Changelog - Dev - 07.21.2026
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog.
[Unreleased] - 2026-07-21
Fixed
- Fix Dashboard subscriptions to follow auth state changes: Dashboard realtime subscriptions (lanterns, scheduled lights, waves, connections) now properly wire on late sign-in, tear down and re-wire on account switch, and clear per-user state on transitions. This prevents one account's data from being rendered for another and eliminates subscription leaks. (#680)
bug
Update - 2026-07-21 00:49 UTC
Security
- Enforce PIN brute-force lockout for sealed pairing: PIN validation on sealed accounts was bypassable because the lockout mechanism keyed on userId and engaged after token issuance. Now enforces the same 5-strike / 15-minute lockout policy keyed on phoneHash before token generation, closing the brute-force window. (#681)
bug
Update - 2026-07-21 02:18 UTC
Added
- Tag blocked peers in Archived Chats view: Blocked peers' conversations now remain visible in Archived Chats with a "Blocked" tag, preserving chat history and context. Active chats continue to filter blocked peers entirely, keeping the interface clean while the archive provides full transparency. (#682)
enhancement
Update - 2026-07-21 17:51 UTC
Added
- Add comprehensive Stage B test coverage and Firebase Admin 14 support: Closes all remaining Stage B test gaps with 18 new phone/email-axis ban route tests, 18 PhonePinLogin integration tests covering ban-is-not-a-wrong-PIN invariants across blocked paths, and explicit concurrency tests for createUser phoneHash uniqueness. Upgrades Firebase Admin SDK to version 14. (#687)
dependencies
Update - 2026-07-21 19:19 UTC
Fixed
- Remove unused firebase-functions-test dependency: Removed firebase-functions-test from the functions workspace to unblock Cloud Functions deployment. The dependency was unused and incompatible with firebase-admin v14, causing Cloud Build to fail during isolated npm install. (#688)
bugdependencies
Update - 2026-07-21 21:56 UTC
Security
- Restrict client Firestore venue creation to manual source: Client-side Firestore rules now enforce that venues created directly by users must have source set to 'manual', preventing authenticated users from bypassing server-side deduplication, rate limiting, and validation by creating venues with external sources like OpenStreetMap or Google Places. (#689)
bug
Update - 2026-07-21 22:51 UTC
Changed
- Adopt react-hooks 7.1 linting rules: Updated eslint-plugin-react-hooks to ^7.1.0 and fixed 23 flagged violations across 12 web files using behavior-preserving patterns: lazy initializers for synchronous reads, React's adjust-during-render pattern for prop/route sync, handler-scoped fetches, and ref-to-state conversions where render depends on values. Improves code quality and future maintainability. (#690)
enhancementdependencies