# Changelog

New features, architectural changes and improvements to the template.

Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide.


## Agent skills from upstream, Expo's renamed skills, and three updates held back

2026-11-06

Twenty-two third-party skills follow their upstream sources, Expo's deployment and CI skills take their new names, Stageshow is at 1.1.1, and the Taste and evlog updates wait for a decision.

Every skill in `skills-lock.json` was compared with its upstream source, file by file. Most were already current. The rest were read diff by diff before they came in, and each commit names the upstream commit it took.

- **Updated from upstream.** Seven of Matt Pocock's skills, seven pstack skills (`interrogate` now keeps only findings an adversary proves with a run; poteto-mode's autopilot-stack never merges), Emil Kowalski's two animation skills (Motion shorthands are hardware-accelerated from 14.2), `neon-postgres` (branching and egress references), `serve-sim` (the hardened server), and three Expo skills. ([4685247](https://github.com/CarlosZiegler/varu/commit/4685247f05a8146a435a76b0a26e30faebaf7fcd), [4232f77](https://github.com/CarlosZiegler/varu/commit/4232f77223fab00d5d02a60c7d0be9e947aac7db), [8411619](https://github.com/CarlosZiegler/varu/commit/84116195a699399d7804727bf5ec526a318eafaf), [456f0c8](https://github.com/CarlosZiegler/varu/commit/456f0c812fd66039b3e316460e73c00d3c73e136), [8ccf7e3](https://github.com/CarlosZiegler/varu/commit/8ccf7e36aaf416b1c7f0d894819d81939646eecb))
- **Stageshow 1.1.1.** The fix steadies the skill's playground when scroll bars are always on. The kit is unchanged, so the landing's vendored copy and the landing itself are untouched. ([4af377b](https://github.com/CarlosZiegler/varu/commit/4af377b331bf3ede05ad6cf99f7be4839c50cd00))
- **Expo's renamed skills.** `expo-deployment` is now `eas-app-stores` and `expo-cicd-workflows` is `eas-workflows`. The old `building-native-ui` and `native-data-fetching` copies are gone, because `expo-native-ui`, `expo-router` and `expo-data-fetching` replace them. `expo-tailwind-setup` (NativeWind) is gone too: upstream deleted it and the mobile app does not use it. The [design map](/docs/development/design) points at `expo-native-ui`. Expo's new feedback instruction, which has the agent report the user's task to Expo on its own, was left out. ([bf34bb9](https://github.com/CarlosZiegler/varu/commit/bf34bb9cd4408e96e7aa66f310ac0259b9166622))
- **Held back.** Taste Skill 2.5 is a different product: a 39 MB static-site kit with scripts that download icons, photos and fonts. Landing work stays on Taste v2 with `redesign-existing-projects`, which upstream folded into 2.5. The evlog skills now tell the agent to run `npx evlog`, which fetches an unpinned `@evlog/cli`. Both wait until that CLI is pinned. Five Expo skills whose only upstream change is the new feedback instruction stay where they were.


## Code is written in English

2026-11-06

A written rule for every project built from the template: code, comments, tests, commits and developer docs are English; only user-facing text is localized.

Projects built from the template now share one rule for the language of their code, stated in `AGENTS.md` and on [Conventions](/docs/development/conventions#code-is-written-in-english): identifiers, file and route names, database tables, env vars, comments, test names, developer logs, error codes, commits, branches, pull requests and developer docs are English, whatever language the domain, the team or the conversation with an agent uses. User-facing text is the only exception and goes through the i18n catalogs. A domain word from another language gets one English name in `CONTEXT.md`.

`scripts/code-language.test.mjs` runs in `pnpm test` and fails when a short list of Portuguese and German words appears in identifiers, comments or test titles under `apps/*/src`, `packages/*/src` and the scripts folders. String literals, JSX text and the locale catalogs are not read. The rest of the rule (other languages, commits, docs) is checked in review; see [Enforcement](/docs/development/enforcement).


## The consent banner paints from the HTML, repeat visits skip revalidation, and real Web Vitals

2026-11-06

First visits to sign-in and the app reach their largest paint 2 to 3 seconds sooner, repeat visits hydrate up to half a second sooner, the landing figure is sent once, the dashboard's hydration error is gone, and visitors who allow analytics report Core Web Vitals.

