# Changelog

New features, architectural changes and improvements to the template.

Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide.


## Public pages paint before any JavaScript arrives

2026-11-05

On a slow phone connection the landing, login and docs paint in about half a second instead of two to two and a half: the CSS of a first visit is inline, the scripts load after it, and every page starts from three script files instead of 33.

A first visit to a public page no longer waits for JavaScript to paint. On the measurement profile (Slow 4G, 4x CPU slowdown, empty cache, the built Worker) the landing paints after about 0.7 s instead of 2.6 s, `/login` and `/docs` after about 0.5 s instead of 2 to 2.3 s, and hydration stays where it was or comes earlier. The method and every number are in [`docs/measurements/2026-11-05-first-paint.md`](https://github.com/CarlosZiegler/template-cloudflare/blob/main/docs/measurements/2026-11-05-first-paint.md); the rule that keeps it this way is W15 in [Web conventions](/docs/development/web-conventions).

- **Three startup files.** The modules every page loads before it hydrates are now the entry with the app's own code, one vendor chunk and Rolldown's runtime, instead of 33 files. Route chunks keep automatic splitting, so a page loads the modules it loaded before. ([be64a8c](https://github.com/CarlosZiegler/template-cloudflare/commit/be64a8ca3d9227ed050632a8315382dd29b225b0))
- **Inline CSS on a first visit.** The root stylesheet is a side-effect import, so Start can inline it. A request without a session gets one `<style>` in its HTML; a signed-in request keeps the stylesheet link its cache already holds. ([fc5e387](https://github.com/CarlosZiegler/template-cloudflare/commit/fc5e387bb5b26c50865943d401785964a6837012))
- **Scripts after the stylesheet.** The head carries no `modulepreload`; a small inline script at the end of the body adds the route chunks' preloads once the stylesheets have loaded, as x.com does. ([a6913a7](https://github.com/CarlosZiegler/template-cloudflare/commit/a6913a780f293e8b464372c91fb8068504772b91))
- **Early Hints.** A page without a session names its font and any stylesheet it did not inline (never a script) in a `Link` header. Cloudflare turns it into a 103 Early Hints answer once the zone has Early Hints on (Speed, Settings, Content Optimization); without the toggle nothing changes. ([11f1e2a](https://github.com/CarlosZiegler/template-cloudflare/commit/11f1e2acd074c559d7e376ad4793092e3edf9038))
- **The sign-in figure waits.** The engine drawing on the sign-in pages (300 KB compressed) is requested once the form is interactive, so it no longer delays the form on a slow connection. ([3d77751](https://github.com/CarlosZiegler/template-cloudflare/commit/3d7775173ce5307d8a6f65406534299f0367fa39))

`scripts/measure-first-paint.mjs` measures first paint and hydration of any deployed URL on the same profile; it takes Playwright from `PLAYWRIGHT_CORE` instead of adding a dependency.


## Better Auth 1.7.16 security fix and dependency round

2026-11-04

Better Auth 1.7.16 closes a critical account takeover through the Expo authorization proxy, the iPhone Duo tab bar becomes a rail, and the dependency round brings Effect 4.1, Takumi 2.19, oRPC beta.48 and Expo SDK 58.0.23 patches.

Better Auth moves to 1.7.16. Its `expo()` plugin, which the template registers for the native app, exposed an authorization proxy that signed a value taken from the request with the application secret (GHSA-4wq4-2ppv-q3hg, critical): anyone who knew an account's email address could forge a verification link and sign in as that user. The same release stops an organization admin from inviting an owner through a role name with extra whitespace (GHSA-c85h-5mrr-mgx4). The other ten advisories of that release need plugins or options the template does not use. The release was under two days old, so its exact versions sit in `minimumReleaseAgeExclude` until 2026-11-05 21:24 UTC. A project created from the template that has been deployed should upgrade and then rotate `BETTER_AUTH_SECRET`; with users and two-factor enabled, pass the new secret in `secrets` and keep the old one as `BETTER_AUTH_SECRET`, so stored TOTP secrets still decrypt.

