What nhost/nhost shipped
Written by FoxPlug from the repository's own releases; not affiliated with Nhost. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/nhost/nhost; Nhost did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- OAuth sign-in errors now return the real reason instead of internal-server-error when a user is unverified, disabled, or uses a blocked email domain. Pull request #5058
- The PostgreSQL image allows the bundled
pg_squeezelogical-decoding output plugin without preloading the library or adding a configurable allowlist. Pull request #5118 - The functions example greetings are served as plain text to prevent reflected XSS. Pull request #5160
- The CLI's MCP server now uses spec-compliant annotations for its resources. Pull request #5138
- The Reference landing page now links every top-level group from the Reference sidebar, including the Auth and Storage API. Pull request #5040
- Personal access tokens are readable in dark mode and toasts are styled correctly in the dashboard. Pull request #5124
- The docs JWT verification example now parses the config JSON and uses the signing key for symmetric verification. Pull request #5112
- New issues and pull requests from external authors are automatically labeled external. Pull request #5120
- A glama.json was added and the MCP server is mentioned in the README so the Nhost MCP server can be claimed on Glama. Pull request #5060
- The CLI generates bindings from production instead of staging for stability. Pull request #5119
Why it matters
This week fixes error reporting so OAuth users see the actual reason for a failed sign-in instead of a vague internal error. It also expands what the PostgreSQL image can do with the bundled pg_squeeze output plugin. Documentation and dashboard fixes make the Reference pages and personal access tokens easier to use.
Changelog entry
- Auth: return the actual OAuth error instead of internal-server-error for unverified, disabled, or blocked-domain users Pull request #5058
- Postgres: allow the bundled
pg_squeezelogical-decoding output plugin Pull request #5118 - Functions: serve example greetings as plain text to prevent reflected XSS Pull request #5160
- Cli: use spec-compliant annotations for MCP resources Pull request #5138
- Docs: link every Reference sidebar group from the Reference page Pull request #5040
- Dashboard: fix PAT token contrast in dark mode and unstyled toasts Pull request #5124
- Docs: use the signing key for symmetric JWT verification in the example Pull request #5112
- Ci: add a job to label issues and pull requests from external authors Pull request #5120
- Mcp: add glama.json and mention the MCP server in the README Pull request #5060
- Cli: use production to generate bindings instead of staging Pull request #5119
- Ci: fix container access after changes in the base image Pull request #5136
This week: OAuth sign-in returns the real error instead of internal-server-error, bundled pg_squeeze is allowed in the Postgres image, functions greetings are served as plain text, CLI MCP resources use spec-compliant annotations, and the Reference page links every sidebar group.
This week in Nhost: OAuth sign-in now returns the actual error (unverified-user, disabled-user, or blocked email domain) instead of internal-server-error. The PostgreSQL image allows the bundled pg_squeeze logical-decoding output plugin without preloading the library. The functions example greetings are served as plain text to prevent reflected XSS. The CLI MCP server uses spec-compliant annotations for its resources. The Reference landing page links every top-level sidebar group, including the Auth and Storage API. Personal access tokens are readable in dark mode, and the JWT verification docs example uses the signing key for symmetric verification.
Week of September 28, 2026
What shipped
- Dashboard 3.6.0 adds a last sign-in method badge, lets users manage logical models and native queries, and manage permissions for logical models and native queries. Release
- Nhost-js 4.9.0 adds SMS deanonymization and phone number changes to auth, and emits nullable schemas correctly in the TypeScript codegen plugin. Release
- PostgreSQL image now exposes WAL and extension configuration settings at startup and in project configuration for tuning retention, compression, checkpoints, diagnostics, and preloaded libraries. Pull request #5080
- PostgreSQL now ships
pg_durable0.2.8 to enable SQL-native durable workflows and HTTP steps that persist across database restarts and failovers. Pull request #5072 - PostgreSQL extensions are upgraded with validation for upgrade paths, supporting both fresh installs and in-place upgrades including TimescaleDB. Pull request #5071
- Dashboard now preserves user-entered values when cloning rows instead of clearing primary-key and unique-column values. Pull request #5081
- Dashboard adds recovery for stale metadata conflicts during mutations. Pull request #5078
- PostgreSQL container now handles SIGTERM gracefully throughout startup, first-boot SQL, collation repair, and normal operation. Pull request #5026
- PostgreSQL startup, point-in-time recovery, and collation repair are hardened to fail safely without disrupting normal startup or deleting data. Pull request #5025
- CI now checks and builds the nhost.toml configuration-reference generator in Nix CI, triggering documentation checks when generator changes. Pull request #5104
Why it matters
Dashboard 3.6.0 brings native queries and logical models to full operational capability with relationship and permission management. PostgreSQL gets production-grade durability features and safer extension upgrades. The auth SDK adds phone number management while the CLI and supporting packages receive stability improvements and dependency updates.
