2026.08.30

Automated release for 8c71671

Changes: d088533..8c71671

Breaking changes

Action required: review the linked pull requests for database migrations, new environment variables, or other deployment changes before upgrading.

• chore(ci): bump the actions group across 1 directory with 2 updates (#137) #137

  Bumps the actions group with 2 updates in the / directory: actions/checkout and actions/upload-artifact.

  Updates actions/checkout from 5 to 7

  Release notes

  Sourced from actions/checkout's releases.

• Make standup a Kanban you filter by person, and delete the meeting machinery (#149) #149

  What this changes

  Standup is now a Kanban board of the whole workspace with everyone's name in tiles along the top. Click a name and the board filters to that person. Click it again, or Everyone, and you are back to the whole team.

  The meeting apparatus is gone: no turn order, no current speaker, no rotation, no blockers, no timer.

• Stop one unknown action from discarding a whole delta batch (#271) #271

  Why

  Three things that are individually reasonable combine into a silent bug.

  sync.ts:43        model: z.enum(SYNC_MODELS)
  

• chore(ci): bump the actions group with 3 updates (#351) #351

  Bumps the actions group with 3 updates: actions/setup-node, github/codeql-action/init and github/codeql-action/analyze.

  Updates actions/setup-node from 6 to 7

  Release notes

  Sourced from actions/setup-node's releases.

