v1.0.0-beta.4

Released to production on August 19, 2026 at 15:16 CDT. See every commit in this release on GitHub

New

• Media library: DAM alt text defaults into every placement
• Console: a new cookie cannot reach production undeclared
• Besigner: the eight declared help topics get the panels they name
• Console: an author host role edits content and cannot publish

Fixed

• Brand: the Cookie Policy and the editor tip read the configured brand
• Limits: a contended rate-limit key refuses instead of hanging
• Self-hosting: the cookie inventory names its OWN surfaces, not Aglyn's
• Console: report-usage resolves the metered price through the helper
• Marketing site: a bounce and a complaint suppress the address
• Sites: the plugin dispatcher refuses cross-origin visitor writes
• Documentation: three console cards get the docs section their tooltip promises
• Sites: the plugin dispatcher refuses cross-origin visitor writes
• Console: a Stripe 200 on a meter event is not a charge
• Security: stop trusting aglyn-console.vercel.app, and pin the list
• Console: a GET on the audit archive reports instead of deleting
• Console: a GET on the audit archive reports instead of deleting
• Plugins: name the published-site email-capture fields
• Sites: collection pages announce their RSS feed, and the feed names itself
• Plugins: name the published-site email-capture fields
• Sites: collection pages announce their RSS feed, and the feed names itself
• Besigner: the Custom CSS form speaks the Styles panel's spelling
• Besigner: the Custom CSS form speaks the Styles panel's spelling

Documentation

• the rate-limiting runbook gains the contention posture
• six beta.3 features that shipped with no documentation get some
• Email: the runbook points at a DNS zone that no longer exists
• the six legal/ops intakes are verified to deliver, not unconfirmed
• the six legal/ops intakes are verified to deliver, not unconfirmed
• Documentation: v1.0.0-beta.3 is promoted, deployed, tagged; rules+indexes live
• Documentation: v1.0.0-beta.3 is promoted, deployed, tagged; rules+indexes live

Behind the scenes

• Sites: the release-gate spec's mock stops hiding the cross-origin refusal
• Sites: the visitor-write rate-limit spec stops faking a symbol away
• Shared libraries: pin the merge semantics a caller gets wrong, not just the bump
• Tooling: make the shared-ui-jsx barrel discipline an exit code
• Dependencies: add the dependabot version-update config the repo never had
• Dependencies: add the dependabot version-update config the repo never had