Changelog entry
- Dashboard 3.6.0: manage logical models, native queries, relationships, and permissions; add last sign-in method badge Release
- Nhost-js 4.9.0: SMS deanonymization and phone number changes in auth; fix nullable schema emission in TypeScript codegen Release
- PostgreSQL: expose WAL retention, compression, checkpoint, diagnostic, and extension settings in image startup and project configuration Pull request #5080
- PostgreSQL: include
pg_durable0.2.8 extension for SQL-native durable workflows and HTTP steps Pull request #5072 - PostgreSQL: upgrade bundled extensions with validation for safe upgrade paths including TimescaleDB Pull request #5071
- Dashboard: preserve user-entered values when cloning rows instead of clearing primary-key and unique-column values Pull request #5081
- Dashboard: add recovery for stale metadata conflicts Pull request #5078
- PostgreSQL: handle SIGTERM gracefully throughout startup and normal operation Pull request #5026
- PostgreSQL: harden startup, point-in-time recovery, and collation repair to fail safely Pull request #5025
- CI: simplify approval handling with per-workflow
safe_to_testworkflow and per-commit approval tracking Pull request #5083 - CI: add nhost.toml configuration-reference generator to Nix CI checks Pull request #5104
- CLI 1.51.2 released Release
Weekly digest: Dashboard 3.6.0 with native queries, logical models, and permissions. PostgreSQL adds pg_durable for durable workflows. nhost-js with SMS deanonymization. Multiple packages updated.
This week's digest: Dashboard 3.6.0 ships native queries and logical models with full relationship and permission management UI. PostgreSQL adds pg_durable 0.2.8 for SQL-native durable workflows, WAL configuration tuning, and safer extension upgrades. Auth SDK gains SMS deanonymization and phone number management. CLI, storage, constellation, and functions packages updated with dependency and infrastructure improvements.
Week of September 21, 2026
What shipped
- Functions now pin npm 11 in the shared dependency installer to prevent execution of untrusted code during deploy when using file: or git dependencies. Pull request #5014
- Dashboard permission editing no longer unintentionally broadens access when modifying compound permissions. Pull request #5062
- Auth 0.52.1-beta1 released with AUTH_SMS_PASSWORDLESS_ENABLED renamed to AUTH_OTP_SMS_ENABLED for general use. Release
- PostgreSQL updated to 17.11. Pull request #5070
- Nix flake now validates the overlay it publishes to prevent unintended exports from shadowing nixpkgs toolchains. Pull request #5069
- Old PostgreSQL versions have been restored. Pull request #5066
- Dashboard tests now use jsdom's native PointerEvent instead of mocks. Pull request #5068
- CI configuration updated to allow dependabot to trigger builds. Pull request #5055
Why it matters
Security improvements in function deployments prevent unintended code execution, dashboard fixes prevent accidental permission escalation, and infrastructure updates bring better stability and tooling validation.
Changelog entry
- Functions: pin npm 11 in shared dependency installer to prevent untrusted code execution during deploy Pull request #5014
- Dashboard: fix permission editing to prevent unintended access broadening Pull request #5062
- Auth: 0.52.1-beta1 released with AUTH_OTP_SMS_ENABLED variable renaming Release
- PostgreSQL updated to 17.11 Pull request #5070
- Nix: validate overlay exports and remove deprecated stdenv checks Pull request #5069
- Restore old PostgreSQL versions Pull request #5066
- Dashboard: use jsdom native PointerEvent in tests Pull request #5068
This week: npm 11 pinning prevents untrusted code execution in functions, permission editing fixes prevent unintended access broadening, and Nix validation hardens overlay exports.
