Changelog
The full changelog is in the repository root file:
CHANGELOG.md — repository root
Latest Versions
[0.56.0] — 2026-07-06
Multi-role user support (Issue #357) — users can hold multiple roles simultaneously. user_roles join table with migration. AuthPrincipal.roles[] + primaryRole. JWT with roles[] array. requireRole() uses roles.some().
RBAC simplified — VOLUNTEER removed. VOLUNTARIO_KIDS renamed to VOLUNTARIO (#362).
[0.55.0] — 2026-07-05
CSP: dynamic nonces via Pages Middleware with HTMLRewriter. CSP without 'unsafe-inline' in script-src.
Fix: ThemeProvider crash (missing .Provider). React 18/19 version conflict resolved.
[0.54.0] — 2026-07-05
EntityRepository pattern (I5-I9, ADR-0021) — EntityRepository<T> with D1EntityRepo + MemoryEntityRepo. 3 services migrated: classService, userService, roleService. Inline queries extracted to service modules. RBAC scope integrated.
IJCP themes — 3 phases: Nunito font + logo (P1), theme gallery in Settings (P2), /themes interactive landing page (P3).
OnlineProxy — getStore() returns OnlineProxy when backend is available. Proxy endpoint on Worker. Hot-swap on offline transition.
Test coverage: 62 frontend tests (7 modules). OnboardingPage with 15 tests (I4).
MUI removed — @mui/material, @mui/icons-material, @emotion/* removed. as any eliminated from production code (22 instances).
[0.53.0] — 2026-07-01
PBKDF2 — password hashing with 600k iterations. timingSafeEqual for constant-time comparison. Login lockout with exponential backoff (5s→30s) + hard lockout after 10 failures.
OnlineProxy adapter — StorageBackend delegating to SQLiteStore via API.
Rate limiting — fail-closed on D1 errors. Event routes rate-limited (5/min register, 3/min proof).
[0.52.0] — 2026-06-29
CSP hash-based (#324) — nonces replaced with SHA-256 hashes. Removed unsafe-eval (SQLite WASM 3.53.0 doesn't need it).
Fix: Blank page on / (OPFS schema init). Login redirect in production. ThemeToggle freeze (110% CPU). ChartContext + TVOverlay stale closures.
Security: CSPRNG for nonces (16 bytes). Theme validation on backend.
[0.51.0] — 2026-06-27
Design System: MUI 7 removed (~400KB). ThemeProvider + dark mode toggle active. Self-hosted Inter + JetBrains Mono fonts.
Storage: SWM complete — Dexie, DexieAdapter, repositories, transactionalWriter removed. SQLite WASM sole storage backend. test-helpers.ts unified mock system.
Docs: ADR-0017 (Dexie→SQLite migration), ADR-0018 (Design System). STACK.md updated. 3 ADRs superseded.
Tests: 429 pass, 0 fail. 2 skipped test files reactivated. fake-indexeddb removed. Coverage baseline created.
[0.20.0] — 2026-06-10
Architecture: AuthContext de-monolithized (642 → 213 lines). 4 modules extracted with tests. Constants consolidated in config.ts. StudentsPage and ImportExportPage de-monolithized.
Fix: wrangler.toml moved to workers/ (Wrangler 4.x compatibility).
Tests: 6 new tests. Total: 172 tests (117 app + 36 workers + 16 schemas + 9 backend).