13 changes:
Helpers::fileGetContents() fetched with TLS verification off- A clamped rendition was never found again, and rebuilt on every request
- Two migrations that could fail on real data now decline instead
- Saving a token through the model stored it in plaintext and unfindable
get() takes upscaling per call, so a template can fill its frame- An application on the legacy version ledger can say what already ran
crop and resample are part of a rendition's identity too- Maintenance mode can be raised and cleared from the console
migrations.auto: stop migrating on your own without disabling migrate- Ask a production database a question without opening a shell on it
- The public MCP endpoint ships one tool, so it can be told from a broken one
- The diagnostic tools can answer off the box, behind three separate scopes
mcp:token — one command for the credential and the client config
57 changes:
- A caller of
OutboundUrl::fetch() could not tell a 404 from a 200 — and the framework's own
caller was storing the placeholder
- The
tokenactions self-repair could not run on MySQL
- What the email second factor does when the store or the mailer fails
- The class added this morning was the day's biggest coverage gap — and
addRemoteImage() with it
- Who counts as signed in for the administration area, and what a missing page answers with
- A grouped page could not be asked for at all
- Where the write spool buffers, and how long it keeps trying
- Re-running
create:model destroyed the model
- The Redis operations that only Redis has
- …and the same reconnect on the path most statements take
- The Select2 branch of the CRUD generator
- Revoking one device, and the cascade that is MySQL-only
- What each DevPanel card shows when the thing behind it is missing
- A security-notification class at 6% covered
- The per-address rate limit had never run
- The session upsert had never been issued against PostgreSQL
- What a client is told about every MCP tool before it calls one
- A round of 69 tests that moved coverage by one statement
route-list was tested through its parser and never through itself- The two scheduled commands whose
execute() had no test at all
- The scaffolders' refusals, and two things that cannot be tested the obvious way
MediaObject's error arms, and a dead-code finding that was not one- An application's own
User class was never once returned in a test
- Losing Redis would have taken the application down, not the cache
- The Memcached counter had never run, and
clear() empties more than you think
- What the human check does when it breaks, and the top three targets that cannot be reached
- The Greek in the search box had never been tested
- The URL cache that keeps a worker's memory bounded
ST_MakePoint() takes longitude first, and nothing had ever checked- The deadlock retry, which had never retried anything
- The privilege boundary in the admin area, and a green run that proved nothing
- A better index: 48 methods with no covered line at all
- TOTP replay protection, which had never run and stands down three ways
- The webhook credential check, and the fourth test that replaced what it tested
- The second leg of an API login had never been taken
- The account a client-credentials token hangs on, and a one-character invariant
--spa-components and the two conditions that silently decide nothing happens- 453 statements were being excluded from measurement by accident
- Three small classes off the never-run list, and a test that told me it was empty
- What
auth:twofactor-cleanup actually sweeps, and the assertion total I made unreadable
- A test called "the omnibox limit is capped" that would pass on an uncapped omnibox
- Configuring a local asset list crashed every page build
- An addon setting called
2fa_enabled is not called that
- The query behind
hasIndex(), and the assertion that PostgreSQL does not inherit it
- Three counters, sessions and headers — and a setter that means the opposite of its name
- Seven more off the never-run list, in one pass
- Three more, and a state leak I caused and had already written the guide entry for
- Three small ones to close the gap
- The machine account, an MCP call's identity, and a helper the framework ships untested
/adminer refuses with a 404, and why that is the security decision- The reconnect that must forget, and the first sign-in that is not a new device
- The middleware list, and the bracket somebody will forget
can() and cannot() — the pair every guard clause is written with- The last three: two seams and the accessor every closing test reads
- The two gaps that were in the environment, not the tests
8 changes:
- Column comments are now applied when altering a table
- Partial indexes and column ordering in the schema builder
- Native enum types in the schema builder
- Attribute-routed controller actions now dispatch
- Auth controller tests no longer drop the shared
users table
- The test suite no longer leaves an
app/ directory in the repo
- Realtime: pluggable SSE + WebSocket backplane
- Cross-cutting improvements: flat-key cache, log output modes, media alpha fix