This week's updates focus on security and reliability. Function deployments now pin npm 11 to prevent untrusted code execution when using file or git dependencies. Dashboard permission editing has been fixed to prevent unintentional access broadening. Infrastructure improvements include PostgreSQL 17.11 support, Nix flake overlay validation, and better CI automation with dependabot integration.
Week of September 14, 2026
What shipped
- MCP service version 0.3.0 released with unauthenticated /healthz endpoint for probes and publication to the official MCP Registry. Release
- PostgreSQL upgraded to 18.6 with support for versions 16 and 17 dropped. Pull request #5020
- Auth version 0.52.0 released with generic SMS support, SMS deanonymization, and phone number change capabilities. Release
- Dashboard project settings sidebar redesigned with docked layout and independent scrolling content. Pull request #4993
- Dashboard Events page migrated to new layout pattern. Pull request #4965
- Auth settings migrated to new dashboard layout with dedicated Auth settings route. Pull request #4933
- Functions development runtime image fixed to include glibc dynamic loader for dynamically linked ELF binaries. Pull request #5006
- Constellation fixed to resolve
foreign_key_constraint_onrelationships against the exact constraint. Pull request #5028 - Sign-in page now displays a LAST USED badge on the sign-in method used previously. Pull request #4984
- CI pipeline enhanced with betterleaks secret scanning on pull requests. Pull request #4962
Why it matters
This week brought significant upgrades to core infrastructure with PostgreSQL 18.6 and continued dashboard modernization across multiple settings sections. Auth gained SMS capabilities and the development experience improved with fixes to functions runtime and constraint resolution.
Changelog entry
- Mcp@0.3.0: Added unauthenticated /healthz endpoint for probes, published MCP service to official MCP Registry Release
- PostgreSQL: Upgraded to 18.6, dropped support for versions 16 and 17 Pull request #5020
- PostgreSQL CI: Retired version 16 and 17 image jobs Pull request #5021
- Auth@0.52.0: Added generic SMS support, SMS deanonymization, and phone number changes Release
- Functions@2.3.0: Fixed Yarn Classic pinning, normalized dependency installation, added chokidar polling for hot-reload Release
- Functions@2.3.1: Added glibc dynamic loader to dev runtime image Release
- Cli@1.51.1: Released with reference updates and provenance check fixes Release
- Dashboard: Project settings sidebar now docked with independent scrolling content Pull request #4993
- Dashboard: Auth settings migrated to new layout with dedicated route Pull request #4933
- Dashboard: GraphQL settings migrated to new layout Pull request #4932
- Dashboard: Storage settings migrated to new layout Pull request #4934
- Dashboard: Functions settings migrated to new layout Pull request #4935
- Dashboard: Run settings migrated to new layout Pull request #4936
- Dashboard: Deployments settings migrated to new layout Pull request #4937
- Dashboard: Metrics settings migrated to new layout Pull request #4938
- Dashboard: Events page migrated to new layout Pull request #4965
- Dashboard: AI pages migrated to new layout Pull request #4964
- Dashboard: Sign-in page shows LAST USED badge for previously used sign-in method Pull request #4984
- Constellation: Fixed
foreign_key_constraint_onresolution against exact constraint Pull request #5028 - Dashboard: Fixed unscheduled deployments hiding live deployment Pull request #5023
Week 32: MCP 0.3.0 published, PostgreSQL 18.6 upgrade, auth gains SMS features, dashboard settings redesigned, and secret scanning added to CI.
This week's updates focus on infrastructure and developer experience. PostgreSQL upgraded to 18.6, MCP service published to official registry, auth adds SMS deanonymization and phone number changes, dashboard continues modernization with docked settings sidebar, and CI gains automated secret scanning. Functions runtime fixed for dynamically linked binaries.