Other

• feat(db): add demo seed data (#1) #1
• feat(realtime): websocket fan-out server and typed realtime client (#2) #2
• feat(web): add app shell, design system, keyboard layer and passwordless auth (#3) #3
• feat(core): add the domain service layer (#4) #4
• feat(services): add markdown, storage, email, notifications and slack services (#5) #5
• fix(shared): stop update schemas from inventing values (#6) #6
• fix: repair three defects surfaced by integrating the packages (#7) #7
• fix: validate every test database url by its database name (#8) #8
• feat(mcp): add the Orbit MCP server over streamable HTTP (#9) #9
• feat: organization, membership, and planning surfaces (#10) #10
• feat(issues): realtime issue board, list, detail and comments (#11) #11
• fix(realtime): suppress deltas by originating tab instead of by user (#12) #12
• feat(account): personal account settings and workspace switching (#13) #13
• feat(filters): filter bar, display options and saved views (#14) #14
• feat(docs): docs browser, markdown editor, attachments, and public publishing (#15) #15
• test(web): seed a clean database before each end to end run (#16) #16
• fix(realtime): bind the socket to the organization the client is viewing (#17) #17
• fix(dev): make the repo runnable from a clean shell (#18) #18
• fix(realtime): reject a malformed stated organization (#19) #19
• feat(import): import the Noveum workspace from Plane (#20) #20
• refactor(email): remove mailpit and send everything through resend (#21) #21
• feat(deploy): run Orbit on EKS with S3-backed uploads (#22) #22
• feat(deploy): run Orbit on EKS with S3-backed uploads (#23) #23
• chore(bun): run Orbit on Bun end to end (#24) #24
• feat(db): land the union schema, indexes and invariants for every stream (#25) #25
• feat(design): rebuild the design system on Linear's measured values and make the shell responsive (#26) #26
• fix(keyboard): scope the hotkey registry and stop advertising shortcuts that do nothing (#27) #27
• feat(landing): a public marketing page as the app root, with SEO (#28) #28
• fix(deploy): run the schema migration before rolling out new code (#29) #29
• fix: restore reactions and S3 uploads in production (#30) #30
• feat(auth): close cross-tenant holes, gate by email domain, add password sign in (#31) #31
• feat(data): cursor pagination, virtualization and slimmer payloads for snappy loads (#32) #32
• feat(realtime): make every mutation publish and reconnect backfill deltas (#33) #33
• feat(uploads): fix the PDF path end to end and close the attachment auth hole (#34) #34
• feat(analytics): scope, burndown, velocity, cycle time, churn and distributions (#35) #35
• feat(integrations): github and slack, plus Linear-quality PR notifications (#36) #36
• feat(onboarding): a resumable setup flow for a new organization (#37) #37
• fix(files): encode download filenames so S3 accepts the content disposition (#38) #38
• feat(landing): serve the landing page at /home for everyone (#39) #39
• feat(docs): rich editor, scroll spy, publish states and doc tree (#40) #40
• feat(filters): working filter builder, grouping, display options and saved views (#41) #41
• feat(nav): add a Home entry to the workspace menu (#42) #42
• feat(issues): open tasks in a right side peek panel (#43) #43
• feat(settings): clear GitHub, Slack and MCP integration setup (#44) #44
• fix(realtime): load catchup models sequentially to avoid a bun sql statement collision (#45) #45
• feat(brand): new Orbit logo, favicons, OG image, and SEO metadata (#46) #46
• fix(web): copy public assets into the standalone runner image (#47) #47
• feat(issues): non-modal resizable peek that opens from board cards (#49) #49
• fix(auth): surface OAuth sign-in and account-linking errors to the user (#50) #50
• feat(auth): full dynamic password management (#51) #51
• feat(web): instant loading skeletons for cycles, inbox, settings, and issue detail (#52) #52
• feat(web): instant loading skeletons for docs, projects, pulls, views and analytics (#53) #53
• feat(account): upload and crop a profile photo, stored in S3 (#54) #54
• fix(filters): stop the filter menu crashing on imported issues with malformed labelIds (#55) #55
• fix(layout): use full width on large screens instead of a fixed column cap (#56) #56
• feat(auth): allow linking a provider whose email differs from the account (#57) #57
• fix(filters): stop the filter menu crashing on the paged issues cache shape (#58) #58
• refactor(account): profile photos are S3-only, ingest OAuth avatars, drop URL input (#59) #59
• feat(integrations): one-click GitHub App and Slack OAuth connect flows (#60) #60
• feat(docs): server-render docs behind a persistent sidebar with hash deep-link scrolling (#61) #61
• fix(auth): force-log-out revoked sessions over the realtime socket (#62) #62
• feat(mcp): one-click OAuth login for the MCP server (#63) #63
• fix(onboarding): drop the avatar URL field from the profile step (#64) #64
• feat(docs): comments on documents (#65) #65
• fix(realtime): authenticate the websocket with a short-lived signed ticket instead of the session token in the url (#66) #66
• fix(mcp): one-click consent approval that never 500s (#67) #67
