Changelog - Dev - 06.14.2026

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[Unreleased] - 2026-06-14

Fixed

Wrap ciphertext into full event for Megolm decrypt

Update - 2026-06-14 01:08 UTC

Fixed

Deliver Megolm room key via shareRoomKey return

Update - 2026-06-14 01:39 UTC

Fixed

Restore Continue Convo and remove redundant bottom toast

Update - 2026-06-14 02:09 UTC

Added

Lift new-message banner into app shell

Update - 2026-06-14 02:33 UTC

Fixed

Resolve peer's lantern name in app-shell banner

Update - 2026-06-14 02:49 UTC

Fixed

Raise new-message banner above full-screen overlays

Update - 2026-06-14 03:23 UTC

Added

Lift wave-accepted banner to app shell

Update - 2026-06-14 05:31 UTC

Added

Provision analytics aggregation scheduler jobs: Enables automated analytics aggregation via Cloud Scheduler jobs with proper OIDC authentication, completing the scheduler-auth migration across the fleet. (#601) devops
Static CSP required-origins lint validation: Adds CI validation to catch Content Security Policy misconfigurations in manifest files, preventing deployment regressions like the stale-dashboard issue. (#601) devops

Changed

Migrate scheduler auth to OIDC fleet-wide: Wires SCHEDULER_OIDC_AUDIENCE and SCHEDULER_SA_EMAIL into venue-api and analytics-api Cloud Run deploys, replacing the deprecated SCHEDULER_SECRET for improved security posture. (#601) devops

Fixed

Address scheduler robustness and CSP manifest issues: Resolves review findings to strengthen scheduler authentication reliability and fix stale-dashboard regression caused by CSP configuration drift. (#601) devops
Fix service account pinning in deploy config: Corrects service account identity pinning to ensure scheduler jobs authenticate with the correct identity across all deployments. (#601) devops

Removed

Retire inert SCHEDULER_SECRET environment variable: Removes the deprecated SCHEDULER_SECRET from venue-api now that OIDC-based authentication is fleet-wide, reducing credential management surface area. (#601) devops

Update - 2026-06-14 20:50 UTC

Changed

Improve merchant PATCH audit logging and Auth sync: Empty-body merchant PATCH requests now return noChanges: true and skip audit log writes, reducing noise. Firebase Auth displayName mirroring is isolated for cleaner sync behavior. (#602) enhancement
Display README pages as Overview in docs sidebar: VitePress sidebar now labels README pages as "Overview" for improved documentation navigation clarity. (#602) enhancement

Fixed

Log stale ownerUserIds and venueIds in merchant detail: Merchant detail endpoint now warn-logs dangling ownerUserIds and venueIds that point to deleted documents, improving diagnosability without changing behavior. (#602) enhancement
Clean up EventCreator accessibility and lint warnings: Resolved accessibility and linting issues in the EventCreator admin component. (#602) enhancement