# Changelog

New features, architectural changes and improvements to the template.

Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide.


## TanStack AI 1.0, password forms and iPhone Duo

2026-10-27

Password forms no longer leak credentials into the URL before hydration, the mobile app keeps content clear of the iPhone Duo bar rail, and the dependency round brings TanStack AI 1.0, oRPC beta.47 and Expo SDK 58 patches.

Password forms on the web are safe to submit before the page hydrates. A click on submit before React attached its handler used to be the browser's native submit, a `GET` that put the email and password in the address bar and history. Sign-in, sign-up, password reset and password change, plus the two-factor and admin password dialogs, now post, and the four forms rendered by SSR keep their submit button disabled until hydration.

The mobile app is ready for iPhone Duo. On its outer display and in landscape, iOS moves the status bar and the native tab bar into a vertical rail on the camera's edge. Screens, the todo list, toasts, the update banner, the confirmation sheet and onboarding add the side safe-area insets to their gutters, so nothing runs under the rail; on other iPhones the layout is unchanged. The mobile `AGENTS.md` records the rule, the simulator checklist and a new rule for `@expo/ui`: a `Host` only wraps fixed-size controls, while steppers and segmented pickers are React Native.

The dependency round moves the assistant to TanStack AI 1.0 without code changes, oRPC to 2.0.0-beta.47 and Better Auth to 1.7.14 (owner-approved quarantine exceptions until 2026-10-29), Effect to 4.0.6, TanStack Start and Router to their latest patches and Expo to the latest SDK 58 patches, and re-resolves zod, body-parser, fast-uri and undici past new advisories. The Better Auth advisories published on 2026-10-27, including CVE-2026-114607, were already fixed in 1.7.7, so the template was not affected. The Worker is 31 KiB gzip smaller.

- [Libraries](/docs/libraries)
- [Mobile app](/docs/features/mobile)

Sources: [password forms](https://github.com/CarlosZiegler/template-cloudflare/commit/ee6f57a), [iPhone Duo](https://github.com/CarlosZiegler/template-cloudflare/commit/8a4eb28), [TanStack AI 1.0](https://github.com/CarlosZiegler/template-cloudflare/commit/abf9cde), [oRPC beta.47](https://github.com/CarlosZiegler/template-cloudflare/commit/176342e), [Expo patches](https://github.com/CarlosZiegler/template-cloudflare/commit/3bd07a4), [advisories](https://github.com/CarlosZiegler/template-cloudflare/commit/3783960).


## Agent skills from upstream and the /pr template

2026-10-19

Matt Pocock's skills and pstack come from their upstream sources through the official installer, /pr joins the skills, and pull requests open with its Summary, Evidence and Merge Danger sections.

Matt Pocock's skills and pstack are installed again from their sources with the official `skills` installer, so `skills-lock.json` matches what upstream ships. `pr` is new from Matt Pocock. `design-an-interface` and `resolving-merge-conflicts` are gone because upstream deleted them, and `writing-great-skills` is gone because upstream renamed it to `writing-for-agents`, which the repo already had. `domain-modeling` keeps this repo's ADR header rules and was not reinstalled.

pstack adds `correct`, `in-your-own-words`, `ketchup`, `principle-attack-the-premise`, `principle-explain-the-number` and `principle-test-behavior-not-implementation`, and seven pstack skills follow upstream edits. pstack's `teach` and `tdd` stay out, so the names keep pointing at Matt Pocock's skills.

A new pull request opens with the `/pr` sections: Summary (a diff sketch, file tree or pseudocode, no Mermaid), Evidence (before and after) and Merge Danger (one-way or two-way door, blast radius). The checks list below them is unchanged. The template says that a merge to `main` deploys to production and that migrations, RLS changes, secret or env changes and feature removals are one-way doors. Skills that name `GLOSSARY.md` read this repo's `CONTEXT.md`.

- [Review checklist](/docs/development/review-checklist)
- [Pull request template](https://github.com/CarlosZiegler/template-cloudflare/blob/main/.github/PULL_REQUEST_TEMPLATE.md)
- [Domain docs for agents](https://github.com/CarlosZiegler/template-cloudflare/blob/main/docs/agents/domain.md)

Sources: [Matt Pocock skills](https://github.com/CarlosZiegler/template-cloudflare/commit/680e461), [pstack skills](https://github.com/CarlosZiegler/template-cloudflare/commit/4d02247).


