Password forms on the web are safe to submit before the page hydrates. A click on submit before React attached its handler used to be the browser's native submit, a GET that put the email and password in the address bar and history. Sign-in, sign-up, password reset and password change, plus the two-factor and admin password dialogs, now post, and the four forms rendered by SSR keep their submit button disabled until hydration.
The mobile app is ready for iPhone Duo. On its outer display and in landscape, iOS moves the status bar and the native tab bar into a vertical rail on the camera's edge. Screens, the todo list, toasts, the update banner, the confirmation sheet and onboarding add the side safe-area insets to their gutters, so nothing runs under the rail; on other iPhones the layout is unchanged. The mobile AGENTS.md records the rule, the simulator checklist and a new rule for @expo/ui: a Host only wraps fixed-size controls, while steppers and segmented pickers are React Native.
The dependency round moves the assistant to TanStack AI 1.0 without code changes, oRPC to 2.0.0-beta.47 and Better Auth to 1.7.14 (owner-approved quarantine exceptions until 2026-10-29), Effect to 4.0.6, TanStack Start and Router to their latest patches and Expo to the latest SDK 58 patches, and re-resolves zod, body-parser, fast-uri and undici past new advisories. The Better Auth advisories published on 2026-10-27, including CVE-2026-114607, were already fixed in 1.7.7, so the template was not affected. The Worker is 31 KiB gzip smaller.
Sources: password forms, iPhone Duo, TanStack AI 1.0, oRPC beta.47, Expo patches, advisories.