On iPhone Duo, built with the iOS 27.1 SDK, the native tabs become a vertical rail beside the content when the device is folded or open in landscape. Screens read the rail from the side safe-area insets and stop reserving space for a bottom bar, the bar is no longer cleared twice when the safe area already reaches it, and the app imports `NativeTabs` from the stable `expo-router/native-tabs` path.

The dependency round moves Expo to the SDK 58.0.23 patches, Effect to 4.1.2 (the ADR-0006 fault gate gives the same result as 4.0.6), Takumi to 2.19.0 with a new `OG_VERSION`, oRPC to 2.0.0-beta.48, TanStack AI to 1.0.1, TanStack Query to 5.105.3, wrangler to 4.156.1 and a set of patch releases. The Worker is 78 KiB gzip larger.

- [Libraries](/docs/libraries)
- [Mobile app](/docs/features/mobile)

Sources: [Better Auth 1.7.16](https://github.com/CarlosZiegler/template-cloudflare/commit/26675533), [Expo patches](https://github.com/CarlosZiegler/template-cloudflare/commit/18dafe6c), [iPhone Duo rail](https://github.com/CarlosZiegler/template-cloudflare/commit/d16fe38d), [Effect 4.1.2](https://github.com/CarlosZiegler/template-cloudflare/commit/e0bb5fb8), [Takumi 2.19](https://github.com/CarlosZiegler/template-cloudflare/commit/21f5903f).


## Animated assistant approval on the landing, and a design patterns page

2026-11-04

The landing's in-app assistant tile now plays a short approval: the todo_create card asks, the cursor approves, the answer streams. It is built with the stageshow skill. A new page maps each design job to its source and agent skill, and the Bklit UI chart skills join the template.

The In-app assistant tile on the landing's feature board now shows the assistant asking before a write. The `todo_create` approval card drops into the thread, the cursor presses Approve, the trace turns to Completed and the answer streams in. The strings are the assistant's own locale keys in en, de and fr, and a note under the tile says it is an illustration, not a screen capture. The scene plays once when most of it is in view, pauses off screen, and shows its last frame under reduced motion. Phones get a tighter crop of the same thread.

The scene is built with the [stageshow](https://github.com/benjitaylor/skills) skill, now in `.agents/skills/stageshow`, for faux product UI on marketing pages. The kit parts the landing uses are vendored in `apps/web/src/platform/stageshow/`, trimmed to the arrow cursor, the default window chrome and the light and dark looks. The landing route grows by 13.4 KiB of gzip JS and 5.6 KiB of gzip CSS. Each trimmed file names what it left out, so a later scene can copy the rest back from the skill.

[Design patterns](/docs/development/design) is new: the three registers (Operate, Persuade, docs), which source each job uses and the rules that keep a rebrand cheap. Charts now come from [Bklit UI](https://bklit.com), whose `@bklit` registry is in `packages/ui/components.json`; its agent skills `bklit-ui`, `bklit-ui-design` and `bklit-ui-migrate` are installed, and `ui-catalog` routes chart work to them. No screen draws a chart yet, and the unused Recharts wrapper stays until one does.

- [Design patterns](/docs/development/design)

Sources: [assistant demo](https://github.com/CarlosZiegler/template-cloudflare/commit/9a10af15), [kit trim](https://github.com/CarlosZiegler/template-cloudflare/commit/2e35d00b).


