Changelog

Added

• Local Upstash Redis Proxy: Added hiett/serverless-redis-http paired with redis:7-alpine in docker-compose.yml to emulate the Upstash REST API locally on port 8079. @upstash/ratelimit now works out-of-the-box without cloud credentials.
• Local MinIO S3 Storage: Added minio/minio to docker-compose.yml with S3 API on port 9000 and Web Console on port 9001, enabling full local file uploads with zero AWS/Cloudflare keys.
• Email Console Fallback: In development mode, transactional auth emails (verification links, password resets) are captured and printed directly to the terminal when no Resend token is provided, preventing signup crashes.
• Conditional Google OAuth: Better Auth now registers Google OAuth conditionally when GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are present. Local development with Email/Password works immediately without Google Cloud Console setup.

Changed

• Node.js 24 Upgrade: Upgraded minimum Node.js requirement to v24+ across the monorepo, starter templates, Dockerfiles (node:24-alpine), and documentation.
• Environment Defaults: Updated starter template .env.example files to point directly to local Docker services by default.

Fixed

• CLI Project Name Replacement: Added packages/rate-limit/.env.example to the project name replacement list so local Redis tokens match between docker-compose.yml and environment configs on newly scaffolded projects.

Added

• Build Elevate migration: Added stackbase migrate to convert .build-elevate.json into .stackbase.json, update unchanged files, and retain local edits as conflicts
• Legacy compatibility: Maps the fullstack template to base, detects missing feature flags, and reads legacy template files from their original repository paths
• Migration guide: Added a step-by-step guide covering dry runs, conflict resolution, verification, backup cleanup, and rollback

Changed

• Manifest tracking: Keeps the legacy source and commit until migration conflicts are resolved, then continues with the standard Stackbase upgrade flow
• Manifest backup: Saves the original manifest as .build-elevate.json.bak after a successful migration

Fixed

• Upgrade safety: Treats new template files that collide with existing local files as conflicts instead of overwriting them

Added

• Standalone Architecture Templates: Dedicated, self-contained templates (base, web, api) replacing monolithic repository pruning for cleaner scaffolds, faster dependency resolution, and predictable project boundaries
• First-Class Bun Support: Full runtime, dependency management, and script execution support for Bun (-p bun) across all templates with 100% test, build, lint, and type check parity
• Non-Interactive Scaffolding Flags: Full suite of command-line flags for zero-prompt automation:
  • --docker / --no-docker: Control Docker container setup and Compose files
  • --k8s, --kubernetes / --no-k8s, --no-kubernetes: Toggle Kubernetes deployment manifests and Ingress
  • --observability (--obs) / --no-observability (--no-obs): Toggle Prometheus & Grafana monitoring stack
  • --studio / --no-studio: Toggle Prisma Studio database browser
• High-Speed Template Delivery: Archive-based tarball downloads via degit replacing full Git clones, retaining commit SHA metadata in .stackbase.json for seamless future upgrades
• Automated Matrix Runner: Permutation and combination verification runner validating 5-stage quality gates (check-types, lint, format:check, test, build) across package managers and templates

Changed

• Templates: Pinned Prettier configuration across all templates to eliminate cross-package-manager AST differences
• ESLint Config: Disabled conflicting react-hooks/set-state-in-effect rule from eslint-plugin-react-hooks@7 across Next.js and React internal configs
• TypeScript: Resolved composite project references across apps/web to ensure clean initial type compilation without prior artifact requirements

Fixed

• Formatting: Resolved long-line attribute wrapping for external links in page.tsx during project name substitution
• Upgrade Tracking: Corrected template hash baselines in .stackbase.json to prevent false conflict warnings on clean scaffolds

