v0.4.0

0.4.0 (2026-06-23)

⚠ BREAKING CHANGES

• households: global routes, legacy User role authorization, old invitations, old API session binding, account subscription plans, and tenantless person/location assumptions are replaced by household-scoped routes, memberships, explicit person grants, and forced PostgreSQL RLS.

Features

• households: replace global auth with household tenancy (#1380) (7c8b84d)

Bug Fixes

• 🛡️ Sentinel: High Fix DOM-based Stored XSS in Schedule Form (#1372) (921354a)
• 🛡️ Sentinel: Medium Fix XSS vulnerability in global search (#1371) (c6c6351)
• block deactivated user authentication (#1356) (615509b)
• use hasMenuItemTarget for empty check (#1368) (60ef344)

Performance Improvements

• Memoize dashboard blocked reasons (#1373) (66368b2)