Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.30.0 - 2026-10-19

Added

• cli: Record the project's package manager in package.json (c5b0b92)
• z: Describe a JSON payload whose shape is not fixed (999d0e8)
• vukem: Give the operational seams their own names and checks (131e904)
• z: Let the validate tag express an optional value and a default (51fbbfc)
• cpu: Report the container's CPU quota for pools the runtime does not size (073560f)
• vukemtest: Decode a response body into a struct (9f218a9)

Fixed

• apidocs: Run the accessibility pass in a microtask, not a frame (6664021)
• cli: Make the make:* generators produce lint-clean code (0977763)
• docker: Make the lockfile an explicit build input of the assets stage (f29c478)
• cli: Gate install:auth --social and give its packages a doc.go (856512c)
• upload: Refuse a type the content detector cannot produce (7912ed6)

Security

• cli: Teach the API ability model the scaffold already enforces (b8087dc)
• archive: Read a user archive under a policy and return safe keys (0d1e0c8)
• mediatype: Name the types an app produces, not the ones it accepts (933de25)

0.29.0 - 2026-10-18

Added

• site: Serve sitemap.xml and robots.txt for search engines (0b09352)
• cli: Add -prefix to openapi:export and the codegen generators (9062d20)
• api: Add RegisterWith for a caller-supplied input schema (bbc07c4)
• ulid: Add a monotonic ULID generator with Valid and TimeOf (f71f287)
• auth: Accept the token from extra headers, with Vary (3604e4c)
• queue: Let a handler report a permanent failure and see its attempt (6d90e21)
• postgres: Add an sse.Broker on LISTEN/NOTIFY (f6ce304)
• openapi: Carry examples in schemas, parameters and media types (cb9fff1)
• openapi: Reject a path prefix that matches no route (0ab4aaf)
• schema: Expose a Schema's dialect and record a migration's SQL (ad353df)
• queue: Ship the queue tables as a registrable migration (ddfe2fd)
• session: Ship the sessions table as a registrable migration (f5ae66b)
• cache: Ship the cache table as a registrable migration (4430efb)
• webhook: Ship the delivery log table as a registrable migration (38fdf2c)
• schema: Add stores.Migrations for the tables vukem owns (0408641)
• ui: Give the generated password fields a toggle and live rule checks (e5b876c)
• cli: Choose the auth message catalogs with install:auth --locales (6ca182d)

Changed

• auth: Read the listed token owner from its row (da63a05)
• cli: Keep starter package comments in a doc.go (264fb46)

Fixed

• apidocs: Give Scalar's caption labels and combobox field accessible markup (082ab73)
• release: Match changelog headings literally and refuse an empty body (89a19bb)
• openapi: Describe path parameters from their doc tag (174cdb3)
• cli: Pin install:billing to contrib/stripe v0.4.0 (9b51f70)
• cli: Keep the demo resource's links inside the demo (c3eb298)
• cli: Generate the Dockerfile for the package manager the project uses (3e3c92c)
• docker: Give the starter image a mailer so its commands can run (04b9c2b)
• cli: Make a fresh scaffold pass the repository's golangci-lint (d76e7b7)
• cli: Scope the API keys install:api mints instead of granting "*" (7791277)
• cli: Commit the generated git hooks with the executable bit (be9ceea)

Security

• vukem: Add WithOpenAPI so an app owns its document info (697c8a0)
• cli: Scaffold the project standards behind flags on vukem new (68e6763)
• cli: Point a new project at the documentation it needs next (bc09220)

0.28.0 - 2026-10-18

Added

• site: Wrap code blocks and add Term and Quote components (7328830)
• signed: Add Signer.WithClock for the app clock (b1fc8b0)
• api: Eager-load includes and add a cursor-aware Request.CursorPaginate (ab96f97)
• apidocs: Configurable route names for several references (751431c)
• vukem: Add MiddlewareOptions.CSRFTokenFallback (656bc11)
• vukem: Add WithViewFuncs for custom template functions (f5d6d4f)
• vukem: Add WithEventsFake and WithRateLimiters options (f3f7efc)
• BREAKING: config: Resolve @file: secrets in the process environment (ea204d2)
• otel: Read OTEL_SERVICE_VERSION into service.version (5c32abe)
• config: Escape a literal @file: value as @@file: (46a7c04)

