What's new with TinaCloud

feat(identity): Self heal verified flag work os

docs: mark the account-activity signals as load-bearing

ci: scan Go only when identity changes and cancel superseded PR builds

fix(ci): wait for npm to serve a new tinacms version before the auto-bump installs it

docs: name the deployed e2e fixture and correct the zstd note

fix: alarm on spikes in failed content changes, not the content DLQ's standing depth

fix: target login-screen announcements by the TinaCMS version a project declares, not its @tinacms/graphql version

fix(auth): preserve editor context when retrying login

fix(assets-api): stage git-push deletes when the media branch is missing

feat(identity): send TinaCloud's own password reset email from the WorkOS webhook

chore(deps): upgrade final-form to 5 and react-final-form to 7 in the dashboard

feat(dashboard): full-width Create Project chooser buttons on phones

feat(identity): Unify TinaCloud WorkOS email policy

chore(deps): hold Amplify on 5 and abstract-level on 1 in Dependabot

fix: gate bulk announcement sends on a rolling SES reputation window

feat(dashboard): explain why account deletion is paused instead of hiding it

fix(deps): pin brace-expansion's 2.x and 5.x copies to their patched releases

feat(auth): Revoke all other WorkOS sessions

feat(dashboard): Add dashboard controls for signing out other sessions

feat(auth): Restore WorkOS auth analytics parity

fix(identity): cache the authorizer policy for 5 minutes and re-check access on fresh reads

chore(deps): take the October patch-and-minor group with the AWS types deduped

perf(content-api): write index batches to DynamoDB in parallel

chore(deps): bump brace-expansion from 1.1.18 to 1.1.21[bot]

chore(deps): bump fast-uri from 3.1.7 to 3.1.8[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 4 updates[bot]

chore(deps): bump markdown-it from 14.3.0 to 14.3.2[bot]

chore(deps): bump dompurify from 3.4.14 to 3.4.16[bot]

chore(deps): bump the patch-and-minor group in /identity with 2 updates[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 22 updates[bot]

chore(deps-dev): bump vite-plugin-svgr from 4.5.0 to 5.2.0[bot]

fix(dashboard): keep Update Payment Method reachable when no card resolves

feat(admin): find customer projects from the staff admin panel

feat(admin): add project and organisation pages to the staff panel

feat(admin): let staff grant a project extra contributor seats

feat(admin): show staff change history in the panel

feat(content-api): alarm when editorial workflow saves keep failing for one project

chore(deps): take the September patch-and-minor group except react-icons

feat: freeze new account deletion requests before WorkOS migration

feat: Heal unprovisioned WorkOS user on retry

test: add deployed TinaCMS client compatibility coverage

feat(dashboard): orange primary buttons, llama welcome hero, responsive Create Project chooser

📝 Remove "may" from the deploy popup warning

feat: add bulk-send email logic

fix(billing): resolve a project's live subscription when it holds more than one row

feat(ses-email-templates): tell announcement recipients what happens to their sign-in

feat: show announcements on the TinaCloud login screen

fix(deps): bump the stale axios copies onto patched releases

chore(identity): log authorizer and gateway errors in the Identity API access log

feat: alarm when the latest @tinacms/graphql has no alias in the deployed content API

chore(deps): bump the patch-and-minor group across 1 directory with 3 updates[bot]

chore(deps): bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 in the patch-and-minor group across 1 directory[bot]

chore(deps-dev): bump vite from 5.4.21 to 6.4.3 in /e2e/tinacms-compat[bot]

chore(deps): bump sonner from 1.7.4 to 2.0.8[bot]

chore(deps-dev): bump vite from 6.4.3 to 8.3.0 in /e2e/tinacms-compat[bot]

🐛 Surface the real indexing failure instead of "Please try again"

chore: upgrade serverless-http from 2.7.0 to 4.0.0 in content-api and assets-api

fix: stop editorial workflow saves crashing on a commit event with no email

chore(deps): bump the patch-and-minor group across 1 directory with 2 updates[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 6 updates[bot]

chore(deps): bump js-yaml from 3.15.1 to 3.15.2[bot]

chore(deps): bump fs-extra and @types/fs-extra[bot]

chore(deps-dev): bump jsdom from 21.1.2 to 30.0.1[bot]

