

Improved

• Refreshed the public site with Inter + DM Sans, olive theme tokens, a quieter Linear-style layout, dashboard wireframe hero, testimonials, and a three-bar Acme mark.
• Page titles: Document titles now use `{page} – {appName}` (en dash), and every SaaS page sets a title so browser tabs never fall back to the product name alone.
• UI polish: Rounded alerts and form controls, wider mail templates, smoother FAQ accordion, blog covers with tag filters, and olive touch accents across the SaaS app.

Fixed

• Social sign-in failures now show a toast, invitation Accept uses the primary button, and list caches refresh after admin/org/settings mutations.

New

• Introduced typed `@repo/permissions` with Permix for admin, organization, and payment gates across oRPC and the SaaS UI.
• Admin user bans: Added admin controls to ban users with an internal reason, optional expiration, active ban details, and unban actions.
• Agent skills: Added curated agent skills for common workflows like features, auth, payments, database changes, tests, and more.

Fixed

• Improved login form keyboard flow and polished Base UI button, dropdown, select, and destructive confirmation behavior.

Improved

• Migrated the UI components from Radix UI to Base UI, the new default base of shadcn/ui, to align with the TanStack Start version. Composition now uses the render prop instead of asChild, and Radix state attributes (data-[state=open]) are replaced by data-[open], data-[closed] and friends. See the changelog in your repository for the full upgrade notes.

Fixed

• Auth redirects and indexing: Login, signup, OTP, and onboarding redirects now stay on safe SaaS paths, and protected SaaS pages are marked noindex.

Fixed

• Organization billing, payment redirects, and AI message handling now have stricter authorization and validation.

Improved

• API contracts: oRPC procedures now define explicit output schemas next to their handlers.
• Organization roles: The organization role selector is more compact and now shows only role names.

Improved

• Aligned the marketing and docs favicon assets with the updated SaaS rocket app icon.

Improved

• Refreshed the SaaS shell with Plus Jakarta Sans, updated theme tokens, cleaner navigation, organization/user menus, auth screens, settings rows, rounded organization logos, and a new app icon.
• Two-factor auth: Database schemas now track failed two-factor verification attempts and lockout timing.

Fixed

• Avatar cropping: The avatar crop dialog now keeps Cropper.js contained inside the modal with a visible default crop selection.

Improved

• Resend is now the default mail provider, and the Plunk provider plus PLUNK_API_KEY example have been removed.

Removed

• Removed the Dependabot configuration. Dependency updates are now handled manually or through AI-agent automation while pnpm's one-day minimum release age remains in place.

Fixed

• Removed the role permissions info box from the members settings page. Role descriptions now appear only in the select dropdown, capped to one line, so the trigger shows the role label alone and stays compact.

Fixed

• Only organization owners see the delete organization section in general settings. Admins keep access to the rest of organization settings.

Security

• Authentication: Removed the Better Auth username plugin and the username and displayUsername user columns, closing the unauthenticated is-username-available endpoint that allowed anonymous username enumeration. Apply the schema change with the database package push command.

Improved

• Dependabot no longer caps open pull requests or applies a cooldown on npm upgrades. pnpm still enforces a one-day minimum release age at install time.

Fixed

• One-time Stripe Checkout sessions for users or organizations that already have a Stripe customer no longer send customer_creation together with customer, avoiding the parameter conflict error from Stripe.
• Theme toggle: ColorModeToggle waits until after mount before applying next-themes values in both marketing and SaaS apps, so server HTML matches the first client render without suppressHydrationWarning and the active mode indicator stays stable.
• Marketing content: The marketing app's content-collections defineConfig follows the 0.14+ migration by using content instead of the deprecated collections option.

Improved

• Role selects list member, admin, then owner from least to most access. The members settings page adds a role permissions summary, and each option includes a short description of what that role can do.

Removed

• Removed the unused NewUser email template and related mail translations because signup and email changes already use the email verification template.

Improved

• Dependencies: Pruned unused direct dependencies per package, dropped the openapi helper that only existed for the removed openapi-merge integration, and refreshed the lockfile while keeping type-check and tests passing.

Improved

• Mail templates and the preview app now use React Email 6 with the unified react-email package, legacy @react-email scoped render and component packages removed, and preview tooling updated for the v6 layout.

Security

• Dependabot and pnpm enforce a one-day minimum release age, and the workspace targets pnpm v11 with build settings consolidated in pnpm-workspace.yaml.

Fixed

• Theme toggles: Marketing and SaaS light or dark theme controls render with correct server markup and no longer disappear behind a client-only placeholder before hydration.

New

• Added passkey renaming so users can update the names of their registered passkeys.

New

• In-app notification center — See updates in one place from the main navigation.
• Preferences: Your preferences — Control notification channels in account settings.
• Email notifications: Email when it matters — Important notifications can reach users by email, matching their preferences.