Fixed

• site: Fit the header on 390px phones (cbc14fe)
• cli: Ignore .env.local in new projects (4a47421)
• site: Fit code blocks and steps on phones (d077dac)
• authz: Let T values use the policy registered for *T (242e495)
• inertia: Name the page script after Config.RootID (6c57955)
• inertia: Keep X-Inertia-Location on https behind a trusted proxy (a43acd6)
• app: Warn about a missing Inertia error page without WithEnv (e8b6990)
• authz: Document the shallow copy for value subjects and test fallback edges (a0ab556)
• schema: Pluralise Constrained() targets like the orm (0605a43)
• schema: Rebind ? placeholders in Raw for the dialect (43c7aa0)
• orm: Name the Field() name in built-in rule messages (46745cd)
• BREAKING: orm: Read Chunk batches by keyset instead of OFFSET (7e8b6ce)
• BREAKING: orm: Cap Paginate and CursorPaginate per page at 100 (9f0bedf)
• mongo: Answer 404 for ErrNotFound and return [] from All (2f02c82)
• orm: Group OR filters in keyset Chunk and check the selected key up front (56659b5)
• auth: Match the Bearer scheme case-insensitively (a7f1ed1)
• jwt: Answer key set and user store outages with 503 (2d5e1b4)
• cli: Revoke API tokens instead of deleting them on email proof (e75382d)
• cli: Require the password and a rate limit to regenerate 2fa recovery codes (4d78c0a)
• BREAKING: cli: Refuse install:auth --social x (694b6ae)
• upload: Accept Verify keys for types outside the extension table (7658d96)
• storage: Send the real Last-Modified and hide local temporary files (d031b68)
• BREAKING: storage: Require UploadRules.Types in PutUploaded (d30d7aa)
• schedule: Log lock errors and measure took from the task start (fb039f7)
• upload: Keep scanner causes and log tus completion failures (709123d)
• events: Name listeners by function and recover sync panics (eeb50d5)
• vukem: Explain queue commands on in-process queue drivers (ff78253)
• BREAKING: mail: Validate tags for every transport (938c891)
• mail: Retry network errors in the Resend and Mailtrap transports (78da6ed)
• BREAKING: vukem: Fail boot on a mail transport that cannot send (a74ee8d)
• events: Re-panic http.ErrAbortHandler and wrap error panics from sync listeners (01ee89d)
• api: Parse typed handler input with the request context and logger (0958e16)
• BREAKING: api: Replay only representation headers on idempotent repeats (1925d67)
• cli: Create the output directory of codegen:types -o (eee86eb)
• graphql: Cost page-size arguments by their SDL default when omitted (903c041)
• BREAKING: graphql: Reject introspection in Handler unless opted in (03d0326)
• BREAKING: graphql: Validate nested inputs, mask Validate errors, check fields at build (3625e30)
• openapi: Reject duplicate operationIds (beb0ac6)
• api: Never replay credential headers on idempotent repeats (4282e95)
• BREAKING: middleware: Let a route raise the router-wide body limit (bd64d69)
• web: Send the c.Status code with the next writer's headers (daefe5c)
• BREAKING: web: Reject unknown JSON fields in BindJSON as documented (1387d1b)
• web: Answer 422 when FormFile reads a non-multipart request (c6243d2)
• BREAKING: router: Make a group's "/" route exact like the root route (e6f8e5c)
• router: Strip inlined-closure suffixes from middleware names (46edb46)
• middleware: Detect fingerprints strictly and add ETags to embedded files (d11e4dd)
• csrf: Trigger the token fallback on the session cookie only (b24352c)
• web: Pass the error to error views in debug mode (067a370)
• session: Report no id for cookie sessions, even after Regenerate (4bbb51e)
• z: Use the singular in default messages for a count of 1 (a1b5717)
• z: Leave Nullable-only keys out of the JSON Schema required list (004e63f)
• middleware: Keep an earlier body limit in MethodOverride (ab1b31b)
• web: Apply a pending status only to 200 and commit it on Flush (ff0e6fb)
• BREAKING: view: Refuse custom template functions that replace built-ins (ed9a6df)
• BREAKING: telegram: Honour info min level, never nil handler, html-safe send truncation (9f8715c)
• broadcast: Reject channels with an empty dot segment (0c30e19)
• BREAKING: webhook: Namespace dedupe keys per provider or route (e722635)
• webhook: Record deliveries dropped for a disabled endpoint (a177d48)
• BREAKING: stripe: Form-encode every map and slice type, refuse the rest (9958167)
• cli: Pin install:billing to the latest contrib/stripe tag (79ef0c4)
• BREAKING: i18n: Refuse plural objects without other, explain bad catalog names (be0512e)
• devtools: Treat X-Forwarded-Proto, X-Forwarded-Port and Via as proxied (b10eb56)
• flags: Stop repeating the flags prefix on invalid values (a15d214)
• admin: Mount flag routes only for registered flags, skip no-op audits (da22e46)
• admin: Match short secret words in column names as whole segments (f0e20df)
• admin: Match secret words anywhere, exempt only known counters (2d8d4c2)
• webhook: Never namespace dedupe keys by the raw request path (d477a32)
• telegram: Count UTF-16 units and skip self-closing tags when truncating (05ee8b9)
• stripe: Bound param nesting, refuse NaN/Inf and send []byte as a string (91d625a)
• vukemtest: Restore Accept after JSON sends, match HX-Trigger lists and stored nils (d916cd5)
• cli: Validate generator input before writing and create the policies registry (0a17532)
• cli: Run templ generate before app-command rebuilds and watch .buildtags (727d365)
• cli: Check bootstrap/app.go can be patched before install:inertia deletes files (0580ff6)
• cli: Read APP_ENV from .env too when choosing embedded resources (e8166d5)
• cli: Build the release binary with CGO_ENABLED=0 like the Dockerfile (0f5d2e1)
• vukem: Report every boot configuration error at once (d31d8dc)
• flags: Fail closed when a FLAG_ @file: secret cannot be read (430b7db)
• vukem: Check @file: secrets are regular files before opening them (6d98bce)
• schema: Defer closing the table listing rows on every return (320f9a1)

Security

• vukem: Send security headers on the maintenance 503 (8eff044)
• BREAKING: openapi: Consistent operationIds, plain route bodies, unknown schemes fail (22a766c)
• api: Document v0.28 API, OpenAPI and GraphQL fixes and refresh stale names (88691b5)

0.27.0 - 2026-10-18

Added

• site: Add a changelog page linked from the header (6381fa5)
• auth: Add ProblemJSON so every API auth failure is problem+json (0c183cf)
• vukem: Warn once when proxy headers arrive without TRUSTED_PROXIES (06ee06a)
• ratelimit: Export IPKey and group throttle keys by it (b0e40f5)
• vukem: Let lazy store funcs fall back with ErrUseDefault (7c2b800)
• telegram: Read the Bot API base URL from TELEGRAM_API_URL (eaab1b3)
• fixinline: Check every go:fix inline wrapper against go fix (8655ddb)
• database: Add ScanTime for timestamps SQLite returns as text (7198679)
• factory: Add en and pt-BR locales with commerce and address data (9c5bf18)
• factory: Add CreateMany to insert factory models in batches (7dc730b)
• vukem: Select seeders and pass seeder flags in db:seed (4312444)
• flags: Add typed feature flags with a cached database store (30031c3)
• vukem: Register feature flags with WithFlags and build them with app.Flags (ffed272)
• admin: Add a feature flags page with audit events (041c0f5)
• cli: Add install:flags and wire feature flags into the admin scaffold (f70d6b0)
• web: Let a frontend adapter render the error page (358087f)
• cli: Ship an Error page in the Inertia starters (f9c00a7)
• BREAKING: vukem: Cap request headers at 64 KiB with HTTP_MAX_HEADER_BYTES (320b89b)
• grpc: Let operators raise the gRPC port's header cap (7db5602)
• vukem: Keep an existing ErrorPage hook and warn without an Error page (0ab65c5)

Changed

• vukem: Group the root package files by theme (a90f9c8)
• factory: Replace NewFakerWithLocale with Faker.WithLocale (fe297b4)
• flags: Type scopes, version cached values and describe flags with Info (5593d07)
• web: Pass error pages to the hook as a web.ErrorPage struct (b34be2b)

