2026-07-23

I'll gather the necessary information from each PR to create a comprehensive release note. Let me fetch the details for all PRs.Now let me get the commits for each PR to gather more detailed information:# Overview

This release includes authentication hardening improvements, Protected Sites map visibility enhancements, and critical database maintenance fixes. The changes improve session security, extend fire alert visibility to Protected Sites, and resolve a long-standing issue where database cleanup crons were unable to advance their cutoff dates on persistent deployments.

What's Changed

Features & Fixes

• fix: gate disabled alert-method buttons and repair Auth0 refresh-token flow: Enhanced authentication flow with automatic access token refresh and request retry on session expiration. Settings SMS/Email/Webhook buttons now properly respect the backend's enabled flag. Implemented session-expiration notifications and automatic logout handling with a toast message. Fixed a broken getCredentials() call that was passing the refresh token into the SDK's scope parameter instead of letting it manage the refresh token internally. Added real 401 recovery for both the tRPC client and axios wrapper with a de-duped refreshAccessToken() utility to prevent duplicate refreshes on concurrent 401s.

• feat(map): show fires and incidents for Protected Sites: Extended map view to display fire alerts and incident boundaries for Protected Sites alongside user-owned sites. Added new alert.getAlertsForProtectedSites tRPC query that mirrors the existing alert.getAlerts endpoint, resolving sites through SiteRelation instead of userId. Protected Site alerts now support all existing features including date filters, alert details sheets, and the alerts/incidents view toggle with no additional UI changes required.

• fix: db-cleanup cron never advances its cutoff date on long-running deployments: Fixed critical issue where the daily database cleanup cron had frozen cutoff dates on persistent Coolify deployments. The cleanup cutoff date was computed once at module load and never recomputed, causing accumulated backlog to go unprocessed. Restructured currentDateTimeAt1AM from a module-level const to be reassigned at the top of each request handler, ensuring fresh cutoff calculations on every invocation. Extended notification cleanup to also capture and delete failed/skipped notifications (where isSkipped: true and sentAt was never set) once 90 days old by createdAt timestamp.

PR Maps

• features to develop - PR #358, PR #359
• [sync] main to develop - PR #360
• [production] develop to main - PR #361