Changelog

Improved

• Refreshed the public site with Inter + DM Sans, olive theme tokens, a quieter Linear-style layout, dashboard wireframe hero, testimonials, and a three-bar Acme mark.
• Page titles: Document titles now use `{page} – {appName}` (en dash), and every SaaS page sets a title so browser tabs never fall back to the product name alone.
• UI polish: Rounded alerts and form controls, wider mail templates, smoother FAQ accordion, blog covers with tag filters, and olive touch accents across the SaaS app.

Fixed

• Social sign-in failures now show a toast, invitation Accept uses the primary button, admin access no longer depends on Permix middleware timing, and list caches refresh after admin/org/settings mutations.

New

• Introduced typed `@repo/permissions` with Permix for admin, organization, and payment gates across oRPC and the SaaS UI.
• Admin user bans: Added admin controls to ban users with an internal reason, optional expiration, active ban details, and unban actions.
• Agent skills: Added curated agent skills for common workflows like features, auth, payments, database changes, tests, and more.

Fixed

• Improved the login form tab order so password visibility controls are reached before the forgot-password link.

Fixed

• Redirect handling now only allows normalized SaaS paths, and protected SaaS pages are marked noindex.

New

• The consent banner is now mounted in the marketing and SaaS apps and remembers allow or decline choices from the consent cookie.

Fixed

• Organization billing, payment redirects, and AI message handling now have stricter authorization and validation.

Improved

• API contracts: oRPC procedures now define explicit output schemas while preserving the existing TanStack response shapes.
• Organization roles: The organization role selector is more compact and now shows only role names.

Improved

• Refreshed the SaaS shell with Plus Jakarta Sans, updated theme tokens, cleaner navigation, organization/user menus, auth screens, settings rows, and rounded organization logos.
• Two-factor auth: Database schemas now track failed two-factor verification attempts and lockout timing.
• Favicons: SaaS, marketing, and docs now share the same rocket favicon wiring.

Fixed

• Avatar cropping: The avatar crop dialog now keeps Cropper.js contained inside the modal with a visible default crop selection.

Improved

• Resend is now the default mail provider, and the Plunk provider plus PLUNK_API_KEY example have been removed.

Removed

• Removed the Dependabot configuration. Dependency updates are now handled manually or through AI-agent automation while pnpm's one-day minimum release age remains in place.
• API rate limiting: Removed the in-memory API rate limiting middleware from auth, RPC, and payment webhook routes so the API no longer returns 429 responses under load.

Fixed

• Payments and image uploads: Dodo Payments webhook metadata is now coerced to strings before validation, and the stale Cropper.js CSS import was removed so Vite/Rolldown builds work with Cropper.js v2.

Improved

• Settings UI: Avatar and organization logo deletion now use compact icon buttons, and button hover states use shared color-mix theme variables for more consistent styling.

Fixed

• Removed the role permissions info box from the members settings page. Role descriptions now appear only in the select dropdown, capped to one line, so the trigger shows the role label alone and stays compact.

Fixed

• SaaS and marketing server entries now use createServerEntry and forward the first request pass into the SSR Vite environment via an x-ssr-dispatch header. In dev, Nitro ran the entry in its own environment where TanStack Start's server-function resolver is not wired, so /_serverFn/ calls returned 500. Server functions now resolve in the SSR environment in both dev and production.
• End-to-end tests: Marketing Playwright config uses import.meta.url instead of __dirname so CI can load the ES module package. The SaaS dev server falls back to a dummy DATABASE_URL when unset so e2e can boot without a live database.

Security

• Replaced Better Auth trustedOrigins wildcard with an explicit allowlist so magic-link verify cannot open-redirect to attacker-controlled callback URLs. Removed the username plugin and user columns that exposed an unauthenticated account-enumeration endpoint. Regenerate and apply the database migration after pulling.

Improved

• Trusted origins: Added getTrustedOrigins in @repo/utils as the single source of truth for Better Auth trustedOrigins and the API CORS allowlist, including the marketing origin when VITE_MARKETING_URL is set.

Fixed

• Organization settings: Only organization owners see the Delete Organization section in general settings. Non-owner admins keep access to all other organization settings.
• Avatar and logo settings: Added delete actions for user avatars and organization logos in general settings, with matching English translations so both image-management flows stay consistent.

Improved

• Disabled postinstall builds for prisma and @prisma/engines in allowBuilds so installs stay fast while schema tasks remain available on the database package.
• Dependabot: Switched npm dependency updates from weekly to daily and removed the open pull request limit.

Removed

• Root scripts: Removed duplicate root-level db and user:create shortcuts. Run database and script tasks through the @repo/database and @repo/scripts package filters instead.

Fixed

• One-time Stripe Checkout sessions for users or organizations that already have a Stripe customer no longer send customer_creation together with customer, avoiding the parameter conflict error from Stripe.

Improved

• Role selects list member, admin, then owner from least to most access. The members settings page adds a role permissions summary, and each option includes a short description of what that role can do.
• Internationalization: Organization role hooks and the roles info panel import the shared @i18n/intl formatting helpers instead of next-intl so the TanStack SaaS app matches the rest of the workspace and passes oxlint.

Removed

• Removed the unused NewUser template and related i18n keys so the TanStack mail catalog matches the other starters.

Improved

• The mail package and preview app follow React Email 6 with consolidated react-email imports and @react-email/ui for local template preview.
• Notification preferences: Account notification settings align with the Next.js starter: per-type and per-channel preferences, grouped preference UI, matching preference APIs, and shared notification helpers from @repo/notifications.
• CI verify: Verify generates marketing content collections before oxlint so type-aware lint resolves the virtual module, with formatting and lint fixes on touched files.

Fixed

• Locale routing: Locale detection skips TanStack Start /_serverFn paths so server function traffic is not mistaken for a missing locale prefix.

Fixed

• Updated TanStack Start routing, invitation flows, and Nitro server entries so marketing and SaaS SSR go through the shared service with more reliable Vercel builds.
• Authentication: Stabilized SaaS auth redirects, fixed forgot-password and OTP form submissions, and surfaced magic link errors on the login form.

Improved

• Settings and onboarding: Moved delete-account controls into general settings, simplified organization general settings layout, and aligned the onboarding page with the shell.
• Optional integrations: Clarified analytics and provider package exports and trimmed redundant environment example stubs.

New

• Admin users: Added the admin users route shell with matching navbar navigation.

New

• Robots.txt route, generated marketing sitemap output, private avatar and logo image proxying, the notifications package with welcome mail, and marketing analytics provider examples.

Fixed

• Billing and organizations: Organization membership is verified before purchases or checkout links, last-active organization state persists through Better Auth and Drizzle, and SSR plus navbar hydration fixes landed from the parity merge.