• fix(integrations): replace a stale GitHub installation on reconnect (#68) #68
• fix(issues): render all display properties on board cards and remove the duplicate top-bar display menu (#69) #69
• fix(docs): stop the sidebar scroll from jumping and land heading anchors on the target (#70) #70
• fix(layout): make breadcrumb ancestors navigable (#71) #71
• perf(ci): install dependencies once in a shared orbit-deps base image (#72) #72
• feat(integrations): searchable lazy-loaded repo and channel pickers (#73) #73
• fix(docs): make the nest under doc picker filter and select as you type (#74) #74
• fix(docs): fix hash/ID scroll by shipping heading ids from the server and make the sidebar a plain native scroller (#75) #75
• feat(editor): richer docs editor plus a shared rich text box for comments, issues, and project updates (#76) #76
• fix(ui): wrap long unbreakable content so docs and issues stop overflowing (#78) #78
• feat(standup): all-projects Standup view with list and board layouts (#79) #79
• test(ci): run the Playwright e2e suite as a CI gate (#80) #80
• feat(standup): filters and a saved personal Standup setup (#81) #81
• perf: stream analytics, window the board with lazy-load, and server-prefetch data-first views (#82) #82
• feat(sidebar): collapsible sections and expandable team trees with smooth motion (#83) #83
• Combine Linear and Plane exports into one Orbit import, run migrations locally (#84) #84
• Move Orbit from EKS to Vercel and Supabase (#85) #85
• Survive a multiplexing connection pooler (#86) #86
• Serve realtime and MCP from the web app on Vercel (#87) #87
• Make the board fast and honest, rebuild standup, and close every security hole (#88) #88
• Make MCP usable for planning: fix the consent dead end, add the ceremony tools (#89) #89
• Docs folders and length limits, the inbox reading pane, and project tabs (#90) #90
• Restore the doc outline, fix the doc page server render, and stop losing writes (#91) #91
• Count past sprints from their issues, and add the production schema catch-up (#92) #92
• My issues opens on a board it remembers, and the create dialog matches Linear (#93) #93
• fix: remove redundant port flag in dev script for Windows (#95) #95
• Stop a dead websocket from logging everyone out of production (#96) #96
• Project settings, full MCP coverage, and the first wave of audit fixes (#97) #97
• feat: add Sprints keyboard shortcut (gt) (#99) #99
• Close four cross-workspace leaks and the project, ordering and update bugs (#100) #100
• Give the sidebar and the command palette one navigation source (#101) #101
• Run standup from a presenter board for the whole workspace (#102) #102
• Give each concurrent test run its own database lane (#103) #103
• Fold the docs tree and put sharing on the document (#104) #104
• Attach a file to an issue from the slash command (#105) #105
• feat(inbox): notify people when they are mentioned, replied to or assigned (#106) #106
• fix(keyboard): make the Linear navigation sequences and arrow keys work on every list (#107) #107
• Close the invite token leak, and fail the build on a stray control byte (#108) #108
• refactor(policy): decide doc read access in one place (#109) #109
• Make every listed issue clickable (#110) #110
• Show what a sprint actually carried: scope, points and what moved (#111) #111
• Make long documents fast to open and to type into (#112) #112
• Anchor a doc comment to the passage it is about (#113) #113
• Close a stored XSS and four cross-team realtime leaks (#114) #114
• Close the six remaining security findings, plus the analytics view leak they exposed (#115) #115
• Stop the docs editor eating a reader's typing, and three things it claimed but never did (#116) #116
• Close the coverage gaps a mutation survey found (#117) #117
• Close the twelve mutations that still survived the suite (#118) #118
• Make a doc findable: ranked search with passages, docs in the palette, and a docs home (#119) #119
• Make standup a Kanban board, one column per person (#120) #120
• fix(mcp): advertise the scopes the tools require, so a client can ask for them (#121) #121
• fix(web): pin the dev port, which the squash of #95 dropped (#122) #122
• Make Orbit a real open source project: licence, README, docs, and contribution paths (#123) #123
• chore(deps): bump lucide-react from 0.552.0 to 1.28.0 (#141) #141
• fix(ci): greeting workflow passed input names the action does not declare (#143) #143
• docs: make the cost argument without naming a competitor (#145) #145
• docs: document optional MCP URL in env example (#131) (#146) #146
• Record the GitHub App permissions the code actually uses (#173) #173
• chore(github): add discussion templates and route the issue chooser (#233) #233
• Correct the GitHub App permissions doc before anyone follows it (#236) #236
• perf(issues): stop holding the team row for the whole create (#240) #240
• chore: drop the Doppler env sync, which nothing uses (#257) #257
• docs: track open source readiness status (#293) #293
• docs: deduplicate quick-start (#305) #305
• Ci/add links check (#315) #315
• chore(ci): add automated dated release workflow (#333) #333
• chore(ci): enforce LF line endings (#357) #357

