Updates

Changelog

What we've shipped, most recent first.

Customer-visible changes to Aspire & Thrive. Most recent first.

2026-10-06

D12 DSL safeguarding category/form/recipient editing source now retains administrator authority and existing tenant, lens, View as, immutable-form and recipient/category guards. Paged names-only recipient choices avoid broader profile visibility; verified tenant/account and selected-row receipts avoid zero-row success feedback.
60 focused checks passed (27 web,33 synthetic local SQL), scoped TypeScript,16-file lint,19-file UTF-8/EOF checks and independent source review. The local marked full historical baseline used bounded genuine current configuration prerequisites and an ownership-only helper alignment. Native plpgsql_check is unavailable and the executable-gate rehearsal was not run; full1466 concern/visibility/email parity, production rehearsal/application, authenticated browser and final CI remain pending. No production application or LIVE data changes.

Self-service settings hub at /settings with cards for profile, security, billing, team, organisation details, SSO, API keys, preferences, and notifications.
Stripe Customer Portal integration so admins can update payment, download invoices, and change plan without contacting support.
App-wide error and not-found boundaries — no more blank-page-on-crash.
Public /about page on every tenant subdomain showing branding, address, and registrations.
Public /security page covering technical and organisational measures.
Onboarding checklist for new admins, with a compact progress indicator on Home.
Bulk staff CSV import at /import/staff.
Bulk contacts CSV import at /import/contacts.
Skip-to-content link and global prefers-reduced-motion honour for accessibility.
Tenant-level branding fields (logo, brand colour, addresses, company / charity / DfE / Ofsted / ICO numbers) in /settings/organisation.
MFA factor management at /settings/security/mfa with a guard that prevents MFA-required roles from removing their last verified factor.
In-app billing banner that surfaces past-due / incomplete / cancelled subscription state.
Demo booking flow at /book-a-demo with a Cal.com webhook receiver.
Read-only API v1 with HMAC-signed keys and outbound webhooks.

Help widget now surfaces a "for this page" suggestion on every authenticated route.

Vendored Vitest 3 for compatibility with the Vite 8 brought in by the Next.js 16 upgrade.
Pre-commit hook now also runs gitleaks when installed locally.