What's new with TinaCloud

fix: disable zstd compression on content-api

fix(dashboard): surface project deletion failures to the user

🐛 fix: preserve starter project state after Vercel deployment redirect

Improve AssetTransformer diagnostic logging

Improve GitHub authoring settings UX

Always deploy cf-security-headers before the main sst deploy on releases

chore: bump vitest and @vitest/coverage-v8 to 3.2.6 across all workspaces

docs(adr): correct the WorkOS migration plan to a forced TinaCMS 3.12 upgrade with an October cutoff

fix: plaintext token retrieval

fix: conditionally check repo push access when guessing installation id

Prove the user can write to a repo before binding a project to it

fix: redact credential-bearing headers and tokens before writing them to logs

chore(deps): bump golang.org/x/crypto from 0.35.0 to 0.52.0 in /identity[bot]

chore(deps): bump fast-uri from 3.1.5 to 3.1.7[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 57 updates[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 17 updates[bot]

🎨 Enlarge header menus: type scale, row height, menu height (#4063)

Fix TinaCloud no-access login handling

their first contribution

Add branch-aware media rename support to TinaCloud

chore: force patched fast-jwt and fast-xml-parser in sst's deploy tree

chore: float @aws-sdk/client-cognito-identity-provider and client-ssm off stale locks

fix(identity): gateway-level CORS so authorizer 401/403s carry CORS headers

🟥 fix: patch fast-xml-parser 4.5.7 entity-expansion cap that kills sst deploys

fix(ci): let the tinacms auto-bump workflow commit on the runner

fix: honest error when password reset hits a confirmed user with unverified email

fix: return 401 instead of 500 for expired GitHub refresh tokens

fix: guard tiny search index uploads

Fix projects wedged when Tina config is missing on the default branch

Add security.txt and public_key.asc to app.tina.io /.well-known/

chore: clear form-data and jsonpath-plus transitive alerts

📝 docs: onboarding checklist covers Internal Project in CRM

Allow /.well-known/ through the SPA rewrite in cf-security-headers

fix(identity): require an org admin caller to change org roles and app assignments

Allow users to cancel pending account deletion

Fix disabled GitHub OAuth sign-in feedback

🐛 Render the real CreateAppUser error when accepting a project invite

🐛 Give every lambda only the stage params it reads

Complete invite acceptance under AuthKit

Extract a shared FullScreenLoader component

Thread the neutral getToken through the GitHub code exchange

fix(ci): normalise follow-redirects entry in yarn.lock

feat: tinacms workos support

Render public routes for logged-out AuthKit visitors

chore(identity): retire the Bind integration

Mint a new token in refreshAuth so newly granted access applies

docs: add dev onboarding issue template

Un-fence repo-connect for WorkOS users

Add the staff admin panel, with WorkOS sign-in and its deployment stack

fix: allow customer origins CORS on GET /v2/auth/config

chore(deps): bump fast-uri from 3.0.6 to 3.1.5[bot]

chore(deps): bump body-parser from 1.20.3 to 1.20.6[bot]

chore(deps): bump nanoid from 3.3.9 to 3.3.18[bot]

chore(deps): bump js-yaml from 3.14.2 to 3.15.1[bot]

chore(deps): bump brace-expansion from 1.1.13 to 1.1.18[bot]

chore(deps): bump tar from 7.5.11 to 7.5.22[bot]

chore(deps): bump linkify-it from 5.0.0 to 5.0.2[bot]

chore(deps): bump @babel/core from 7.26.10 to 7.29.7[bot]

chore(deps): bump @tootallnate/once from 2.0.0 to 2.0.1[bot]

chore(deps): bump ws from 7.5.10 to 7.5.11[bot]

chore(deps): bump fast-xml-builder from 1.1.4 to 1.2.0[bot]

chore(deps): bump follow-redirects from 1.15.9 to 1.16.0[bot]

chore(deps-dev): bump esbuild from 0.25.12 to 0.28.1[bot]

chore(deps-dev): bump postcss from 8.5.3 to 8.5.23[bot]

chore(deps-dev): bump aws-cdk-lib from 2.224.0 to 2.260.0[bot]

chore(deps): bump axios from 1.12.0 to 1.18.0[bot]

chore(deps): bump the patch-and-minor group across 1 directory with 2 updates[bot]

chore(deps): bump form-data from 4.0.4 to 4.0.6[bot]

chore(deps): bump markdown-it from 14.1.1 to 14.2.0[bot]

chore(deps): bump actions/github-script from 8.0.0 to 9.0.0[bot]

chore(deps): bump actions/checkout from 5.0.1 to 7.0.0[bot]

chore(deps): bump actions/setup-node from 5.0.0 to 6.4.0[bot]

chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1[bot]

feat: personal activity calendar

Stop logging raw tokens in plaintext

✨ Activity reporting: content-change leaderboard and latest landing

fix(identity): harden org list against membership rows missing OrgName

feat(refresh-webhooks): refresh content-repo hooks in direct mode

feat(auth): dual-issuer (Cognito + WorkOS) JWT verification for content-api & assets-api

✨ Return matching folders as media-search results (v2 list)