What nhost/nhost shipped

This week: WebAuthn elevation proofs are now bound to the bearer-token user. Dashboard settings got a redesigned General page and a configuration editor that matches other settings pages. The landing blog now has categories and search, and a new beta clarifies token confinement.

This week's changes to the repository: WebAuthn step-up verification now binds the elevation proof to the user named in the bearer token, rather than whichever user owned the challenge. In the dashboard, the General page of project settings was redesigned into clear Project name, Delete project and Availability cards, and the configuration editor now matches the width of other settings pages with a description, a help icon to the configuration reference, and Revert changes and Save at the top of the card. The landing blog gained category tags, search, featured posts and an estimated read time preview, the security contact now points to GitHub Security, and a new beta release clarifies default-role admission and token confinement.

This week: shared reversible migrations land in the services, Auth adds SMS OTP, TOTP and email OTP session elevation, Constellation supports computed fields and coalesces query parsing, and the dashboard can deploy a branch, tag or commit.

This week the services moved onto a shared, database-backed migration library that moves PostgreSQL schemas to an image's target version and can roll back when an older image is deployed. Storage, Auth, AI and the shared library all adopted it. Auth sessions can now be elevated with SMS OTP behind a flag, and TOTP and email OTP elevation flows plus an elevate endpoint were added so accounts without a security key can still satisfy elevated requests. Constellation added Hasura v2 PostgreSQL computed-field support and now coalesces concurrent parsing and validation of identical queries. The dashboard gained a New deployment button for a branch, tag or commit SHA, a multi-column unique constraint editor, and a round of consistency work on settings cards, popups, icon buttons and copy buttons.

This week: auth sessions can be elevated with TOTP, the dashboard supports composite foreign keys, nhost-js no longer recurses on custom auth URLs, storage handles date conditionals on transformed images, and the CLI filters psql guards from initial migrations.

This week's changes to the project: Auth: new elevate/totp endpoint verifies a TOTP code and returns a session whose JWT carries the elevated claim. Dashboard: composite foreign keys can be created, edited, introspected and tracked; foreign keys can reference columns covered by a standalone unique index. nhost-js: the refresh middleware recognises the auth client's own token request whatever authUrl is configured, avoiding recursive refresh. Storage: conditional requests on transformed images use the source file's modification time, and bodyless 304 and 412 responses skip decoding and transforming. CLI: psql-only restrict and unrestrict lines are removed from generated initial migrations. Functions ship latest Node.js versions and fix reflected XSS in example greetings.

New dashboard design shipped this week, with reworked breadcrumbs, header notifications, account menu and command palette in the header. Also released: CLI 1.52.0 with WAL and extension config plus ca-central-1 support, and a dashboard fix that gates native queries on older Graph

This week the new dashboard design went out, covering reworked breadcrumb navigation, header notifications, the account menu and a command palette moved into the header. A patch release followed it. The CLI reached 1.52.0, exposing WAL and extension configuration for Postgres and adding support for the ca-central-1 region, with updated certificates. The dashboard now gates native queries when a project runs a GraphQL engine older than v2.33.0, where create and update calls were failing. Smaller fixes align field-array row controls with their inputs and make MultiSelect toggle from its controlled value.

This week: OAuth sign-in returns the real error instead of internal-server-error, bundled pg_squeeze is allowed in the Postgres image, functions greetings are served as plain text, CLI MCP resources use spec-compliant annotations, and the Reference page links every sidebar group.

This week in Nhost: OAuth sign-in now returns the actual error (unverified-user, disabled-user, or blocked email domain) instead of internal-server-error. The PostgreSQL image allows the bundled pg_squeeze logical-decoding output plugin without preloading the library. The functions example greetings are served as plain text to prevent reflected XSS. The CLI MCP server uses spec-compliant annotations for its resources. The Reference landing page links every top-level sidebar group, including the Auth and Storage API. Personal access tokens are readable in dark mode, and the JWT verification docs example uses the signing key for symmetric verification.

Weekly digest: Dashboard 3.6.0 with native queries, logical models, and permissions. PostgreSQL adds pg_durable for durable workflows. nhost-js with SMS deanonymization. Multiple packages updated.

This week's digest: Dashboard 3.6.0 ships native queries and logical models with full relationship and permission management UI. PostgreSQL adds pg_durable 0.2.8 for SQL-native durable workflows, WAL configuration tuning, and safer extension upgrades. Auth SDK gains SMS deanonymization and phone number management. CLI, storage, constellation, and functions packages updated with dependency and infrastructure improvements.

This week: npm 11 pinning prevents untrusted code execution in functions, permission editing fixes prevent unintended access broadening, and Nix validation hardens overlay exports.

This week's updates focus on security and reliability. Function deployments now pin npm 11 to prevent untrusted code execution when using file or git dependencies. Dashboard permission editing has been fixed to prevent unintentional access broadening. Infrastructure improvements include PostgreSQL 17.11 support, Nix flake overlay validation, and better CI automation with dependabot integration.

Week 32: MCP 0.3.0 published, PostgreSQL 18.6 upgrade, auth gains SMS features, dashboard settings redesigned, and secret scanning added to CI.

This week's updates focus on infrastructure and developer experience. PostgreSQL upgraded to 18.6, MCP service published to official registry, auth adds SMS deanonymization and phone number changes, dashboard continues modernization with docked settings sidebar, and CI gains automated secret scanning. Functions runtime fixed for dynamically linked binaries.