## Earlier updates

- 2026-11-04: [Loading skeletons drawn from the real components](/docs/changelog/2026-11-04-skullet-skeletons)
- 2026-10-29: [Invitations are not a mail relay](/docs/changelog/2026-10-29-invitation-relay)
- 2026-10-29: [MCP Apps widget, approval status and plugin marketplaces](/docs/changelog/2026-10-29-mcp-apps-widget-approval-status)
- 2026-10-29: [One URL per language](/docs/changelog/2026-10-29-path-locales)
- 2026-10-29: [Account emails in React Email, in English, German and French](/docs/changelog/2026-10-29-react-email)
- 2026-10-29: [Share cards, Markdown negotiation and one site identity](/docs/changelog/2026-10-29-seo-agent-readiness)
- 2026-10-27: [TanStack AI 1.0, password forms and iPhone Duo](/docs/changelog/2026-10-27-deps-password-forms-iphone-duo)
- 2026-10-19: [Agent skills from upstream and the /pr template](/docs/changelog/2026-10-19-agent-skills-update)
- 2026-10-19: [Ponytail from the official plugin](/docs/changelog/2026-10-19-ponytail-plugin)
- 2026-10-17: [One folder per backend feature, tagged errors and written rules](/docs/changelog/2026-10-17-backend-structure)
- 2026-10-17: [One folder per mobile feature, and the API aliases are gone](/docs/changelog/2026-10-17-mobile-structure)
- 2026-10-17: [The web app is organized by feature, like the backend](/docs/changelog/2026-10-17-web-structure)
- 2026-10-16: [Auth and tenant security fixes](/docs/changelog/2026-10-16-auth-and-security-fixes)
- 2026-10-16: [Database, Worker and web performance](/docs/changelog/2026-10-16-performance-and-placement)
- 2026-10-16: [Row-level security per Organization](/docs/changelog/2026-10-16-row-level-security)
- 2026-10-15: [AI assistant and one tool catalog](/docs/changelog/2026-10-15-assistant-and-agent-tools)
- 2026-10-15: [Dependency round, i18next fix and ReUI controls](/docs/changelog/2026-10-15-dependency-round-and-reui)
- 2026-10-15: [Developer documentation and changelog](/docs/changelog/2026-10-15-developer-docs-and-changelog)
- 2026-10-15: [Documents and large uploads](/docs/changelog/2026-10-15-documents-and-large-uploads)
- 2026-10-15: [Landing page redesign](/docs/changelog/2026-10-15-landing-redesign)
- 2026-10-15: [Landing sections and project skills](/docs/changelog/2026-10-15-landing-sections-and-project-skills)
- 2026-10-14: [Trace and code block primitives](/docs/changelog/2026-10-14-trace-and-code-blocks)
- 2026-10-13: [TanStack Start 1.0, OG images and durable imports](/docs/changelog/2026-10-13-start-og-and-imports)
- 2026-10-12: [Payments, native screens and a new landing page](/docs/changelog/2026-10-12-payments-and-native-experience)
- 2026-10-03: [Runtime and recovery hardening](/docs/changelog/2026-10-03-runtime-and-recovery)
- 2026-09-25: [Authentication foundations and performance](/docs/changelog/2026-09-25-auth-and-performance)
- 2026-09-24: [Platform dependency alignment](/docs/changelog/2026-09-24-platform-dependencies)
- 2026-09-03: [oRPC and Drizzle upgrades](/docs/changelog/2026-09-03-typed-api-upgrade)
- 2026-08-25: [Typed domain operations and a real dashboard](/docs/changelog/2026-08-25-typed-domain-and-dashboard)
- 2026-08-24: [Agent connections and native account security](/docs/changelog/2026-08-24-agent-connections-and-account-security)
- 2026-08-13: [Cloudflare email and shared UI](/docs/changelog/2026-08-13-email-and-ui)
- 2026-07-30: [An enforced client/server boundary](/docs/changelog/2026-07-30-client-boundary)
- 2026-07-24: [Native interface foundations](/docs/changelog/2026-07-24-native-foundation)
- 2026-07-13: [Administration and data workflows](/docs/changelog/2026-07-13-admin-and-data-workflows)
- 2026-06-10: [Setup, storage and localization](/docs/changelog/2026-06-10-setup-storage-and-i18n)