v1.32.0

1.32.0 (2026-10-12)

Added

• app: accounts and realtime built from the runtime and wired by nucleus add, and an API key's owner as the authorization subject (A11 N5, NU-112) (#598) (d427531)
• app: WithAuthz() gives an application built WithoutDefaults() the default stack's default-deny authorization, opt-in (NU-125, NU-128, NU-130) (#620) (4a36dfc)
• cache: a Redis backend for pkg/cache wired by configuration, installed by nucleus add redis-cache (A11 N6) (#601) (99615f4)
• cli: nucleus add wires what it installs — options and mounts spliced into main.go, the configuration block written, oidc, API keys and the SQL queue as catalog entries (A11 N4) (#595) (cd18dc8)
• cli: one catalog for nucleus add — pinned to the release, the same names for add and new --with, suggestions and the key that selects each entry (A11 N1) (#590) (34eacb8)
• plugins: the outbox bridges queue and webhook events to plugins, an in-process example, and a module template held to CheckModule (A11 N11) (#599) (e65be51)
• plugins: the plugin side — an SDK helper, a tested example plugin, plugin test that executes, external commands in the help, and an opt-in allowlist (A11 N10) (#596) (a8d2a00)
• saml: a SAML 2.0 service provider as a federated sign-in module, installed and wired by nucleus add saml (A11 N8) (#602) (6624e18)
• sentry: a Sentry module for unhandled errors and panics, installed and wired by nucleus add sentry (A11 N7) (#597) (fbf613a)

Fixed

• app: a mail_driver a WithoutDefaults() application ignores is reported at boot, naming WithMail() (NU-114) (#616) (61b91f8)
• app: a WithoutDefaults() application reports at boot the profiler it serves unguarded and the module policy rows it discards (NU-124, NU-126) (#619) (9f8d50d)
• app: the api starter honours the storage the catalog installs, and a backend's keys say which module is missing (A11 N2) (#589) (b260cc0)
• app: the rate limit and the RBAC keys a WithoutDefaults() application ignores are reported at boot, and WithRateLimit() mounts the limiter (NU-122, NU-123) (#618) (114e470)
• app: the server-listening line is logged once the port is bound, so a client that dials on it connects (NU-115) (#615) (cff51f4)
• cli: nucleus routes and dev ignore a go.mod at the system temp root, as the go tool does (NU-109) (#611) (c082bdd)
• db: db.New warns once at startup when it opens an engine with no unique-violation classifier, as IsUniqueViolation promised (NU-118) (#612) (ead7901)
• deps: build and test with Go 1.26.9, which fixes GO-2026-6617 in net/http (#623) (1facc34)
• deps: raise the sibling module floors to nucleus v1.31.0 (#625) (e2640c5)
• health: the storage probe checks the store below tenant scoping, so a multi-tenant /healthz neither warns nor answers 503 (NU-111) (#609) (db87fc5)
• nucleustest: the kit registers SQLite's unique-violation classifier with the driver it links, so db.IsUniqueViolation answers in a test binary with no driver module (NU-117) (#608) (6328bd6)
• nucleustest: the storage helpers read below tenant scoping, and StoredFor reads a tenant's files, so a multi-tenant test neither warns nor fails (NU-119) (#613) (2e8efd4)
• router: BindJSON binds a JSON array and validates each element instead of refusing it (NU-107) (#591) (72053c1)
• tasks: a SQL scheduler leader whose renewal is late stops firing when its lease runs out (NU-116) (#617) (67e5aea)

Performance

• build: the CLI and the test-only dependencies leave the root module, and a lane holds the hello-world's size (A12 N1) (#607) (e8fc1a1)
• db: each driver module classifies its own engine's errors, so an application links only the engine it uses (A11 N3, NU-8) (#593) (4eb4b97)
• tasks: the SQL queue scales with its workers — SKIP LOCKED where the engine has it, no full-interval sleep after a lost claim, and a stop that waits for the tick before closing the database (A12 N2) (#592) (cd0bee7)