28 August 2026
66 changes:
- A sign-in is questioned when it looks wrong, not when the browser is new
- One TOTP code, one login
- A password change that cannot be the same password
- The bundled sign-in forms can price automation
- The mail an account was sent is on the account's screen
- Themed email: the column that had never been read
- An email is written in the recipient's language
- A datatable over an
authserver.*table read as empty on MySQL - Authorization is three layers, and the guide said two
- Two reported bugs: a date of zero, and a cropped PNG's black corners
- Something runs the second-factor cleanups
- The services screen says whether anything is listening to its buttons
- A message to many accounts, composed and sent from a screen
- Three test classes were spending their time emptying the cache
- Requiring a second factor, and requiring a real one
- The debug bar says where the second factor stands — and stops forgetting your tab
- Three dead ends on the administration screens
- A settings row no longer opens the debug toolbar
- Nothing on the settings screen opens the DevPanel any more
- A scaffolded application comes with something that runs its background work
/admin/Servicessays how to create the supervisor- New-sign-in alerts can be on unless turned off
- The DevPanel's Back button goes where you came from
Sessioncan write, not only read- One apostrophe no longer destroys a page's breadcrumb structured data
Html\Daterenders the time and the dropdowns it always claimed to accept- The queue worker runs under a supervisor
/admin/Servicescan see a supervisor in another container- An unsubscribe link, and the two headers Gmail actually reads
Addon::trigerAddon()refuses a nameless addon too- The default language is a list, not ten characters of free text
- Adminer, at
/adminer, behind the application's own gate /messages— the inbox those internal messages were going into- Any browser with JavaScript can solve the human check — and a test proves it
- A CSP-blocked redirect, and a script with two nonces
- Adminer signs itself in
Html\Datereads the properties it declares- An idle connection is not a query running for three hours
Html\Date's field is validated by the browser again- A date is written the way the language writes dates
- Two of the widest columns on the process list said the same thing four times
- Two empty boxes where the log charts should be
- The log dashboard's figures, asked for by something that is not a screen
- The components guide listed
Seoand then never mentioned it again mcp:servehad its own copy of the tool catalogue, and it was stale- The most frequent error in the log was the framework asking a question
- Every log entry was dated the moment you looked at it
mcp:serveis not something a person could debug- An MCP tab in the DevPanel: the schema as a form, the answer on the page
find-symbol: the question grep cannot answer- The DevPanel's MCP tab shipped with a JavaScript syntax error
route-listexecuted the views, and then said there were no routes- A link in the DevPanel is styled wherever it is
- Two more MCP tools: what the CLI can do, and what the theme is made of
- Three tests that were a copy of the tool catalogue
api-docsandfind-tests: the other two of the four- Two rules that could not be checked, and now can
changelog-add: the one tool that writes- The plain-text part of an email was the CSS, with the links removed
- Four headers that decide what happens to a message
- Gmail actions: a button in the message list, and the reason yours is not showing
- A ViewAction never needed a handler — the password-reset mail has one now
- One-click mail actions, and the handler a "this wasn't me" button needs
- The unsubscribe page was 181 KB, and 180 of them were the website
- A session count that was not a number, and four tables called
sessions - Email tracking that works, and only for mail somebody agreed to receive