Fixed

• CLI: Point template cloning, diffs, upgrades, and latest commit lookups to stackbase-labs/stackbase#legacy
• Catalog: Moved pino, pino-http, and pino-pretty to the core catalog so @workspace/logger resolves dependencies cleanly in web-only templates where the server catalog is removed
• Format: Added @workspace/prettier-config to api, db, and ui devDependencies to resolve Prettier configuration resolution in isolated workspaces
• Package: Updated repository, homepage, and bugs metadata in package.json to the new organization

Added

• Prometheus-compatible /metrics endpoint exposing HTTP request counts, request duration histograms, in-flight request gauges, and Node.js runtime metrics
• RED metrics middleware that records request rate, errors, and duration while excluding scraper and probe traffic from application metrics
• Local Prometheus and Grafana compose stack with a provisioned Prometheus data source and API overview dashboard
• Scaffold script updates that keep observability assets, Docker scripts, project-name replacement, and generated README output aligned with selected template options
• Prometheus scrape annotations on API pods for clusters with Prometheus-compatible service discovery
• Observability guide covering local startup, Prometheus targets, Grafana dashboard provisioning, metric names, Kubernetes notes, and troubleshooting

Added

• New @workspace/storage package providing vendor-agnostic S3-compatible cloud storage (AWS S3, Cloudflare R2, MinIO, Supabase Storage) with direct client presigned PUT/GET URLs, object deletion, and collision-safe key generation
• Storage schemas and MIME/size limits (getPresignedUploadUrlSchema, deleteStorageFileSchema) in @workspace/contracts
• Authenticated /api/storage/presigned-upload and /api/storage/file endpoints with user-scoped access control
• Reusable <FileUploader /> dropzone component in @workspace/ui with drag-and-drop, progress bar, and file validation
• Interactive avatar upload and removal in General Settings (apps/web/components/profile/avatar-uploader.tsx) syncing directly with Better Auth
• Interactive 4-step DX lifecycle simulation and interactive TypeFlow architecture trace with syntax-highlighted IDE view
• Complete storage guide at apps/docs/content/docs/packages/storage.mdx covering S3/R2/MinIO setup and CORS configuration
• Updated CLI scaffolding, Turbo lint envs, and project readme generation to include storage environment variables and packages

Added

• Interactive prompts for Docker Hub username and production domain name when scaffolding Kubernetes manifests

Changed

• Configured dynamic replacements for the domain in Ingress manifests and uncommented TLS cert-manager configurations

Fixed

• Updated environment templates to properly retain LOG_LEVEL and POD_NAME across scaffolding options

Fixed

• upgrade no longer re-adds files for optional features (Docker, Kubernetes, Prisma Studio) that were declined at scaffold time — the manifest now records the chosen features (new version and features fields) and upgrade skips files for any opted-out feature; projects scaffolded before this change have their features inferred from disk and the manifest is self-healed on the next upgrade
• Scaffolding now removes the repo-only CONTRIBUTING.md and SECURITY.md guides instead of shipping them into generated projects, and upgrade sources its skip list from the canonical internal-files list so the two can no longer drift

Added

• upgrade --force advances the manifest to the latest commit while keeping your local edits — for each conflicting file it records the template's latest hash as the new base (the template content is never written to disk) so the conflict clears, your file is left untouched, and it only re-flags if the template changes that same file in a future release

Added

• New @workspace/logger package wrapping pino with env-based log level (LOG_LEVEL), sensitive-key redaction, and pino-pretty for local development — adopted across the API with pino-http per-request logging (health-check routes skipped, child logger on req.log) replacing morgan and ad-hoc console calls
• Rebuilt changelog page with color-coded entries grouped by change type, a /changelog/rss.xml feed, a reusable CopyButton and NPM brand icon, and Documentation/Changelog/NPM links in the shared nav
• .markdownlint.yaml config for linting Markdown content

Changed

• Converted the profile, dashboard, and settings (general/security/activity) pages to React Server Components that fetch the session server-side and pass data into client children — eliminating skeleton flash, useEffect form resets, and the activity data waterfall; added route-level loading/error boundaries and a shared requireUser() server guard
• Trust the first proxy hop in production so the real client IP is resolved for request logs