Stop reporting a blocked GitHub call as missing push access

feat(identity): backfill owners on projects and orgs that have none

Administer the CMS announcement bar from a staff admin panel

feat: add MFA enrolment for AuthKit accounts

chore: upgrade koa to 3 with @koa/cors 5, koa-router 12 and @koa/bodyparser 6

chore: update TinaCMS dependencies[bot]

Development/2057 improve consistency of domain name overrides

fix(identity): require an org admin caller and refuse owner deletion when removing an org user

fix(content-api): validate GraphQL schema before indexing succeeds

💄 Shorten the co-authoring name and email fields

fix(content-api): recover failed index migrations

chore: update TinaCMS dependencies[bot]

fix: teach the Lambda wrapper that compressed bodies are binary

Hide account deletion for WorkOS users until it cascades

chore(assets-api): align aws-sdk-client-mock with the rest of the workspace

fix(dashboard): mark required fields and hold errors until blur

chore(dashboard): upgrade vite 4 to 6

feat(dashboard): capture churn feedback on cancel

test: add deployed-environment e2e coverage for the content editing flow

💄 Replace the chevron wizard steps with a rail on a card

fix(content-api): stop applying the generator pathToTina to content repo clones

chore(deps): bump qs from 6.15.3 to 6.16.0[bot]

chore(deps): bump browserslist from 4.24.4 to 4.28.8[bot]

chore(deps): bump github.com/go-chi/chi/v5 from 5.0.8 to 5.2.4 in /identity[bot]

chore(deps): bump postcss-selector-parser from 6.1.2 to 6.1.4[bot]

chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in /identity[bot]

their first contribution

fix: disable zstd compression on content-api

fix(dashboard): surface project deletion failures to the user

🐛 fix: preserve starter project state after Vercel deployment redirect

Improve AssetTransformer diagnostic logging

Improve GitHub authoring settings UX

Always deploy cf-security-headers before the main sst deploy on releases

chore: bump vitest and @vitest/coverage-v8 to 3.2.6 across all workspaces

docs(adr): correct the WorkOS migration plan to a forced TinaCMS 3.12 upgrade with an October cutoff

fix: plaintext token retrieval

fix: conditionally check repo push access when guessing installation id

Prove the user can write to a repo before binding a project to it

fix: redact credential-bearing headers and tokens before writing them to logs

chore(deps): bump golang.org/x/crypto from 0.35.0 to 0.52.0 in /identity[bot]

chore(deps): bump fast-uri from 3.1.5 to 3.1.7[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 57 updates[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 17 updates[bot]

🎨 Enlarge header menus: type scale, row height, menu height (#4063)

Fix TinaCloud no-access login handling

their first contribution

Add branch-aware media rename support to TinaCloud

chore: force patched fast-jwt and fast-xml-parser in sst's deploy tree

chore: float @aws-sdk/client-cognito-identity-provider and client-ssm off stale locks

fix(identity): gateway-level CORS so authorizer 401/403s carry CORS headers

🟥 fix: patch fast-xml-parser 4.5.7 entity-expansion cap that kills sst deploys

fix(ci): let the tinacms auto-bump workflow commit on the runner

fix: honest error when password reset hits a confirmed user with unverified email

fix: return 401 instead of 500 for expired GitHub refresh tokens

fix: guard tiny search index uploads

Fix projects wedged when TinaCMS config is missing on the default branch

Add security.txt and public_key.asc to app.tina.io /.well-known/

chore: clear form-data and jsonpath-plus transitive alerts

📝 docs: onboarding checklist covers Internal Project in CRM

Allow /.well-known/ through the SPA rewrite in cf-security-headers

fix(identity): require an org admin caller to change org roles and app assignments

Allow users to cancel pending account deletion

Fix disabled GitHub OAuth sign-in feedback