Fixed

• BREAKING: cli: Require the account's login to verify an email address (37da4e1)
• cli: Send expired verification links to the resend page (379620d)
• BREAKING: ratelimit: Key IPv6 clients by their /64 in ByIP (6f66901)
• vukem: Harden the ErrUseDefault fallback of lazy store funcs (9ac99f1)
• BREAKING: grpc: Give the gRPC port its own cleartext opt-in (91cf1f5)
• BREAKING: otel: Export metrics to the generic OTLP endpoint by default (4cb0b8e)
• apicheck: Reject trailing braces and foreign-major exception versions (4156585)
• orm: Scan text timestamps into time fields on SQLite (fc0eac7)
• vukem: Fail closed on db:seed --class without a name (4de9aa6)
• database: Accept space-separated RFC 3339 text in ScanTime (ea2ef1c)
• flags: Match FLAG_ keys exactly when checking for unknown flags (7895fad)
• vukem: Refuse FLAG_ keys in .env when no flag is registered (c5c2697)
• admin: Redact string flag values and survive a failed audit row (52881da)
• cli: Make install:flags safe to re-run (7bbcbf6)
• apidocs: Load the API reference with zero CSP violations (770263f)

Security

• repo: Move the community health files into .github (49c22b0)
• apicheck: Add a versioned exception list for security-driven breaks (e4542e7)
• BREAKING: inertia: Render an Error page for errors on Inertia requests (d9d3876)
• web: Render the built-in status pages under the default CSP (83fcc01)

0.26.0 - 2026-10-17

Added

• stripe: Add typed Accounts v2, refunds and transfer reversals (3ae351a)
• BREAKING: cache: Add Sharer contract and fail closed on undeclared stores (7b86743)
• redis: Declare the cache store shared (bcd81e0)
• cache: Bound Unwrap chains with cache.Layers (25e49bb)
• database: Add RebindChecked that rejects unterminated SQL and mixed placeholders (a5864e0)
• BREAKING: queue: Pop same-millisecond database jobs in push order (b644749)
• signed: Verify links signed with previous keys (acad399)
• social: Accept state cookies signed with previous keys (febfa33)
• session: Open cookie sessions sealed with previous keys (5658c74)
• middleware: Accept maintenance bypass cookies from previous keys (efccd58)
• cli: Add key:rotate and pass previous keys in auth scaffolds (8cdca11)
• grpc: Add ErrorContext to translate keyed errors into the request locale (ae3a3ca)
• schema: Add Schema.HasColumn for upgrade migrations (99e2b8a)
• BREAKING: auth: Soft revoke API tokens with revoked_at (6cf8d9c)
• cli: Add revoked_at to the install:auth access_tokens table (534c3d8)
• cli: Revoke API tokens with Tokens.RevokeAll on password reset (d66f523)
• BREAKING: i18n: Return the config error from Middleware instead of panicking (43df6fd)
• mail: Add the Mailtrap Email API transport (1c70018)
• vukem: Select the Mailtrap transport with MAIL_MAILER=mailtrap (0689a31)

Changed

• graphql: Derive the 5xx check from errs.Status (6cd0ccb)
• BREAKING: orm: Remove the deprecated BeforeCreater and AfterCreater aliases (ad02707)
• BREAKING: mail: Remove the deprecated WithAttachments alias (7c57159)
• BREAKING: stripe: Remove the deprecated Client.Do (a5affc3)

Fixed

• BREAKING: stripe: Map v2 errors and validate Call paths and object ids (4550bf6)
• BREAKING: schedule: Check OnOneServer locks with cache.Shared (3c6f831)
• BREAKING: vukem: Require a declared shared cache for RATE_LIMIT_STORE=cache (5ba0290)
• schedule: Name cache.Sharer in ErrLocksNotShared (42fe1c1)
• database: Quote only an 80-byte prefix of the query in RebindChecked errors (e7aea62)
• queue: Add the seq column only on an unknown-column probe error (cd7434a)
• cli: Keep the starter upload test off the filesystem (f4a0be4)
• cli: Make key:rotate atomic and keep .env line syntax (c063b95)
• graphql: Keep loader batches whole while siblings make progress (dc529e4)
• graphql: Translate keyed resolver errors into the request locale (427aab1)
• graphql: Hide field errors wrapped in a 5xx HTTPError (6e05325)
• BREAKING: grpc: Send 5xx HTTPErrors as "internal error" and log their cause (35832ec)
• graphql: Cap how long a pending loader batch waits for progress (2a6c078)
• BREAKING: grpc: Mask unknown Validate errors and 5xx headers (aa000e2)
• auth: Answer 503 when the token store fails (58a101b)
• auth: Keep revoking possible on access_tokens without revoked_at (30404bd)
• mail: Harden Mailtrap error decoding and redirects (a9f7b84)

Security

• cache: Document the cache.Sharer contract (73c41d0)
• vukem: Honour APP_PREVIOUS_KEYS in every APP_KEY-derived feature (6c5084c)
• web: Add AuditEvent for routine audit records at info (35995da)
• BREAKING: cli: Make the install:auth sign-up enumeration-safe (53788f2)
• BREAKING: cli: Require verified email and rate limit sign-up in install:auth (0eb6fa2)
• BREAKING: cli: End squatter access when the email is proven (99edfe5)

