Blog / CMS: Inkwell

Dependency hygiene: updated @types/uuid to v11 for improved TypeScript type accuracy.

Dependency maintenance: updated all non-major dependencies to their latest patch and minor versions. Ensures compatibility with upstream ecosystem improvements and security patches.

**Dependency Updates** Updated esbuild to v0.28.1, incorporating security and reliability hardening improvements. This ensures your build pipeline benefits from the latest stability enhancements and best practices in the esbuild ecosystem. No breaking changes. Update at your convenience.

Security and reliability hardening: updated nodemailer to ^9.0.1 to address upstream stability concerns. This ensures your email delivery pipeline remains robust and compliant with current best practices. No migration steps required—update at your convenience.

Documentation: aligned licence terms in project documentation for clarity and consistency.

Dependency hygiene: applied override to brace-expansion range to ensure reliable and secure dependency resolution. No changes to template features or API.

Dependency maintenance: updated all non-major dependencies to their latest patch and minor versions. These updates include security and reliability hardening across the dependency tree. No breaking changes or migration required.

Documentation: added comprehensive universal buyer documentation to improve onboarding and reference materials for all users of the Inkwell Blog CMS template.

Fixed display font token references to use local token definitions instead of external dependencies. This ensures consistent font rendering across the Inkwell blog CMS and reduces external stylesheet dependencies.

**Fixed:** CMS taxonomy creation actions now properly wired. Taxonomy management in the admin panel now functions as intended, allowing you to create and organize content categories without workarounds.

Fixed prose typography styling on the legal page template to ensure consistent text rendering and readability across the Inkwell blog CMS. **Changes:** - Legal page prose typography alignment (#59)

Theme palette alignment for Inkwell. This release includes a styling fix to ensure consistent color values across the theme system.

Fixed duplicate analytics nav item that appeared in the sidebar navigation. This was a visual-only issue with no impact on functionality or data.

Fixed responsive layout issues in the mobile dashboard view. Dashboard components now render correctly across all viewport sizes with improved touch target spacing and reduced layout shift on smaller screens. No breaking changes. Update at your convenience.

Fixed an authentication edge case where API key validation could incorrectly fall back to browser session credentials (#51). This prevents unintended session reuse in API contexts and strengthens the separation between API and browser-based auth flows. No breaking changes. Update recommended for all deployments using API key authentication.

Fixed API key session handling to enforce strict boundary isolation. This prevents potential cross-session key leakage in edge cases where multiple API keys were active in the same request context. The fix is transparent — no configuration changes needed. Session boundaries are now enforced automatically on all API key operations.

Documentation: cleaned up buyer-facing docs branding for consistency and clarity. No functional changes to the template or CMS.

Improved resilience and security controls for magic link authentication and file upload handling. **Changes:** - Hardened magic link validation and token lifecycle management to reduce token reuse and replay attack vectors - Strengthened upload download security with additional integrity checks and rate-limiting safeguards No migration required. Update at your convenience.

Fixed character encoding issue in marketing-content component that was causing mojibake (garbled text) in certain locales. This resolves display corruption when rendering marketing copy with non-ASCII characters.

Removed unused SaaS billing code that was out of scope for this template. Internal cleanup with no impact on template functionality or buyer workflows.

Documentation: clarified production Docker Compose environment variable requirements in deployment guide (#45). No code changes.

Bug fixes and quality improvements from phase 7 review cycle. Internal refinements to ensure stability and code quality across the template.

Fixed console logging in DSAR script that was inadvertently left in production code. This cleanup ensures compliance tooling runs silently without debug output.

Fixed compliance scaffold surface propagation to ensure internal tooling consistency across the template structure. This maintenance release improves build reliability without affecting template output or buyer workflows.

Applied phase 4 inherited safety fixes across the codebase. This release contains internal improvements to code quality and security posture with no changes to template functionality or APIs.

Fixed phase 4 hardening inheritance propagation in the tl03 template layer. This ensures security and configuration hardening rules are correctly inherited across nested component structures. No action required.

Maintenance and reliability improvements.

**Fixed:** Server-Sent Events (SSE) streams in the browser now correctly handle refresh cookie propagation. Previously, cookie-based session refresh could fail during active SSE connections, causing event streams to drop unexpectedly. This fix ensures cookies are properly maintained throughout the stream lifecycle, improving reliability for real-time event features. If you're using SSE for live updates or notifications, upgrade to benefit from more stable connections.

Documentation: clarified default access control behaviour in activity logging. No code changes in this release.

**Code block syntax highlighting.** Blog posts now render code blocks with language-aware syntax highlighting, improving readability for technical content. **Dashboard layout refinement.** Full-width dashboard shell provides better use of screen real estate for content management. **Fixes & maintenance.** Corrected character encoding in customization documentation. Updated Next.js to 16.2.6 for latest stability and performance patches.

Security and reliability hardening. Update recommended.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Introduces a complete content management system with a public blog and a dedicated admin content studio. - Public blog with a polished article reader, pagination, and standalone static pages - Admin content studio with auto-save drafts and editorial workflow controls - Comment moderation workflow and a content analytics dashboard - Media handling with automatic image optimisation - RSS and sitemap feeds, plus a globally customisable colour palette and a distinct editorial landing page Includes security and reliability hardening.

Adds breadcrumb navigation for clearer wayfinding through the app, alongside refinements to email rendering for more consistent transactional messages. Includes security and reliability hardening.

Adds an activity timeline that presents a chronological view of recent events in the application.

Adds file upload support, giving the application a shared way to handle user-supplied files.

Adds real-time updates via server-sent events, so connected views reflect changes as they happen without a manual refresh.

Introduces a reusable data-table component for presenting structured records in a consistent layout across the app.

Adds groundwork for marketplace payments through Stripe Connect, laying the foundation for multi-party transactions.

Maintenance and reliability improvements.

Added per-family content override slots, letting you customise marketing copy independently for each product family without touching shared layout.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

Maintenance and reliability improvements.

v1.3.1 — backport user.login_failed + sweep from TL00-BASE v1.3.1 Backport from TL00-BASE v1.3.1 (commit 5926a75).