Six changes from the x.com rebuild research, each measured against `main` on the slow profile (Slow 4G, 4x CPU, the built Worker, median of 5). Method and every number: [`docs/measurements/2026-11-06-web-quick-wins.md`](https://github.com/CarlosZiegler/varu/blob/main/docs/measurements/2026-11-06-web-quick-wins.md).

- **The cookie banner is in the server HTML.** It used to mount after hydration and was the largest paint of a first visit to `/login`, `/dashboard` and `/todos`. The choice now lives in a `cookie_consent` cookie the server reads, so the banner paints with the page: largest paint 2.52 → 0.50 s on `/login`, 3.54 → 1.00 s on `/dashboard`, 4.02 → 0.99 s on `/todos`. Choices stored in the browser before this release are moved to the cookie without the banner flashing. Categories, defaults and the analytics gate are unchanged. ([0406d2f](https://github.com/CarlosZiegler/varu/commit/0406d2fdb09a0d9dbd810ec440972bf3d033a4db))
- **Hashed assets are cached for a year.** `/assets/*` answers `public, max-age=31536000, immutable` (`apps/web/public/_headers`; the build fails if an unhashed file lands there). A repeat visit takes scripts from the cache without a request: the landing hydrates at 0.92 s instead of 1.41 s, `/dashboard` paints at 0.20 s instead of 0.40 s and hydrates at 0.50 s instead of 1.01 s. Favicons, figures and other public files keep revalidating. ([ee97233](https://github.com/CarlosZiegler/varu/commit/ee9723356bc4caaa39f8ccaea439b4ac895e5543))
- **The landing figure is sent once.** The request machine was inlined in the HTML and shipped again as 130 KB of JSON in the landing script. The server now inlines the generated SVG and hydration keeps it; the landing chunk drops from 57 to 33 KB gzip and a first visit hydrates 0.28 s sooner. The drawing and its animation are pixel-identical. ([dd62551](https://github.com/CarlosZiegler/varu/commit/dd62551c194cc90195bd26e779517fedc6023dad))
- **No hydration error on the dashboard.** Relative times ("5 minutes ago") were computed from the clock at the server render and again at hydration, seconds later, and React threw #418 whenever the rounding changed in between. `useFormatTimeAgo` counts from the moment the server rendered until hydration; the activity timeline's day headings now use the visitor's time zone as well ([W16](/docs/development/web-conventions)). ([772bef0](https://github.com/CarlosZiegler/varu/commit/772bef0a0121e368999281556b37eaee4c90b9c1))
- **Web Vitals from real visits.** Visitors who allow analytics in the banner report LCP, INP, CLS, FCP and TTFB with the route pattern (never the URL), language, navigation type and connection class to `POST /api/events/web-vitals`, which writes one `web_vital` line to Workers Logs. Nothing is observed or sent without that consent, and nothing loads before the first paint. See [Observability](/docs/architecture/observability). ([bcfbd84](https://github.com/CarlosZiegler/varu/commit/bcfbd841de597eb0025aef224afd9e6f898ec5df))
- **The Workers Logs sampling rate is explicit.** `observability.logs.head_sampling_rate` is set to `1` in `wrangler.jsonc`, with what lowering it saves and loses (sampling drops whole requests, errors included) and the cost table in [Observability](/docs/architecture/observability). ([67588c2](https://github.com/CarlosZiegler/varu/commit/67588c2f32cca382a5c601f2729925e5a54c29a3))