0.25.0 - 2026-10-17

Added

• middleware: Log peer address and resolved client IP per request (c6da5ad)
• middleware: Add HSTSForce and HSTS_FORCE for untrusted TLS proxies (98135e2)
• stripe: Add connect resources and per-request idempotency and account options (7970378)
• stripe: Accept connect webhook secrets and expose event account (e253c0f)
• router: Report whether routes were compiled (26f12d5)
• vukem: Add WithRoutesAfterBoot for routes that need booted services (8596784)
• vukem: Let seeders reach the app with WithAppSeeders (d2c820a)
• vukem: Name seeders through an optional Name method (da31331)
• export: Stream CSV, JSON and NDJSON downloads (50f9f6b)
• errs: Add message keys and a request translator to errors (3200fb9)
• web: Show keyed http errors in the request locale (67dd98b)
• i18n: Ship built-in en and pt-BR framework messages (5a54ca2)
• auth: Translate guard errors through message keys (6b52fdd)
• social: Add message keys to callback errors (9eed6e8)
• orm: Translate unique and exists rule messages (7c20d74)
• mail: Build envelopes from the send context with ContextEnveloper (f977288)
• telegram: Add SendSync/ContactSync, Filter and RateLimit (ed796d4)
• vukem: Add TELEGRAM_LOG, TELEGRAM_RATE_LIMIT and WithTelegram (a0e4030)
• webhook: Add DeliveryLogFunc and document DeliveryLog as the extension point (9fa44c8)
• grpc: Serve rpc services on their own port as an app runner (54bec2a)
• s3: Add idempotent region-aware CreateBucket (1586a42)
• totp: Encode qr codes up to version 40 (b078d4f)
• api: Add Op.ValidateResponse to check typed handler output (5b1736e)
• BREAKING: openapi: Emit zod 4 schemas and inline request body schemas (6204877)
• vukem: Run codegen:types without a database or APP_KEY (1f1077f)
• BREAKING: i18n: Add locale source order and allowed locales to MiddlewareConfig (3d1680d)
• vukem: Add MiddlewareOptions.I18n and APIMiddlewareWith (64f3d12)
• inertia: Add RenderStatus for pages with a non-200 status (3ffb56f)
• i18n: Fail closed on invalid middleware config and vary on cookie (d80a1ec)
• vukem: Install the locale resolver in APIMiddleware (9a35a8e)
• vukem: Add ServeOpenAPIWith for prefixed, production-opted documents (0d9b5b5)
• BREAKING: schema: Add partial indexes with Index/UniqueIndex(...).Where(expr) (52f1906)
• database: Add Rebind for portable raw SQL placeholders (1012e20)
• database: Fan out query observers and add vukem.WithQueryObservers (f983e9d)
• uuid: Add stdlib UUID v4/v7 package (6faedf8)
• session: List a user's sessions and revoke one by handle (5c70a2a)
• vukem: Read SESSION_RECORD_CLIENT into the session config (98d49bc)
• auth: End sessions on every driver with a per-user session version (81efca9)
• vukemtest: Add WithSession and stamp the session version in ActingAs (62a0836)
• redis: Implement session.ListStore on the session store (80c6b94)
• cli: End every session on password reset with a session version (bd4e878)
• queue: Add Queue.SetClock and the queue.Clock driver interface (5d334ee)
• queue: Bound the worker drain with WorkOptions.StopTimeout (486ff01)
• queue: Add DispatchKindTx (cafe81e)
• redis: Implement queue.Clock on the queue driver (84aceaf)
• mail: Add Mailer.SendLaterTx (add0822)
• schedule: Add Task.OnOneServer (3d4ac45)
• BREAKING: app: Run a queue worker in serve for persistent queues (8324377)
• app: Add MailLaterTx (a1a3f17)
• app: Refuse OnOneServer schedules on the in-process cache (08d912d)
• schedule: Namespace task locks with Options.Namespace (3c536b3)
• httpclient: Add Options.WrapTransport for tracing and metrics (27e4822)
• vukem: Add App.Instrument hooks for database, queue and mail (2ac2c2f)
• otel: Add metrics, data-layer spans and OTEL_* settings from app.Source (a76a55d)
• otel: Export metrics over OTLP/HTTP from OTEL_* settings (4ee0cb1)

Changed

• stripe: Deprecate Do in favour of Call (d944d94)

Fixed

• middleware: Warn when HSTS_FORCE is ignored and document its scope and log privacy (3674147)
• tools: Report compatible apidiff changes as unchecked in gate mode (77a74ed)
• stripe: Refuse account scope on platform calls and decode expanded ids (61133d0)
• router: Mark the router compiled before building it (eb7bff3)
• vukem: Fail closed around routes after boot and keep the boot error (35172ca)
• middleware: Hijack through wrapped writers in gzip (5bde2ca)
• web: Sanitize Download file names (9eb6303)
• export: Renew write deadline per write and always abort mid-stream (806c5b2)
• i18n: Fill only existing catalogs of the same locale with built-in messages (99b6c23)
• errs: Copy the params given to NewKey (ec9f1be)
• broadcast: Show keyed sse refusals in the request locale (6b4bc1d)
• sse: Release a topic's broker subscription when its last subscriber leaves (23abd7b)
• telegram: Report errors outside the queue lock and never forward OnError records (6e02e03)
• sse: Make every subscriber wait for its topic relay and fail closed (9eb5277)
• vukem: Show telegram log forwarding off in about (5cee6b7)
• graphql: Fold go names of json-tagged fields in the default resolver (27ac7f1)
• graphql: Free a websocket subscription id before its terminal message (b917414)
• grpc: Refuse a cleartext production port in Server too (1e8b11b)
• BREAKING: z: Treat required on a list as present, not non-empty (5cd14ca)
• openapi: Emit minLength 1 for required strings (abafd04)
• BREAKING: openapi: Suffix component names that shadow typescript globals (514d1c8)
• vukem: Never boot a warmup app and export openapi in warmup (5c34f59)
• openapi: Reserve the fetch types the generated client uses (d817eae)
• openapi: Fail typescript codegen on colliding generated names (2435e2b)
• web: Answer 422 for z.FieldError and z.Issues returned by handlers (bea0e86)
• BREAKING: z: Hide the text of plain Refine and Custom errors (6bdc413)
• web: Fail closed on z issues and skip redirect-back for GET (36110d0)
• upload: Send z validation messages from tus completion (e80f03b)
• apidocs: Keep the nonce-only CSP and pass axe serious checks (8ce814f)
• auth: Answer problem+json on token routes and use the app clock (890d919)
• auth: Force JSON only on the error path of API guards (cdae9a9)
• openapi: Match PathPrefix on whole path segments (6d9196b)
• apidocs: Limit the CSP shim to plain style values and hide scalar.com links (95da209)
• orm: Share the Rebind lexer for WhereRaw placeholder counting (82972f7)
• dbtest: Bound each conformance subtest and shrink the MySQL bulk insert (db74695)
• orm: Lex MySQL -- comments, backticks and SQLite brackets per dialect (d33721a)
• orm: Reject $n in WhereRaw and fail closed on unterminated WHERE SQL (d21a30b)
• database: Contain panicking query observers and ignore typed nils (e5432a9)
• auth: Bind remember-me tokens to the user's session version (e26bdc0)
• cli: Delete remember-me tokens when ending a user's other sessions (493583f)
• redis: Key sessions by SHA-256 of the id and re-key legacy keys (cb3f49b)
• auth: Harden session version checks and remember-me deletion (9ac9923)
• session: Strip control and format runes from the recorded user agent (0854dad)
• app: Follow the app clock in the queue and its drivers (e6dfa9c)
• app: Stop waiting for runners that ignore ctx after SHUTDOWN_TIMEOUT (8ad882a)
• cli: Queue the verification mail in the auth scaffold (290116c)
• queue: Return reserve errors from Work with StopWhenEmpty (d358031)
• app: Create the database queue tables at boot (c8f5c5e)
• app: Namespace schedule locks by APP_NAME (77667c7)
• queue: Free only shutdown-caused interruptions, at most three in a row (a8b4a0b)
• app: Give runners three seconds of grace after SHUTDOWN_TIMEOUT (fad85c2)
• app: Name the database queue in its boot error (ec100e3)
• httpclient: Fail closed when WrapTransport returns nil (3b3c6f8)
• otel: Harden provider boot, shutdown and globals; add db.system.name (d745922)
• vukem: Chain Instrument query hooks through database observers (2df56d3)
• queue: Contain panicking job observers and add AddObserver (d1f047b)
• vukem: Add Instrument job hooks through queue.AddObserver (88b4aee)
• tools: Exempt the sessiontest conformance suite from the coverage gate (b223724)

