What's new with TinaCloud

Add branch-aware media rename support to TinaCloud

chore: force patched fast-jwt and fast-xml-parser in sst's deploy tree

chore: float @aws-sdk/client-cognito-identity-provider and client-ssm off stale locks

fix(identity): gateway-level CORS so authorizer 401/403s carry CORS headers

🟥 fix: patch fast-xml-parser 4.5.7 entity-expansion cap that kills sst deploys

fix(ci): let the tinacms auto-bump workflow commit on the runner

fix: honest error when password reset hits a confirmed user with unverified email

fix: return 401 instead of 500 for expired GitHub refresh tokens

fix: guard tiny search index uploads

Fix projects wedged when Tina config is missing on the default branch

Add security.txt and public_key.asc to app.tina.io /.well-known/

chore: clear form-data and jsonpath-plus transitive alerts

📝 docs: onboarding checklist covers Internal Project in CRM

Allow /.well-known/ through the SPA rewrite in cf-security-headers

fix(identity): require an org admin caller to change org roles and app assignments

Allow users to cancel pending account deletion

Fix disabled GitHub OAuth sign-in feedback

🐛 Render the real CreateAppUser error when accepting a project invite

🐛 Give every lambda only the stage params it reads

Complete invite acceptance under AuthKit

Extract a shared FullScreenLoader component

Thread the neutral getToken through the GitHub code exchange

fix(ci): normalise follow-redirects entry in yarn.lock

feat: tinacms workos support

Render public routes for logged-out AuthKit visitors

chore(identity): retire the Bind integration

Mint a new token in refreshAuth so newly granted access applies

docs: add dev onboarding issue template

Un-fence repo-connect for WorkOS users

Add the staff admin panel, with WorkOS sign-in and its deployment stack

fix: allow customer origins CORS on GET /v2/auth/config

chore(deps): bump fast-uri from 3.0.6 to 3.1.5[bot]

chore(deps): bump body-parser from 1.20.3 to 1.20.6[bot]

chore(deps): bump nanoid from 3.3.9 to 3.3.18[bot]

chore(deps): bump js-yaml from 3.14.2 to 3.15.1[bot]

chore(deps): bump brace-expansion from 1.1.13 to 1.1.18[bot]

chore(deps): bump tar from 7.5.11 to 7.5.22[bot]

chore(deps): bump linkify-it from 5.0.0 to 5.0.2[bot]

chore(deps): bump @babel/core from 7.26.10 to 7.29.7[bot]

chore(deps): bump @tootallnate/once from 2.0.0 to 2.0.1[bot]

chore(deps): bump ws from 7.5.10 to 7.5.11[bot]

chore(deps): bump fast-xml-builder from 1.1.4 to 1.2.0[bot]

chore(deps): bump follow-redirects from 1.15.9 to 1.16.0[bot]

chore(deps-dev): bump esbuild from 0.25.12 to 0.28.1[bot]

chore(deps-dev): bump postcss from 8.5.3 to 8.5.23[bot]

chore(deps-dev): bump aws-cdk-lib from 2.224.0 to 2.260.0[bot]

chore(deps): bump axios from 1.12.0 to 1.18.0[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 2 updates[bot]

chore(deps): bump form-data from 4.0.4 to 4.0.6[bot]

chore(deps): bump markdown-it from 14.1.1 to 14.2.0[bot]

chore(deps): bump actions/github-script from 8.0.0 to 9.0.0[bot]

chore(deps): bump actions/checkout from 5.0.1 to 7.0.0[bot]

chore(deps): bump actions/setup-node from 5.0.0 to 6.4.0[bot]

chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1[bot]

feat: personal activity calendar

Stop logging raw tokens in plaintext

✨ Activity reporting: content-change leaderboard and latest landing

fix(identity): harden org list against membership rows missing OrgName

feat(refresh-webhooks): refresh content-repo hooks in direct mode

feat(auth): dual-issuer (Cognito + WorkOS) JWT verification for content-api & assets-api

✨ Return matching folders as media-search results (v2 list)

Account deletion cron job

feat(identity): route OAuth endpoints through WorkOS

💄 Soften the collaborator seat-limit warning

🧹 Split assets-api list paths and add a v2 list endpoint

Validate postMessage origin & harden OAuth state

🐛 Skip re-index when a linked content repo has no branch ref yet

✨ Add a search query param to the v2 list endpoint

Handle GitHub repository rename webhook events

Fix cross-tenant boundary holes in updateAppsForOrgUser and assets sync

fix: sanitise github api errors

Refactor auth user decouple cognito

feat(identity): provisioning-status readiness endpoint

feat: add endpoint to retrieve github app name

Complete WorkOS AuthKit dashboard user flow

feat(identity): add pending-deletion action-required email

fix(content-api): guard Segment identify() against a missing userId

Fix JWT verification to prevent account takeover

feat(dashboard): gate dashboard mount on WorkOS provisioning readiness

✨ feat(identity): user deletion endpoint + LastSeenAt

🧹 Point quickstart and analytics at renamed tina-react-starter

remove word last from header

feat(dashboard): block transferring ownership to a deactivated user

feat(dashboard): gate account deletion on ownership + type-to-confirm

feat(identity): WorkOS webhook endpoint with signature verification, gated behind WORKOS_AUTH

feat(identity): WorkOS user-provisioning webhook handler

fix(auth): route new invitees to /register, not /signin

fix(auth): stop link-preview crawlers locking invitees out of their own invite

📝 Add ADR: source of truth for document `lastUpdated` in collection listings

✨ Add isDraft body param to editorial workflow PR creation