Removed

• Dropped the now-unused /api/sessions route; sessions are fetched server-side via auth.api.listSessions

Added

• Kubernetes deployment manifests for the API and web apps — Namespace, ConfigMap, Deployments, ClusterIP Services, nginx Ingress with /api/v1/* rewrite, and HPAs (2–10 replicas)
• deploy.sh to build/push images and apply all manifests, plus a CI-friendly k8s/verify.sh that health-checks pods, endpoints, in-cluster HTTP, ingress, and HPA metrics — exposed as k8s:deploy and k8s:verify pnpm scripts
• /readyz and /healthz probe endpoints on the API server for Kubernetes liveness and readiness checks
• Opt-in Kubernetes prompt during scaffolding (Docker-gated, defaults to No) with per-template manifest pruning and full upgrader integration
• Kubernetes deployment guide added to the documentation site

Changed

• Bake API_INTERNAL_URL into the web Docker image at build time so server-side rendering can reach the API in-cluster
• Upgraded the GitHub Actions workflow — actions/checkout, setup-node, and pnpm/action-setup to v6, Node.js 20 → 24, pnpm 10 → 11.1.1, and switched to the native setup-node pnpm cache

Fixed

• Stripped unnecessary quotes from DATABASE_URL values in .env.example files

Performance

• Added Turborepo cache restoration to the lint, type-check, test, and build CI jobs for faster pipeline runs

Changed

• Migrated the API app from Jest to Vitest and aligned test scripts, config, and setup with the shared workspace preset
• Updated docs, package metadata, and workspace configuration to remove Jest references and reflect the Vitest-based test setup

Removed

• Removed Jest dependencies, presets, and config files now that the workspace test suite runs on Vitest

Changed

• Introduced @workspace/contracts for shared Zod schemas and moved auth validation out of @workspace/utils
• Updated web auth and security flows to import schemas from @workspace/contracts
• Refreshed workspace package configs, dependencies, and lockfile entries.
• Updated docs content for the utils and contracts packages to describe the new split

Added

• Added reusable empty state components and refreshed the web shell experience
• Introduced API rewrite support with a shared web API client

Changed

• Simplified URL schemas across auth, database, and rate limit packages
• Updated the docs collections alias and related configuration to match the current content layout
• Added a dev Docker script, updated CI environment wiring, and refreshed package metadata for the workspace

Fixed

• Added Node types to the rate-limit tsconfig so type checking works consistently

Fixed

• Included docker-compose.yml in project name replacement files so scaffolded project names update everywhere

Fixed

• Updated manifest skip directory from generated/prisma to packages/db/generated to correctly exclude generated Prisma client files

Changed

• Extracted template transformation logic into separate, composable modules for better code organization
• Refactored scaffold initialization, readme generation, and upgrade workflows to use composed transformations
• Added lint:fix script and turbo task for automated code style corrections across the monorepo

Added

• Introduced the upgrade command to automatically update files that remain unchanged since scaffolding, while marking modified files as conflicts for manual review.
• Added a diff command that shows a colored, line-by-line comparison between your scaffolded version of a file and the latest template version.
• Created a .build-elevate.json manifest during initialization to store the scaffolded commit SHA, template name, project metadata, and per-file hashes used during upgrades.
• Template-aware upgrade filtering ensures projects only receive updates for files that were included during scaffolding (e.g., web projects will not receive api-specific files).

Fixed

• Upgrade now applies initialization-time transformations before comparing template files, preventing false conflicts in files like package.json, turbo.json, and pnpm-workspace.yaml.
• Normalized line endings (CRLF → LF) before hashing to prevent false conflicts on Windows environments.