Security

• site: Expand cache, scheduler, idempotency, two-factor, redis and mongodb pages (03a9a83)

0.24.0 - 2026-10-17

Added

• schema: Add named CHECK constraints with Check and DropCheck (adb5339)
• orm: Add row locks with LockForUpdate, ForShare, SkipLocked and NoWait (9f70c15)
• orm: Add CreateMany for batched multi-row inserts (f420758)
• z: Add FieldErrorKey for translatable refine messages (c4a3e06)
• z: Add StringSchema.Preprocess to normalize before checks (39c6e26)
• errs: Add ValidationError.Append without a result (1bc6fc1)
• vukemtest: Add Build to assert that an app fails to build or boot (c9d0b10)
• vukemtest: Add flash assertions for web and Inertia responses (ff26679)
• vukemtest: Add AssertNoFlash and require a present flash value (d5f7c8b)
• vukem: Run the scheduler inside serve (fab0830)
• BREAKING: vukem: Run the scheduler inside serve by default (0cf2d69)
• s3: Bind presigned PUT URLs to content type and length (74a04f4)
• mongo: Add OpenLazy and document MONGO_DATABASE and authSource (c567860)
• redis: Add OpenLazy so the app can boot while Redis is down (3362b03)
• middleware: Add CSPSources and ReportURI to SecureHeadersConfig (b245387)
• vukem: Add DefaultMiddlewareWith with CSP, stateless and bypass options (f0aac24)
• auth: Add a configurable prefix to api tokens (0c7a622)
• webhook: Add hmac, a middleware constructor that fails at boot (ffc315a)
• BREAKING: cli: Translate install:auth messages with en and pt-BR catalogs (b1b3926)
• database: Add the vukem_nosqlite build tag to leave SQLite out (063cabc)
• cli: Add vukem new --minimal and project build tags (a879c31)
• session: Store hashed ids and revoke a user's other sessions (a79cc72)
• auth: Record the session user on login (9a33939)
• cli: End other sessions on password reset and 2fa enable (be85d8b)
• database: Add Tx.AfterCommit hooks (55ec70e)
• app: Add WithJobsFunc so job handlers reach the app (4dc4cf0)
• mail: Add Mailer.SendLater (d5740c3)
• app: Encrypt queued mail payloads and wire Mailer.SendLater (9640bd9)
• vukem: Add ReadyHandler, CheckHealth and per-check health timeouts (16b84b5)
• vukem: Expose Stdout, Stderr and Stdin to app commands (9b520b7)
• BREAKING: vukem: Boot without APP_KEY outside production and fail closed on use (2b73e60)
• vukem: Add lazy cache, session and queue store options (515e4fc)
• middleware: Honour X-Forwarded-Proto only from trusted proxies (d6fc83f)
• vukem: Read TRUSTED_PROXIES and TRUST_FORWARDED_PROTO from the environment (59b87a4)
• cli: Ship a production Dockerfile and .dockerignore in every starter (48742fb)
• web: Read the client IP from a named proxy header (5290e94)
• cli: Build the starter image with the tags in .buildtags (1584b64)
• vukem: Warn at boot when TRUSTED_PROXIES trusts every address (d6081c3)