Area: database

• Fail the build on a Bun built-in that would reach the node runtime (#162) #162
• Scope db:test-lanes-drop to one lane (#163) #163
• Resolve one @codemirror/view, and fail the build on a second copy (#164) #164
• Make the committed migrations produce the schema they claim (#250) #250
• Allow yodu.ai email addresses in Noveum (#251) #251
• Fix yodu.ai access for the live Noveum AI workspace (#262) #262
• fix(db): quarantine unsafe importer tooling (#287) #287
• fix(db): guard destructive demo seed (#288) #288
• fix(db): configure prepared statements explicitly (#290) #290
• Guard production database schema releases (#310) #310

Area: integrations

• Link the issues a pull request names in its description (#184) #184

Area: mcp

• fix: stop the production catch-up creating standup tables, and say task manager over MCP (#160) #160
• Expose the GitHub integration through MCP (#232) #232
• Read an issue thread and your inbox over MCP (#244) #244
• Scope the inbox issue lookups to one workspace (#254) #254
• Let an assistant read the files on an issue, not just post them (#284) #284
• fix(docs): enforce row-level security on doc collection deletion (#316) #316
• feat(mcp): add analytics overview tool for agent insights (#219) (#336) #336

Area: web

• Create views on the views page, and stop workspace views landing in a random team (#133) #133
• chore(deps): bump the next-and-react group with 3 updates (#135) #135
• chore(deps): bump better-auth from 1.6.24 to 1.6.25 in the auth group (#136) #136
• Rebuild standup around person tiles and stage columns (#138) #138
• Delete an issue, from every surface that shows one (#139) #139
• chore(deps-dev): bump @testing-library/jest-dom from 6.10.0 to 7.0.0 (#142) #142
• Connect GitHub across several organisations and associate repositories with projects (#144) #144
• Let a workspace own its labels and its board columns (#147) #147
• Create projects, and manage milestones from the UI and MCP (#148) #148
• Make due dates, sub issues, relations and comment files writable (#150) #150
• Make sprints operable: start, complete, edit and delete from the product (#151) #151
• docs: call Orbit a task manager (#153) #153
• Unblock main: stop auth module mocks leaking between test files (#155) #155
• Show a saved view what it says it shows: one scope resolution, and a save that keeps the filter (#156) #156
• chore(keyboard): drop the standup scope and section nothing registers (#159) #159
• fix: wire clear filters callback on My Issues view (#161) #161
• Make docs folders real, let cards be dragged on every board, and load a board in one round trip (#165) #165
• Say what actually lands in the inbox (#166) #166
• chore(deps): bump the patch-and-minor group across 1 directory with 38 updates (#167) #167
• fix(github): say why an install did not connect instead of leaving the page blank (#168) #168
• build: let Vercel trace the output instead of building standalone (#169) #169
• feat(issues): copy a branch name from the issue menu (#170) #170
• feat: team settings, issue copy actions, and a visible delete (#171) #171
• Let cards be dragged on the My Issues board (#172) #172
• feat(github): say why a webhook delivery changed nothing (#198) #198
• fix(issues): keep the peek open on the issue you are reading (#234) #234
• feat(issues): let the properties panel take you to what it names (#235) #235
• Fix the docs outage, and let MCP actually file a document (#241) #241
• perf(web): make loading fast, cached and ready (#242) #242
• perf(web): load the bootstrap and the first issue page together (#243) #243
• feat(workspace): add permanent workspace deletion (#246) #246
• perf(web): turn on the React Compiler (#247) #247
• perf(github): stop recording a delivery for events no handler reads (#248) #248
• feat(pulls): say why the pull request page is empty (#249) #249
• Open a document rendered, not as its source (#252) #252
• feat(perf): measure what the app feels like, and bound the tables that grow (#253) #253
• Refuse to build against a database that is behind the schema (#256) #256
• perf(issues): warm the issue the keyboard is sitting on (#258) #258
• Let a document read like a document (#259) #259
• feat(settings): show why recent GitHub deliveries changed nothing (#260) #260
• perf(deploy): put the functions in the same region as the database (#261) #261
• feat(webhooks): scope a delivery to the workspace it belongs to (#263) #263
• feat(perf): record where the time inside a metric went (#264) #264
• Fix quick create project freshness and keyboard flow (#265) #265
• Give the document the top of the page back (#266) #266
• fix(issues): show all projects in quick create (#268) #268
• Say a repository is untracked instead of blaming branch naming (#269) #269
