Ridu v0.5.0

Ridu 0.5.0 adds a GraphQL playground to the admin and makes hooks, filters and upgrades simpler to write and easier to understand. Hooks can refuse an operation with a message editors see, unique values report which field conflicted, duplicated documents get a free slug, and ridu upgrade moves a project to a new release in one command. The CMS still builds into one Go binary with its static admin embedded.

Try Ridu

Install Go 1.25.13 or newer, Node.js 24 and Bun 1.4.0, then run:

bun create ridu@0.5.0 my-ridu-app
cd my-ridu-app
bun install
bun run dev

Choose SQLite for a local trial without a separate database service. See the quickstart and deployment guide.

What changed

• Applications that use the GraphQL plugin get a playground at /admin/graphql, from the new @riducms/plugin-graphql admin package. Admins get schema-aware autocompletion and validation, run operations under the current admin access rules, and browse the schema in a docs panel. The schema reaches the playground through the admin loader boundary instead of enabling GraphQL endpoint introspection. The editor loads only when the page opens.
• ridu.Reject(message, issues...) lets a collection, global, or field hook refuse an operation with a message for the editor. The admin shows the message and marks any fields named by the issues; REST, the SDK, and the Local API return a new rejected error (HTTP 422). Other hook errors are still reported as internal errors whose messages stay on the server.
• Saving a value that another document already uses in a .Unique() field, including every field.Slug, now fails with a unique issue on that field instead of a generic conflict.
• Duplicating a document gives a copied slug the next free value, such as about-us-copy, instead of failing on the unique slug.
• ridu upgrade <version> rewrites every @riducms/* pin, official plugin and the Go module requirement, installs dependencies, and runs the new CLI's generate, agent sync and migrate create.
• query.Field("price") names a field in filters written in code without an error check, and query.And, query.Or and query.Not return an expression directly.
• Field transforms return operation.Set(value) or operation.Clear[T]().
• Field hooks now receive the saved document's ID once a create or duplicate is stored, including in AfterCommit; a duplicate's hooks see the copy, not the original.
• ridu migrate reads RIDU_ALLOW_INSECURE_DATABASE like the generated server, so a local .env works for both.
• The SvelteKit server client uses SvelteKit's event.fetch by default, as SvelteKit recommends for server code. The client still sends its token in a header and never forwards the web app's cookies.
• ridu generate, ridu check, ridu build and ridu dev warn with an install command when a registered plugin's admin package is missing from the admin workspace.
• ridu.RootHooks is available from the ridu package, so application-wide hooks no longer import core.
• The hooks, operation and query guides document every hook and type with its own example.
• Admin updates submit only edited fields, preserving protected unchanged values, keyed row order and membership, and complete content when an edited locale fallback becomes a new translation.

Breaking changes and upgrading from 0.4.x

Run the new CLI's upgrade command from the project root, then review and commit the result:

bunx @riducms/cli@0.5.0 upgrade 0.5.0

It creates one migration, ridu-0-5-0. Manifests no longer record plugin package versions, so this migration contains only a schema assertion; later plugin or framework upgrades do not need a migration unless the schema changes.

GraphQL

The GraphQL plugin now pairs with an admin package. Install it in the admin workspace:

bun add --cwd admin @riducms/plugin-graphql@0.5.0

To keep GraphQL without the playground, set graphqlplugin.Options{DisablePlayground: true} instead.

Hooks

• BeforeValidate now runs only for create, duplicate, update, publish and unpublish, and no longer for reads, deletes or restores.
• AfterCommit no longer runs after reads. It still runs after deletes and restores. Remove read guards such as if ctx.Operation == operation.Read { return nil } from after-commit hooks if you like; they are now unnecessary.
• BeforeOperation and AfterOperation still run for every operation.

Go API

• Replace operation.Replace(operation.Present(value)) with operation.Set(value) and operation.Replace(operation.Empty[T]()) with operation.Clear[T](). operation.Replace has been removed.
• query.And, query.Or and query.Not return query.Expression without an error. With one condition, And and Or return that condition; they panic when given no conditions or a nil one, like the comparison helpers. Check the length of a list built from input before calling them.
• Use query.Field(...) for field names written in code; query.NewPath and query.ParsePath still return errors for paths from input.

Errors

• A unique conflict on a .Unique() field returns validation (HTTP 422) with a unique issue instead of conflict (HTTP 409). Revision and other conflicts still return conflict.
• Add rejected to any exhaustive handling of Ridu error codes.

Data and deployment

Update the Go module, CLI, all framework npm packages and official plugins together to 0.5.0.
Regenerate application contracts, review the generated migration plan, and rebuild the embedded
admin and Go binary. This release does not introduce a new database migration encoding or rewrite
historical artifacts. Back up database and upload storage together and rehearse the upgrade against
a restored copy before directing production traffic to it.

SQLite remains qualified for a local file on one host. PostgreSQL retains its networked,
multi-replica operating model. MongoDB retains its documented authenticated replica-set, TLS and
Linux x86-64 qualification limits. The GraphQL playground adds static admin assets and does not
add a JavaScript server to the CMS runtime.