Fixed

• orm: Make CreateMany fail closed on unordered ids and pk-only models (c4a849f)
• z: Revalidate Preprocess output and reject a nil func (ad38233)
• BREAKING: z: Honor FieldError path in Custom parser errors (b3c5a4b)
• session: Expire store sessions by the manager clock (b1d8ac6)
• session: Make the store clock race-free and test Prune with it (83ba81a)
• schedule: Bound the wait for running tasks on shutdown (8d48a39)
• admin: Match % and _ literally in list search (18933b5)
• middleware: Refuse wildcard hosts and unsafe schemes in CSPSources (4ca3a65)
• vukem: Refuse SessionBypass with Stateless and document bypass matching (3c1c541)
• social: Record used oauth states in the cache store (d7b5e3f)
• BREAKING: jwt: Require audience and issuer with a remote key set (c0717df)
• social: Stop reflecting the provider error parameter (e0e36fd)
• BREAKING: api: Bound query page and filter value lists (ca25efb)
• BREAKING: api: Scope idempotency keys by the authenticated principal (035a90f)
• auth: Keep the session when the user lookup fails (9f3cc10)
• auth: Treat wrapped no-rows errors from providers as not found (2eb7730)
• BREAKING: jwt: Detect shared key sets by interface and fail guards at boot (df31f51)
• api: Make idempotency scopes unambiguous across guards and prefixes (a58f81c)
• api: Keep default query limits for non-positive values (9cd965e)
• vite: Serve public files from the app while the dev server runs (c73b941)
• cli: Load htmx before the vite entry in starter layouts (450f18e)
• cli: Create the social user before returning it (7f2b27f)
• cli: Let the app's language catalog and English subjects back auth messages (fec8ced)
• session: Never resurrect revoked sessions and harden legacy re-key (ed1a998)
• auth: Namespace the session owner by guard (5c9170a)
• cli: Flash recovery codes before revoking sessions on 2fa enable (e20e534)
• BREAKING: queue: Refuse delays on sync and dispatch after commit without TxPusher (01d1f13)
• cli: Queue the password reset mail in the auth scaffold (da122af)
• database: Keep Tx comparable (07e5add)
• mail: Keep Mailer comparable (74d7ef5)
• database: Isolate AfterCommit hook panics and reject foreign Tx (6acdbd0)
• app: Turn a WithJobsFunc panic into the Queue error (336f95c)
• BREAKING: app: Refuse clear-text queued mail jobs by default (af48ee4)
• vukem: Type the readiness body and log write errors (82f8a76)
• BREAKING: signed,social: Refuse signing keys shorter than 32 bytes (1308ec2)
• vukem: Tolerate a missing APP_KEY only with an explicit development or test APP_ENV (39e64d5)
• cli: Derive scaffold signing keys with app.DeriveKey (b846bd5)
• vukem: Run at most one goroutine per health check (cd7941c)
• vukem: Reject nil lazy stores and detect the memory cache through any option (eb51232)
• upload: Log presign response write errors (4338d07)
• vukem: Bracket IPv6 hosts in the listen address (0c9f8c2)
• web: Return client IPs from headers in canonical form (113d0ff)
• middleware: Require one X-Forwarded-Proto line and trusted proxies (50ca1a4)

Security

• api: State that op.security does not authenticate the route (7cd989c)

0.23.0 - 2026-10-17

Added

• webhook: Add signed outgoing webhooks with retries and delivery log (6706466)
• postgres: Add pgtest helper for per-test databases (c7d563c)
• vukem: Add key:generate app command (95d074a)
• imaging: Add contrib/imaging for safe image thumbnails (ddd6588)
• ratelimit: Add a fixed-window limiter over a shared counter (5da8705)
• app: Choose the rate limit store with RATE_LIMIT_STORE (a3d7737)
• cli: Build scaffold rate limiters from RATE_LIMIT_STORE (9ee7034)
• app: Prune expired database cache entries hourly (a1f9c0d)
• app: Find the cache pruner through wrapped stores (8c1bd87)
• site: Add last-updated dates and a pt-BR locale (e06cde3)

Changed

• cache: Increment database counters in one statement (7a4814e)
• site: Remove the docs version switcher (9ebc88d)

Fixed

• webhook: Harden outgoing deliveries after review (91fd77b)
• postgres: Make pgtest cleanup robust to reconnecting pools (1493ae4)
• vukem: Send key:generate diagnostics to stderr (7ceadeb)
• imaging: Apply review findings to thumbnails (2e33e83)
• cache: Make database Increment atomic across connections (96eff2c)
• ratelimit: Hash every window key and validate limiter names (162b6fc)
• app: Refuse RATE_LIMIT_STORE=cache over the memory cache (e977575)

Security

• webhook: Document outgoing webhooks and their security guarantees (eb9127b)
• app: Check unknown RATE_LIMIT_STORE values as a security default (6e05120)
• ratelimit: Document shared rate limits and RATE_LIMIT_STORE (2a790ca)

0.22.0 - 2026-10-17

Added

• auth: Add owner-scoped Tokens.RevokeFor and Tokens.List (08e001d)
• webhook: Add Standard Webhooks verifier and event dedupe (bc69938)
• inertia: Share locale and translations with I18n middleware (9813474)
• upload: Cap image dimensions to stop decompression bombs (d1bb6b8)
• auth: Redirect unverified browsers to the verification notice (230c19c)
• cli: Detect the JavaScript package manager from the lockfile (317867f)
• cli: Tailwind-only Inertia starters with class-based dark mode (d7f908d)

Fixed

• queue: Settle database jobs only while holding the reservation (d9655c2)
• cache: Store database cache values as BYTEA on Postgres (64c3d20)
• session: Do not create a session for read-only visits (e08a266)
• vukemtest: Send the app's asset version from Inertia("") (b0c348d)
• vukemtest: Keep GetJSON's Accept header to that request (54b6716)
• cli: Use a real PNG header in the starter upload test (50994e0)
• cli: Embed starter resources when APP_ENV=production (c5c6d54)
• cli: Render the 2FA QR code as an image, not raw HTML (61b3696)

Security

• api: Refuse idempotency keys with an empty caller scope (9963ad9)
• session: Prune expired database sessions hourly (043c3a4)
• vukemtest: Add AssertHeaderContains and AssertHeaderMissing (fa713e9)

0.21.1 - 2026-10-17

Added

• logging: Aggregate repeated identical errors (023820b)
• otel: Add trace and span ids to log records (48a79fd)

Fixed

• crypt: Bound integer arithmetic flagged by CodeQL (db3662c)

Security

• cli: Pin govulncheck as a go tool in new apps (a56c203)

0.21.0 - 2026-10-17

Added

• site: Version the docs per minor with a header switcher (77ffd25)
• examples: Add the JSON API example with typed task routes (b40242e)
• examples: Add the SaaS example with Inertia, auth and billing (27129b8)

Changed

• BREAKING: dbtest: Unexport the conformance fixture models (0e2650a)

Deprecated

• orm: Rename create hook interfaces to BeforeCreator and AfterCreator (acdab3e)
• mail: Rename WithAttachments to Attachable (3fb8926)

