Blog / CMS — Inkwell

Theme palette alignment for Inkwell. This release includes a styling fix to ensure consistent color values across the theme system.

Fixed duplicate analytics nav item that appeared in the sidebar navigation. This was a visual-only issue with no impact on functionality or data.

Fixed responsive layout issues in the mobile dashboard view. Dashboard components now render correctly across all viewport sizes with improved touch target spacing and reduced layout shift on smaller screens. No breaking changes. Update at your convenience.

Fixed an authentication edge case where API key validation could incorrectly fall back to browser session credentials (#51). This prevents unintended session reuse in API contexts and strengthens the separation between API and browser-based auth flows. No breaking changes. Update recommended for all deployments using API key authentication.

Fixed API key session handling to enforce strict boundary isolation. This prevents potential cross-session key leakage in edge cases where multiple API keys were active in the same request context. The fix is transparent — no configuration changes needed. Session boundaries are now enforced automatically on all API key operations.

Documentation: cleaned up buyer-facing docs branding for consistency and clarity. No functional changes to the template or CMS.

Improved resilience and security controls for magic link authentication and file upload handling. **Changes:** - Hardened magic link validation and token lifecycle management to reduce token reuse and replay attack vectors - Strengthened upload download security with additional integrity checks and rate-limiting safeguards No migration required. Update at your convenience.

Fixed character encoding issue in marketing-content component that was causing mojibake (garbled text) in certain locales. This resolves display corruption when rendering marketing copy with non-ASCII characters.

Removed unused SaaS billing code that was out of scope for this template. Internal cleanup with no impact on template functionality or buyer workflows.

Documentation: clarified production Docker Compose environment variable requirements in deployment guide (#45). No code changes.

Bug fixes and quality improvements from phase 7 review cycle. Internal refinements to ensure stability and code quality across the template.

Fixed console logging in DSAR script that was inadvertently left in production code. This cleanup ensures compliance tooling runs silently without debug output.

Fixed compliance scaffold surface propagation to ensure internal tooling consistency across the template structure. This maintenance release improves build reliability without affecting template output or buyer workflows.

Applied phase 4 inherited safety fixes across the codebase. This release contains internal improvements to code quality and security posture with no changes to template functionality or APIs.

Fixed phase 4 hardening inheritance propagation in the tl03 template layer. This ensures security and configuration hardening rules are correctly inherited across nested component structures. No action required.

fix(layout): declare smooth scroll behavior for Next.js. This ensures consistent scroll-behavior CSS application across the template without relying on implicit browser defaults.

**Fixed:** Server-Sent Events (SSE) streams in the browser now correctly handle refresh cookie propagation. Previously, cookie-based session refresh could fail during active SSE connections, causing event streams to drop unexpectedly. This fix ensures cookies are properly maintained throughout the stream lifecycle, improving reliability for real-time event features. If you're using SSE for live updates or notifications, upgrade to benefit from more stable connections.

Documentation: clarified default access control behaviour in activity logging. No code changes in this release.

**Code block syntax highlighting.** Blog posts now render code blocks with language-aware syntax highlighting, improving readability for technical content. **Dashboard layout refinement.** Full-width dashboard shell provides better use of screen real estate for content management. **Fixes & maintenance.** Corrected character encoding in customization documentation. Updated Next.js to 16.2.6 for latest stability and performance patches.

- fix(deps): override vulnerable fast-xml-builder (#38)

- fix(auth): propagate account deletion hardening

- fix(scope): align Lite commerce surfaces with feature matrix (#36)

- fix(template): align commerce surfaces with feature matrix (#35)

- fix(tl03): make dashboard open the CMS studio (#34)

- fix(tl03): align Inkwell landing copy with buyer mode (#33)

- docs(customization): remove stale landing component paths (#32)

- chore(landing): remove unused TL01 landing carryover (#31)

- fix(mech-review): clear release findings

- fix(marketing): gate demo copy for buyer builds (#28)

- fix(a11y): propagate base skip links and focus rings (#26)

- fix(ui): replace hardcoded colour classes with semantic tokens

- feat(demo): add Template Empire live demo banner (#23)

- fix(package): slim buyer zip contents

- test: allow db-backed vitest hooks to complete

- fix(ui): use buyer brand placeholder in inherited chrome

- docs(install): align buyer verification steps

- fix(db): wait for demo postgres before migrations

- fix(dev): fail fast when demo database is unavailable

- fix(ui): preserve outline button contrast

- fix(theme): align accent token with catalogue

- fix(deps): satisfy full dependency audit

- fix(email): escape CTA href attributes - feat: backport buildEmailHtml + breadcrumbs from TL00-BASE

- feat(activity): backport activity-timeline helper (Phase 3.7)

- feat(uploads): backport file-upload abstraction (Phase 3.6)

- feat(events): backport in-memory event bus + SSE primitive (Phase 3.5)

- feat(data-table): backport generic DataTable primitive (Phase 3.4)

- feat(commerce): backport Stripe Connect marketplace primitive shim (Phase 3.3)

- feat(commerce): backport commerce.mode + commerce.requireAccount flags

- feat(marketing): adopt per-family content override slots from TL00-BASE v1.6.0

- ci: pass catalogue-canonical theme tokens to mech-review

- fix(copy): secondary marketing sweep — Phase 1f-A

- fix(copy): replace false hero/marketing claims with truthful foundation framing

- feat(config): backport SITE_CONFIG.auth + SITE_CONFIG.commerce flags

- fix(base): propagate TL00-BASE v1.4.0 universal deltas

- fix(licence): commit licence.json placeholder so CI prebuild can run

- fix(package): exclude .npmrc from buyer ZIP

- fix(ci): mech-review now runs on GH Release ZIP regardless of Supabase upload

- fix(toolchain): pin packageManager: pnpm@10.33.0 + tighten engines.pnpm

- fix(ci): chain release → publish → mechanical-review in single workflow - chore(ci): inherit canonical workflows from TemplateEmpire/.github

v1.3.1 — backport user.login_failed + sweep from TL00-BASE v1.3.1 Verified 11/11 PASS by te-verify-fullstack v0.2.1. Backport from TL00-BASE v1.3.1 (commit 5926a75).