## Earlier updates

- 2026-11-05: [Dates in your time zone, without a hydration error](/docs/changelog/2026-11-05-dates-in-your-time-zone)
- 2026-11-05: [Public pages paint before any JavaScript arrives](/docs/changelog/2026-11-05-first-paint)
- 2026-11-04: [Better Auth 1.7.16 security fix and dependency round](/docs/changelog/2026-11-04-better-auth-security-dependency-round)
- 2026-11-04: [Animated assistant approval on the landing, and a design patterns page](/docs/changelog/2026-11-04-landing-assistant-demo)
- 2026-11-04: [Loading skeletons drawn from the real components](/docs/changelog/2026-11-04-skullet-skeletons)
- 2026-10-29: [Invitations are not a mail relay](/docs/changelog/2026-10-29-invitation-relay)
- 2026-10-29: [MCP Apps widget, approval status and plugin marketplaces](/docs/changelog/2026-10-29-mcp-apps-widget-approval-status)
- 2026-10-29: [One URL per language](/docs/changelog/2026-10-29-path-locales)
- 2026-10-29: [Account emails in React Email, in English, German and French](/docs/changelog/2026-10-29-react-email)
- 2026-10-29: [Share cards, Markdown negotiation and one site identity](/docs/changelog/2026-10-29-seo-agent-readiness)
- 2026-10-27: [TanStack AI 1.0, password forms and iPhone Duo](/docs/changelog/2026-10-27-deps-password-forms-iphone-duo)
- 2026-10-19: [Agent skills from upstream and the /pr template](/docs/changelog/2026-10-19-agent-skills-update)
- 2026-10-19: [Ponytail from the official plugin](/docs/changelog/2026-10-19-ponytail-plugin)
- 2026-10-17: [One folder per backend feature, tagged errors and written rules](/docs/changelog/2026-10-17-backend-structure)
- 2026-10-17: [One folder per mobile feature, and the API aliases are gone](/docs/changelog/2026-10-17-mobile-structure)
- 2026-10-17: [The web app is organized by feature, like the backend](/docs/changelog/2026-10-17-web-structure)
- 2026-10-16: [Auth and tenant security fixes](/docs/changelog/2026-10-16-auth-and-security-fixes)
- 2026-10-16: [Database, Worker and web performance](/docs/changelog/2026-10-16-performance-and-placement)
- 2026-10-16: [Row-level security per Organization](/docs/changelog/2026-10-16-row-level-security)
- 2026-10-15: [AI assistant and one tool catalog](/docs/changelog/2026-10-15-assistant-and-agent-tools)
- 2026-10-15: [Dependency round, i18next fix and ReUI controls](/docs/changelog/2026-10-15-dependency-round-and-reui)
- 2026-10-15: [Developer documentation and changelog](/docs/changelog/2026-10-15-developer-docs-and-changelog)
- 2026-10-15: [Documents and large uploads](/docs/changelog/2026-10-15-documents-and-large-uploads)
- 2026-10-15: [Landing page redesign](/docs/changelog/2026-10-15-landing-redesign)
- 2026-10-15: [Landing sections and project skills](/docs/changelog/2026-10-15-landing-sections-and-project-skills)
- 2026-10-14: [Trace and code block primitives](/docs/changelog/2026-10-14-trace-and-code-blocks)
- 2026-10-13: [TanStack Start 1.0, OG images and durable imports](/docs/changelog/2026-10-13-start-og-and-imports)
- 2026-10-12: [Payments, native screens and a new landing page](/docs/changelog/2026-10-12-payments-and-native-experience)
- 2026-10-03: [Runtime and recovery hardening](/docs/changelog/2026-10-03-runtime-and-recovery)
- 2026-09-25: [Authentication foundations and performance](/docs/changelog/2026-09-25-auth-and-performance)
- 2026-09-24: [Platform dependency alignment](/docs/changelog/2026-09-24-platform-dependencies)
- 2026-09-03: [oRPC and Drizzle upgrades](/docs/changelog/2026-09-03-typed-api-upgrade)
- 2026-08-25: [Typed domain operations and a real dashboard](/docs/changelog/2026-08-25-typed-domain-and-dashboard)
- 2026-08-24: [Agent connections and native account security](/docs/changelog/2026-08-24-agent-connections-and-account-security)
- 2026-08-13: [Cloudflare email and shared UI](/docs/changelog/2026-08-13-email-and-ui)
- 2026-07-30: [An enforced client/server boundary](/docs/changelog/2026-07-30-client-boundary)
- 2026-07-24: [Native interface foundations](/docs/changelog/2026-07-24-native-foundation)
- 2026-07-13: [Administration and data workflows](/docs/changelog/2026-07-13-admin-and-data-workflows)
- 2026-06-10: [Setup, storage and localization](/docs/changelog/2026-06-10-setup-storage-and-i18n)