Fixed

• web: Reject same-host redirects to scheme-relative paths (56dd98e)
• graphql: Bound introspection selections (f04dd80)
• graphql: Mask 4xx errors that wrap a cause (c3aa7e4)
• web: Read every X-Forwarded-For line in Ctx.IP (8188ae4)
• middleware: Parse the media type before treating a body as JSON (c5cb0d6)
• httpclient: Block IPv6 ranges that embed IPv4 addresses (4254b55)
• grpc: Hide the text of server-fault connect errors (30e98a9)
• BREAKING: app: Refuse to boot with an unknown APP_ENV (4824717)
• BREAKING: ratelimit: Key by client IP unless a verified token is available (994276b)
• cli: Require the second factor for generated API tokens (c34e04e)
• cli: Normalize login throttle keys and revoke tokens on reset (1ef3674)
• upload: Verify only keys that Presign could have issued (31f6178)
• upload: Strip format characters from sanitized file names (5077f1c)
• upload: Count nameless multipart parts toward the limits (5897d11)
• middleware: Handle an empty path in the maintenance bypass check (95a19ba)
• mail: Reject attachment content types with line breaks (6396868)
• auth: Consume remember-me tokens atomically (9afea58)

Security

• web: Add package overviews and examples for the http core (f2d6475)
• repo: Publish the 1.x stability policy, release cadence and upgrade guides (e317f16)
• repo: Rename the agent security rules to secure-coding.md (3d4003b)
• BREAKING: hash: Replace DefaultArgon2 var with DefaultArgon2Params (0405c29)
• repo: Add fuzz targets for untrusted-input parsers (231f5e9)
• web: Check the cleaned redirect path in SafeRedirect (bdf0fbe)
• storage: Hide dot directories and sandbox served files (88da87a)
• repo: Name the test or mechanism behind every security default (e31231c)
• security: Record the B.5.2 security review (8ebefd8)

0.20.1 - 2026-10-17

Changed

• web: Allocate the response writer inside Ctx and add WriteString (aa08aba)
• orm: Reuse scan buffers across rows and presize limited Get (b1b628b)

Fixed

• release: Ignore driver and contrib tags when finding the previous release (c71f5fe)

Security

• docs: Document release signing, sboms and verification (8b8c995)

0.20.0 - 2026-10-17

Added

• graphql: Add the contrib/graphql module with lexer and parser (fc7fa9d)
• graphql: Add schemas, validation, execution and introspection (85a1b9a)
• graphql: Add the batching loader with ORM helpers (68a6a36)
• cli: Add install:billing for Stripe subscriptions (a6295fd)
• graphql: Add subscriptions over graphql-ws and SSE (fbf13ae)
• app: Serve http/2 cleartext outside production (5724c54)
• grpc: Add the contrib/grpc module on connect-go (3bfc1d2)
• cli: Add make:proto and codegen:rpc (30147cb)
• admin: Add the admin panel package (28a8c8c)
• cli: Add install:admin and make:admin-resource (ba460a5)

Changed

• BREAKING: grpc: Name the production reflection opt-out insecure (724a841)

Fixed

• session: Flush through writers that only implement Unwrap (bfae772)

Security

• graphql: Serve GraphQL over HTTP with persisted queries (08527d5)
• graphql: Document the contrib/graphql module (e966941)

0.19.0 - 2026-10-16

Added

• social: Add Apple, LinkedIn and X sign-in (79df84d)
• stripe: Add the Stripe API client and webhook module (fc3b71b)
• s3: Add the S3 storage driver module (4f8294a)
• database: Add the mysql dialect and a url-to-dsn driver hook (6ac1996)
• schema: Generate mysql ddl and drop tables on mysql (a543b86)
• orm: Support the mysql dialect in inserts and queries (87c0e0a)
• queue: Run the database queue on mysql (2a1f0ff)
• cache: Run the database cache store on mysql (7729bf4)
• session: Add a mysql option to the sql session store (9519aee)
• boost: Read the database schema on mysql (3c431da)
• mysql: Add the drivers/mysql module for mysql 8 and mariadb 11 (6fd67f0)
• openapi: Generate typed TypeScript and Go API clients (7c36729)
• cli: Add the codegen:client app command (d7e4ad4)
• web: Add context session helpers and Partial for components (2b600b5)
• vite: Carry the Vite instance in the request context (2dd3849)
• cli: Add the templ starter (be88bcd)
• database: Add a query observer hook (9d47072)
• queue: Add a job observer hook (3caf7c2)
• events: Add a dispatch observer hook (8a4952a)
• devtools: Add the /_vukem development dashboard (ea5bb39)
• broadcast: Add channel broadcasting with an SSE transport (c9d297f)
• websocket: Serve the broadcast protocol over WebSockets (e3319f1)
• web: Let a route body limit replace the router default (3b7b0c0)
• BREAKING: middleware: Read _method from the query for multipart forms (2aee55f)
• z: Add z.File for uploaded files (eee6e80)
• cli: Add an upload demo with progress to the HTMX starter (9f7966d)
• cli: Add install:auth --2fa for TOTP two-factor authentication (443cbfa)

Fixed

• cli: Drop the html/template upload demo from the templ starter (cd40371)

Security

• websocket: Add the WebSocket driver module (02b4f59)
• upload: Add streaming, resumable and direct uploads (c201582)

0.18.0 - 2026-10-16

Added

• vite: Add the vite package and view tag functions (a118c48)
• inertia: Add the Inertia v3 core adapter (b7eb1cd)
• cli: Add Vukem Boost for coding agents (979619a)
• inertia: Add prop types and partial reload filtering (bc79c40)
• inertia: Add history encryption, flash, prefetch and precognition (bfde089)
• inertia: Add the SSR client with client-side fallback (0b1de61)
• cli: Ship Vite and Tailwind v4 in the HTMX starter and prompt for the stack (810e832)
• vukemtest: Add WithInertia and Inertia assertions (c850fdb)
• cli: Add codegen:routes for typed frontend routes (28ed3b5)
• cli: Add the Inertia React starter and install:inertia (9e671dc)
• cli: Add Inertia auth pages to install:auth (907a4cc)
• web: Add a youch-style debug error page (a6499ea)
• sse: Add server-sent event streams and a topic hub (441b456)
• cli: Add maintenance mode with vukem down and up (684a942)
• auth: Add the JWT guard with JWKS rotation and refresh tokens (55fdb77)
• crypt: Add encryption with key rotation and encrypted cookies (2ce4c00)
• orm: Add the Encrypted column type (2f1d6df)
• z: Record message keys and localize issues (8b2a353)
• web: Localize validation issues from the request context (334454d)
• i18n: Add JSON catalogs, plurals and locale resolution (b85a9ad)
• view: Add the t and locale template functions (5818c2e)
• i18n: Wire translations into the app (b9a736e)
• cli: Add the Inertia Vue starter (f35e398)
• auth: Add the TOTP package with a stdlib QR encoder (a117db6)
• cli: Add the Inertia Svelte starter (051cfbe)

