What's new with TinaCloud

Extract a shared FullScreenLoader component

Thread the neutral getToken through the GitHub code exchange

fix(ci): normalise follow-redirects entry in yarn.lock

feat: tinacms workos support

Render public routes for logged-out AuthKit visitors

chore(identity): retire the Bind integration

Mint a new token in refreshAuth so newly granted access applies

docs: add dev onboarding issue template

Un-fence repo-connect for WorkOS users

Add the staff admin panel, with WorkOS sign-in and its deployment stack

fix: allow customer origins CORS on GET /v2/auth/config

chore(deps): bump fast-uri from 3.0.6 to 3.1.5[bot]

chore(deps): bump body-parser from 1.20.3 to 1.20.6[bot]

chore(deps): bump nanoid from 3.3.9 to 3.3.18[bot]

chore(deps): bump js-yaml from 3.14.2 to 3.15.1[bot]

chore(deps): bump brace-expansion from 1.1.13 to 1.1.18[bot]

chore(deps): bump tar from 7.5.11 to 7.5.22[bot]

chore(deps): bump linkify-it from 5.0.0 to 5.0.2[bot]

chore(deps): bump @babel/core from 7.26.10 to 7.29.7[bot]

chore(deps): bump @tootallnate/once from 2.0.0 to 2.0.1[bot]

chore(deps): bump ws from 7.5.10 to 7.5.11[bot]

chore(deps): bump fast-xml-builder from 1.1.4 to 1.2.0[bot]

chore(deps): bump follow-redirects from 1.15.9 to 1.16.0[bot]

chore(deps-dev): bump esbuild from 0.25.12 to 0.28.1[bot]

chore(deps-dev): bump postcss from 8.5.3 to 8.5.23[bot]

chore(deps-dev): bump aws-cdk-lib from 2.224.0 to 2.260.0[bot]

chore(deps): bump axios from 1.12.0 to 1.18.0[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 2 updates[bot]

chore(deps): bump form-data from 4.0.4 to 4.0.6[bot]

chore(deps): bump markdown-it from 14.1.1 to 14.2.0[bot]

chore(deps): bump actions/github-script from 8.0.0 to 9.0.0[bot]

chore(deps): bump actions/checkout from 5.0.1 to 7.0.0[bot]

chore(deps): bump actions/setup-node from 5.0.0 to 6.4.0[bot]

chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1[bot]

feat: personal activity calendar

Stop logging raw tokens in plaintext

✨ Activity reporting: content-change leaderboard and latest landing

fix(identity): harden org list against membership rows missing OrgName

feat(refresh-webhooks): refresh content-repo hooks in direct mode

feat(auth): dual-issuer (Cognito + WorkOS) JWT verification for content-api & assets-api

✨ Return matching folders as media-search results (v2 list)

Account deletion cron job

feat(identity): route OAuth endpoints through WorkOS

💄 Soften the collaborator seat-limit warning

🧹 Split assets-api list paths and add a v2 list endpoint

Validate postMessage origin & harden OAuth state

🐛 Skip re-index when a linked content repo has no branch ref yet

✨ Add a search query param to the v2 list endpoint

Handle GitHub repository rename webhook events

Fix cross-tenant boundary holes in updateAppsForOrgUser and assets sync

fix: sanitise github api errors

Refactor auth user decouple cognito

feat(identity): provisioning-status readiness endpoint

feat: add endpoint to retrieve github app name

Complete WorkOS AuthKit dashboard user flow

feat(identity): add pending-deletion action-required email

fix(content-api): guard Segment identify() against a missing userId

Fix JWT verification to prevent account takeover

feat(dashboard): gate dashboard mount on WorkOS provisioning readiness

✨ feat(identity): user deletion endpoint + LastSeenAt

🧹 Point quickstart and analytics at renamed tina-react-starter

remove word last from header

feat(dashboard): block transferring ownership to a deactivated user

feat(dashboard): gate account deletion on ownership + type-to-confirm

feat(identity): WorkOS webhook endpoint with signature verification, gated behind WORKOS_AUTH

feat(identity): WorkOS user-provisioning webhook handler

fix(auth): route new invitees to /register, not /signin

fix(auth): stop link-preview crawlers locking invitees out of their own invite

📝 Add ADR: source of truth for document `lastUpdated` in collection listings

✨ Add isDraft body param to editorial workflow PR creation

feat(identity): gate account deletion on org/project ownership

fix(content-api): skip full media mirror for branch-aware non-default branches

feat(identity): block ownership transfer to a disabled user

💄 Tighten projects table spacing and labels

✨ Cache per-item Timestamp during collection-list iteration

fix(identity): harden user provisioning against duplicate records, retries and race conditions

fix(identity): whitelist localhost dev port range for OAuth callbacks

Add unit tests for dual-issuer JWT authorizer

⏪ Revert gitleaks hook + stray test.txt commits pushed to main

✨ Surface per-document last-write Timestamp from the content DynamoDB read

🔒 Add Husky hooks: gitleaks secret scan, format check, and main-push block

fix(content-api): guard DDB iterator throttles so Lambda runtime survives

fix(content-api): retry transient 5xx from identity-v2

Bump actions to use Node 24 and pin SHAs

🧹 Add Dependabot config with 3-day cooldown and grouped updates

✨ Show actionable build/index failure details in the Event Log

📝 Document the dependency cooldown policy in AGENTS.md

update to tinacloud logo

Support workos backend jwt authorization for tinacloud

change avatar logo to initials

docs(adr): restructure WorkOS AuthKit migration docs into a layered ADR + action plan

💄 Fix squished logo and inconsistent spacing/buttons across email templates

🐛 Send firstName/lastName to Segment so Mailchimp welcome email greeting fills