I Shipped...

I capped nested AuthorizationScopeView decoding at eight wrappers and reject deeper peer messages during deserialisation. The existing wire format and exact boundary remain supported.

I charged descriptor-only upload starts against the existing work budget and capped restart-persistent pending upload metadata at 1,024 records. This stops small requests from creating unlimited durable metadata while existing uploads can still resume.

I added an 8 MiB budget for frames waiting in the native WebSocket queue. Producers now get a backpressure error when the budget is full, and space is released only after queued frames are dropped.

I capped auxiliary immutable-chunk requests at four entries per decoded message and rejected oversized sequences before storage work. Local one-request frames and the exact limit remain supported.

I attached each persistence receipt to the database that created it. Foreign receipts are now rejected before they can change metrics, publication state, or the durable frontier.

I required a message sender profile to belong to the authenticated session. This stops a writer from attributing a message to somebody else's profile while leaving reads and existing reaction protections unchanged.

I stopped live indexes being registered while applied writes are still resident. Registration can continue once those writes are durable and the index can backfill from complete storage.

I made each todo REST and event-stream request use a database tied to its authenticated session. Ownership now comes from that session rather than request input, so routes use the normal permission checks.

I made the HTTP WebSocket layer use the same 2 MiB limit as the wire decoder. Valid fragmented messages up to that size can now reach the decoder instead of being rejected early, with a regression test for a 1.5 MiB message.

I added deny rules for every generated Better Auth table, including names that do not work as JavaScript identifiers. This keeps ordinary clients from reading or changing authentication records while the backend adapter can still use them.

I brought the guides, examples, and search index back into line with the current public APIs. I also added a reference guide for the new core and explained transactions, durability, and errors around the unified mutation results.

I replaced several different write-result shapes with one consistent database mutation result. Inserts and restores still return their rows, while updates, upserts, and deletes clearly return no row, and each result keeps its value, batch ID, and wait operation.

I stabilised browser tests that use a file worker by limiting how many browser files run at once and allowing slow operations more time before failing. This stops the browser's main work from being starved by too much parallel file activity, while still warning when responsiveness falls below the target.

I separated the Vue provider that creates and shuts down a database client from the provider used with a client supplied by the caller. This makes it clear who owns the client's lifetime, keeps rapid configuration changes in order, and updates the examples and documentation.

I separated the Svelte provider that creates and shuts down a database client from the provider used with a client supplied by the caller. This makes it clear who owns the client's lifetime and updates the examples and documentation to use the right provider.

I separated the Solid provider that creates and shuts down a database client from the provider used with a client supplied by the caller. This makes it clear who owns the client's lifetime and lets later configuration recover after a shutdown failure.

I fixed a development-startup race where a generated app ID was not saved before Vite's server and file watcher began. The app ID is now saved during configuration, and the same preparation is used by direct runtime and SvelteKit startup.

I fixed a stale-data bug in shared server query results. When a user's permissions changed, a new subscription could claim it already had the current rows and keep seeing old or unauthorised data. The server now sends the full current result when the permission state is out of date, while unchanged reconnects keep the smaller update.

I fixed a race in the hybrid starter tests where account recovery could begin before the optimistic write it was meant to restore had been saved. The tests now wait for the saved status first, so they check the real recovery sequence instead of competing with it.

I added support for WorkOS identity IDs in server authentication, while keeping the existing UUID-based IDs working. The TypeScript and Rust sides now apply the same rules, so permissions and identity checks agree across the system.