Fixed

• site: Align the docs TOC with the header and drop the pre-1.0 callouts (d3d0332)

Security

• otel: Add the OpenTelemetry driver module (ea81f06)

0.17.0 - 2026-10-16

Added

• site: Add the Vukem icon, align the header and open on the docs (0eb9623)
• redis: Add the Redis driver module (8691588)
• mongo: Add the MongoDB driver module (7a4d0f3)

Security

• repo: Rewrite the README after the Laravel layout (90360c0)

0.16.0 - 2026-10-16

Added

• queue: Add typed jobs, workers and the sync and memory drivers (405c978)
• queue: Add the database driver, DispatchTx and failed-job commands (91be143)
• queue: Add make:job, queue.Fake, queued mail and queued listeners (305e9ca)
• schedule: Add the scheduler with cron expressions and overlap locks (e42e3d8)

0.15.0 - 2026-10-16

Added

• api: Add typed handlers with api.Register (36b8638)
• openapi: Generate OpenAPI 3.1 documents from the router (7334aa8)
• vukemtest: Assert responses match the OpenAPI document (186c1e0)
• openapi: Export JSON Schema and generate TypeScript and Zod types (e9b2c71)
• api: Add the Idempotency-Key middleware (f11fdd9)
• apidocs: Serve a Scalar API reference for the OpenAPI document (e94f6fa)

0.14.0 - 2026-10-16

Added

• examples: Add the blog example and auth.Optional (5e13d26)

Security

• site: Document every alpha feature (a1e5d62)

0.13.0 - 2026-10-16

Security

• security: Add SSRF-safe client, webhook signatures and security events (393b165)

0.12.0 - 2026-10-16

Added

• logging: Add the Telegram slog handler (8fc0ad3)

0.11.0 - 2026-10-16

Added

• subsystems: Add cache, file storage and typed events (b0dceeb)

0.10.0 - 2026-10-16

Added

• cli: Add the JSON API starter and install:api (253f10f)

0.9.0 - 2026-10-16

Added

• cli: Add install:auth --social with account linking (120ea0f)

0.8.0 - 2026-10-16

Added

• cli: Add install:auth with registration, verification and password resets (e68047e)

0.7.0 - 2026-10-16

Added

• mail: Add mailables with SMTP, Resend, log and array transports (052df72)

0.6.0 - 2026-10-16

Added

• authz: Add gates and policies with fail-closed authorization (a84543d)

0.5.0 - 2026-10-16

Added

• auth: Add hashers, session and token guards, and auth middleware (4a5a95f)
• social: Add OAuth2/OIDC social login with PKCE (d60638f)

0.4.0 - 2026-10-16

Added

• orm: Add relations, factories, seeders and database rules (0ca2389)

0.3.0 - 2026-10-16

Added

• postgres: Add the PostgreSQL driver module and conformance suite (8283d33)

Changed

• BREAKING: Rename the framework to Vukem (f7e19e0)

0.2.0 - 2026-10-16

Added

• api: Add REST toolkit with pagination, query conventions and rate limiting (6e779bd)

0.1.1 - 2026-10-16

Added

• cli: Answer JSON from the starter's post controller (fc2cf50)

0.1.0 - 2026-10-16

Changed

• Maintenance release (no user-facing changes).

0.0.12 - 2026-10-16

Added

• BREAKING: cli: Add vukem new with the HTMX + SQLite starter (92d44b2)

0.0.11 - 2026-10-16

Added

• cli: Add the vukem command with generators, serve, build and delegation (0abc848)

0.0.10 - 2026-10-16

Added

• vukemtest: Add testing toolkit with fluent client and DB assertions (c3a9400)

0.0.9 - 2026-10-16

Added

• view: Add html/template views, htmx 4 helpers and fragments (e45d36e)

0.0.8 - 2026-10-16

Added

• orm: Add database connections, generic query builder and migrations (2d17f79)

0.0.7 - 2026-10-16

Added

• session: Add sessions, flash, old input and csrf protection (a62538f)

0.0.6 - 2026-10-16

Added

• z: Add zod-style typed schemas and web parsing (23b1438)
• site: Add documentation site with Next.js 16, Tailwind v4 and Base UI (aaa45f6)

Fixed

• deps: Require go1.27.2 toolchain for standard library security fixes (bcab5a8)

0.0.5 - 2026-10-16

Added

• middleware: Add built-in middleware, app HTTP wiring and commands (2af9fd4)

0.0.4 - 2026-10-16

Added

• router: Add ServeMux router, web.Ctx, errs and problem details (9ba13bd)

0.0.3 - 2026-10-16

Added

• app: Add App, provider lifecycle, runners and HTTP server (255eee4)

0.0.2 - 2026-10-16

Added

• config: Add .env parser, typed struct loading, secrets and app key (736332a)

0.0.1 - 2026-10-16

Project foundation. No framework code yet; see PLAN.md for the roadmap.

Added

• Research on Laravel 13, AdonisJS v7, Goravel, the Go ecosystem, Inertia v3 and htmx 4 (docs/golang-web-search.md).
• Design decision log (docs/brainstorming.md) and design docs: architecture, configuration, HTTP, REST APIs, security (OWASP Top 10:2025), databases, authentication, frontend, CLI, subsystems, testing and tooling.
• Phased plan (PLAN.md): Prototype, ALPHA, BETA and 1.0 Stable, with verifiable tasks and exit criteria.
• Conventional Commits validator (internal/tools/commitlint) used by the commit-msg hook.
• Tooling: golangci-lint v2 (gofumpt, gci, golines, depguard), markdownlint-cli2, lefthook hooks, Taskfile, git-cliff, .editorconfig and .gitattributes.
• GitHub workflows (CI, PR title, CodeQL), Dependabot, issue forms and PR template.
• README, MIT license, CONTRIBUTING, SECURITY and CODE_OF_CONDUCT.
• Agent configuration: AGENTS.md, CLAUDE.md, path-scoped .claude/rules/, Go skills and project settings.