• Keep a task box on the line it belongs to, and show the task in the inbox (#270) #270
• fix(issues): keep the issue link picker open (#272) #272
• fix(issues): line up the link type buttons (#273) #273
• Give people a handle they can be mentioned by (#274) #274
• test(web): stop module stubs outliving the file that installed them (#275) #275
• fix(issues): name a link in the activity trail the way the UI names it (#278) #278
• chore(open-source): define the preview boundary (#280) #280
• feat(db): neutralize built-in demo seed (#281) #281
• chore(privacy): replace private demo artifacts (#282) #282
• fix(deploy): make standalone start portable (#283) #283
• fix(github): recheck callback authorization (#285) #285
• Show the whole task in the inbox, and stop the shell scrolling off the page (#286) #286
• fix(auth): enforce MCP consent and token scopes (#289) #289
• fix(inbox): stop the hidden labels and wide markdown breaking the page (#291) #291
• feat(inbox): page through an inbox larger than one screenful (#292) #292
• fix(auth): require a production sign-in path (#294) #294
• feat(sprints): one sprint for the workspace, not one per team (#295) #295
• fix(issues): make the create dialog scrollable and stop the project picker snapping back (#296) #296
• Make the standup board filterable and its person tiles honest (#297) #297
• feat(sprints): a real sprint board, browsable history, and sane defaults for a new task (#298) #298
• fix(docs): render pasted markdown in rich editors (#299) #299
• refactor(sprints): show the sprint on the board every other surface uses (#300) #300
• fix(issues): a failed surface says so, and clearing one filter clears one (#301) #301
• feat(auth): replace magic links with email OTP (#302) #302
• fix(issues): save large pasted descriptions (#303) #303
• Mirror GitHub pull request activity in Orbit (#304) #304
• fix(issues): estimate glyph, comment attach control, Duplicate status, and chip glyphs (#306) #306
• feat(analytics): add planning cockpit (#309) #309
• feat(docs): render mermaid diagrams in documents (#311) #311
• fix(github): backfill pull requests from pulls page (#312) #312
• fix(analytics): make planning charts readable (#313) #313
• feat(docs): make a mermaid diagram legible, and openable in a viewer (#314) #314
• feat(analytics): planning-grade sprint burn and insights lens (#318) #318
• feat(inbox): open on Activity and move field changes to a Status tab (#320) #320
• feat: deliver personal notifications as Slack DMs (#321) #321
• test(e2e): make the filter history round trip deterministic (#322) #322
• feat: persist Slack user mappings (#323) #323
• feat(web): add shift+t keyboard shortcut for theme toggle (#331) #331
• feat(web): add development collision detection for hotkeys (#334) #334
• test(e2e): fix account and workspaces flaky test (#335) #335
• fix(tests): stop the Slack install test overwriting the auth secret (#338) #338
• chore(web): use path alias and describe/it for registry tests (#339) #339
• fix(issues): stop a long description covering the new issue properties (#340) #340
• feat(docs): add HTML pages and members-only published links (#342) #342
• feat(issues): add multiple reviewers (#343) #343
• feat(issues): add accessible keyboard drag and drop to Kanban board (#345) #345
• fix(analytics): scope drilldown rows to authorized teams and report withheld counts (#346) https://github.com/Noveum/orbit/pull/346
• chore(deps): bump motion from 12.43.0 to 13.1.1 (#353) https://github.com/Noveum/orbit/pull/353
• test(web): isolate issue row focus from leaked guards (#354) https://github.com/Noveum/orbit/pull/354
• feat(mcp): surface the MCP server and HTML pages in the UI (#358) https://github.com/Noveum/orbit/pull/358
• fix(ci): give the heaviest e2e test the suite timeout back (#360) https://github.com/Noveum/orbit/pull/360
• fix(web): stop relative timestamps breaking hydration (#361) https://github.com/Noveum/orbit/pull/361
• feat(docs): preview an html artifact on documents and issues (#362) https://github.com/Noveum/orbit/pull/362
• feat(docs): drag to resize the html split view (#363) https://github.com/Noveum/orbit/pull/363
• docs: publish searchable documentation site (#364) https://github.com/Noveum/orbit/pull/364
• Fix Windows verification portability (#367) https://github.com/Noveum/orbit/pull/367
• feat(mcp): add workspace agent instructions (#368) https://github.com/Noveum/orbit/pull/368
• feat(auth): open sign-up to anyone (#369) https://github.com/Noveum/orbit/pull/369
• fix(slack): route inbound unfurl events on the integration team id (#370) https://github.com/Noveum/orbit/pull/370
• fix(charts): render a dot for single-point series instead of an empty path (#371) https://github.com/Noveum/orbit/pull/371