v1.8.0
From clone to live
One command now takes a fresh clone to a monitored production deploy, and your app runs before you set up a database. Underneath: a patched Next.js, a content security policy scoped to your own database, and tests that stay on your machine.
Added
- One command from clone to production: pnpm deploy-wizard links Vercel and Supabase, applies migrations, deploys, then confirms your site and database answer before monitoring startsFeature
- See your app before you set up a database: your site, the design system, and the sign-in screens render straight awayFeature
- A deploy you can stop and resume: the wizard picks up where it left off, and asks for Stripe only when you sell somethingFeature
- Type-checked database queries: your Supabase clients carry the full generated schema, and CI fails when the committed types drift from itFeature
- Every test you write actually runs: the build fails if a test file isn't picked up by any runnerFeature
Changed
- Setup ends with your app on screen: it writes your private settings file, makes your first commit, and hands you a go-live checklistImprovement
- Your app's name, not ours: the header, browser tab, and sign-in pages show your name, and renaming it keeps pnpm test greenImprovement
- A leaner kit: ten fewer CI workflows, and a fresh clone without the teams tables or the unused sandbox packageImprovement
Security
- Next.js 16.3.4: closes two remote-code-execution advisories in the frameworkSecurity
- A content security policy scoped to your database: it names your own Supabase URL instead of every Supabase projectSecurity
- Sign-in redirects you control: every auth redirect is built from NEXT_PUBLIC_APP_URL, never from a request headerSecurity
- Row-level security that binds everyone: the user-table template forces RLS, so even the table's owner role follows your policiesSecurity
- Tests and seeds stay on your machine: both refuse a hosted database unless you opt in for that runSecurity
- Safer guardrails: the secret scanner catches Supabase's sb_secret_ keys, and the destructive-command guard works offline and logs every blockSecurity
Upgrading
- pnpm 11 is now required (Node 22.13 or later). Run the health check as pnpm run doctor.
- Database has the teams tables? Run supabase migration repair --status reverted 20260406000000 20260601000000 once. Your tables and rows stay.
- Remove any CSP_DOMAINS.supabase reference, and set NEXT_PUBLIC_APP_URL for each environment.
- Import designTokenRules from @repo/eslint-plugin/tokens/eslint-rules.
- Add FORCE ROW LEVEL SECURITY to tables you made from the old user template.
- Testing or seeding a hosted database? Prefix the command with E2E_ALLOW_REMOTE_DB=1 or SEED_ALLOW_REMOTE=1.
- Full steps are in the v1.8.0 release notes.