Added

• Reusable, composable form field components added to the shared UI package

Changed

• Split the unified CredentialsForm into separate SignInForm and SignUpForm components for a cleaner auth UI
• Updated shadcn/ui components to use unified @radix-ui primitives
• Upgraded Zod to v4 for improved schema validation performance and API

Fixed

• Fixed missing environment variables in the CI build job

Security

• Shared a single auth secret across all environment files to prevent secret drift

Security

• Shared a single auth secret across all environment files to prevent secret drift

Changed

• Accept whitespace format of app name, and trim it for use in env vars and display (e.g. 'My App' becomes MY_APP in env vars and 'My App' in display)

Changed

• Load package env vars in development

Fixed

• Fixed a lint error present in newly scaffolded apps
• Resolved package resolution errors for pg and prettier in monorepo installs
• Added metadataBase to site config to remove the warn log

Added

• Fumadocs-powered documentation site with full structured MDX content
• Package manager detection with adaptive CLI options during project scaffolding

Changed

• Add a script to create structured documentation content on the scaffolded apps by template

Fixed

• Fixed formatting check failures during scaffolding

Added

• Added support for multiple package managers (npm, pnpm, bun) in Scaffolding CLI
• Format check on scaffolding to ensure new projects adhere to code style standards
• Turbo environment variable setup script
• generatePageMetadata utility for per-page SEO metadata generation

Changed

• Improved project initialization flow and CLI prompts for a better developer experience
• Update script to include environment variables required by each template for turbo tasks
• Update eslint-config for nextjs web app to extend from the root config for better consistency

Removed

• Removed auth/client.ts in api only scaffolded projects since it is only needed for the web app

Changed

• Update scripts to update pnpm catalog, docker-compose file on scaffolding new projects
• Optimized Docker Compose configuration for production environments
• Ignore .md changes in GitHub workflows to prevent unnecessary CI runs on documentation updates
• Use explicit paths filter to trigger the github workflows
• Updated Documentation and Getting Started guide on README.md
• Moved better-auth from the web app to the core workspace package for better reuse
• Moved shared dependencies to the core catalog to reduce duplication across packages

Fixed

• Fixed Prisma Studio app script after a Prisma version bump

Added

• Scaffolding scripts to bootstrap new projects from the monorepo template

Changed

• Make env placeholder values more descriptive
• Made Environment variable management more consistent across all packages

Added

• Turborepo monorepo with apps/ and packages/ structure
• Next.js web app with App Router, Tailwind CSS, and shadcn/ui
• Express API server with TypeScript, structured routing, and a 404 catch-all
• Shared packages: ui, utils, auth, db, email, eslint-config, typescript-config
• Docker Compose setup for local development and production deployments
• GitHub Actions CI with lint, type-check, and test jobs
• Jest testing setup with shared workspace presets
• Better-Auth with email/password sign-in and sign-up flows
• Dedicated @workspace/auth package with centralized auth logic and TypeScript support
• Authentication middleware for the Express API with protected route support
• Rate limiting for API calls and verification email requests with configurable strategies
• Email verification on sign-up
• Two-factor authentication (2FA) with TOTP support, including setup flow for OAuth users
• Forgot/reset password flow with secure token-based email links
• Email change flow with a verification step
• Social login connect/disconnect cards in account settings
• Session activity UI and API — view and manage active sessions across devices
• Revoke all sessions from the security settings page
• User profile, account settings, and security settings pages
• Account deletion with a post-deletion goodbye page
• Light/dark/system theme switcher
• React Email + Resend email package with in-app preview
• Refreshed email templates with a modern design
• Responsive layout across auth and settings pages
• Prisma ORM with PostgreSQL support and auto-generated client
• Prisma Studio as a standalone app in the monorepo
• Environment validation using @t3-oss/env for fail-fast startup errors
• Husky git hooks for pre-commit linting and formatting enforcement

Fixed

• Fixed hydration error on authentication pages

Security

• Prevented client-side access to server-only environment variables