v3.0.0-beta.27

Changes

Security

• Require auth + ownership on user-profile read/write
• Require auth on /api/global-variables routes
• Escape number/date/datetime input values in dynamic fields (stored XSS)
• Exempt /auth/logout and /auth/refresh from CSRF validation

Fixes

• Bind CACHE_KV in starter template to fix cold-start TTFB
• Fix plugins not visible in admin
• Stats: login loop, telemetry, collection dashboard, auto-deploy
• Resolve demo broken login
• CI/E2E: quarantine broken tests, module cache, RBAC seed ordering

Features

• Commercial support tier + intake form

Dependencies

• Bump hono, axios, sharp, ws, wrangler, @hono/node-server, and others

Installation

npm create sonicjs@latest my-app

Or update existing project:

npm install @sonicjs-cms/core@3.0.0-beta.27