## Ponytail from the official plugin

2026-10-19

The default working style is the official ponytail plugin, enabled by the project settings, and new apps get a step for their own verification skill.

Ponytail is no longer a copy of six skills under `.agents/skills`. The project's `.claude/settings.json` declares the upstream `ponytail` marketplace with auto-update and enables `ponytail@ponytail`, so Claude Code loads the always-on plugin once a contributor trusts the folder and follows upstream releases. `AGENTS.md` lists the upstream install commands for Codex, Cursor and other agents, and says when to switch to `/poteto-mode` instead.

The template ships no verification skill. The README's "Using this template" steps now tell a new app to run `/create-verification-skill` once its first features exist, then `/maintain-verification-skill` on the team's cadence, and where the generated `verify-<app>` skill belongs.

- [Agent instructions](https://github.com/CarlosZiegler/template-cloudflare/blob/main/AGENTS.md)
- [Using this template](https://github.com/CarlosZiegler/template-cloudflare/blob/main/README.md#using-this-template)

Sources: [official plugin](https://github.com/CarlosZiegler/template-cloudflare/commit/bad3133), [verification skill step](https://github.com/CarlosZiegler/template-cloudflare/commit/9c061f0).


## Earlier updates

- 2026-10-17: [One folder per backend feature, tagged errors and written rules](/docs/changelog/2026-10-17-backend-structure)
- 2026-10-17: [One folder per mobile feature, and the API aliases are gone](/docs/changelog/2026-10-17-mobile-structure)
- 2026-10-17: [The web app is organized by feature, like the backend](/docs/changelog/2026-10-17-web-structure)
- 2026-10-16: [Auth and tenant security fixes](/docs/changelog/2026-10-16-auth-and-security-fixes)
- 2026-10-16: [Database, Worker and web performance](/docs/changelog/2026-10-16-performance-and-placement)
- 2026-10-16: [Row-level security per Organization](/docs/changelog/2026-10-16-row-level-security)
- 2026-10-15: [AI assistant and one tool catalog](/docs/changelog/2026-10-15-assistant-and-agent-tools)
- 2026-10-15: [Dependency round, i18next fix and ReUI controls](/docs/changelog/2026-10-15-dependency-round-and-reui)
- 2026-10-15: [Developer documentation and changelog](/docs/changelog/2026-10-15-developer-docs-and-changelog)
- 2026-10-15: [Documents and large uploads](/docs/changelog/2026-10-15-documents-and-large-uploads)
- 2026-10-15: [Landing page redesign](/docs/changelog/2026-10-15-landing-redesign)
- 2026-10-15: [Landing sections and project skills](/docs/changelog/2026-10-15-landing-sections-and-project-skills)
- 2026-10-14: [Trace and code block primitives](/docs/changelog/2026-10-14-trace-and-code-blocks)
- 2026-10-13: [TanStack Start 1.0, OG images and durable imports](/docs/changelog/2026-10-13-start-og-and-imports)
- 2026-10-12: [Payments, native screens and a new landing page](/docs/changelog/2026-10-12-payments-and-native-experience)
- 2026-10-03: [Runtime and recovery hardening](/docs/changelog/2026-10-03-runtime-and-recovery)
- 2026-09-25: [Authentication foundations and performance](/docs/changelog/2026-09-25-auth-and-performance)
- 2026-09-24: [Platform dependency alignment](/docs/changelog/2026-09-24-platform-dependencies)
- 2026-09-03: [oRPC and Drizzle upgrades](/docs/changelog/2026-09-03-typed-api-upgrade)
- 2026-08-25: [Typed domain operations and a real dashboard](/docs/changelog/2026-08-25-typed-domain-and-dashboard)
- 2026-08-24: [Agent connections and native account security](/docs/changelog/2026-08-24-agent-connections-and-account-security)
- 2026-08-13: [Cloudflare email and shared UI](/docs/changelog/2026-08-13-email-and-ui)
- 2026-07-30: [An enforced client/server boundary](/docs/changelog/2026-07-30-client-boundary)
- 2026-07-24: [Native interface foundations](/docs/changelog/2026-07-24-native-foundation)
- 2026-07-13: [Administration and data workflows](/docs/changelog/2026-07-13-admin-and-data-workflows)
- 2026-06-10: [Setup, storage and localization](/docs/changelog/2026-06-10-setup-storage-and-i18n)