Repository navigation
The Boring Stack 1.6.0
The Boring Stack 1.6.0
The Boring Stack 1.6.0 gives every starter a complete Klean UI redesign, adds Inertia DevTools support through inertia-sails@1.6.0, and refreshes dependencies across the Vue, React, and Svelte templates.
This release builds on 1.5.0's Inertia v3, selective SSR, Precognition, and development error handling. It focuses on the experience developers see when they create an application—and the tools they use while building it.
Five templates, 71 redesigned pages
The redesign covers every existing page in:
- Mellow Vue: 11 pages
- Mellow React: 11 pages
- Mellow Svelte: 11 pages
- Ascent Vue: 19 pages
- Ascent React: 19 pages
Mellow combines warm off-white surfaces, violet actions, restrained serif headings, and straightforward forms. Its landing page, authentication and recovery screens, dashboard, profile, and error pages share one coherent design.
Ascent uses neutral surfaces, teal actions, and consistent light/dark styling. Its design extends through the landing page, features, pricing, blog, contact, authentication, two-factor sign-in, dashboard, profile, security, team management, billing, invitations, and error pages.
Layouts use clearer headings, quieter surfaces, fewer heavy shadows, and simpler sections. Decorative eyebrow labels, section numbering, oversized branding, and marketing gradients have been removed. Mobile public navigation, authenticated navigation, menus, dialogs, and form feedback received attention alongside desktop layouts.
Klean UI and Klean Icons, owned by your application
All five templates now use Klean UI and Klean Icons for applicable controls and interactions. The component source lives in the application under assets/js/components/ui/; it is editable code, not a Klean runtime or provider dependency.
Tailwind classes at the call site control component appearance. Application-level recipes in assets/css/app.css provide the shared typography, palette, spacing, and layout conventions. Each template's UI.md documents its component inventory, customization approach, and source-update workflow.
The templates demonstrate Klean in real forms, navigation, menus, dialogs, notifications, and upload controls rather than adding a separate component showcase.
Inertia DevTools in inertia-sails 1.6.0
The adapter now implements the Inertia v3 DevTools protocol. Install the official browser extension and use an Inertia client adapter version 3.6 or newer. Initial page loads and subsequent Inertia visits are discovered automatically; an extra DevTools script tag is not required in your root view.
The implementation includes request recording, prop classification, source-location metadata, credential redaction, and a bounded entry repository. Recording defaults to the Sails development environment.
Default storage behavior:
- Entries are stored under
.tmp/inertia-devtools. - Entries expire after 24 hours.
- History is limited to 100 entries per browser tab.
- The entry and entry-list endpoints use the same authorization rules.
Configuration is available through config/inertia.js:
module.exports.inertia = {
devtools: {
enabled: null, // development only by default
storage: {
ttl: 24,
limit: 100
}
}
}Enabling DevTools outside development requires an explicit request authorizer. Common credential fields and security headers are redacted by default. Custom redact.keys or redact.headers arrays replace their respective defaults, so preserve the sensitive names your application needs protected.
More durable interactions
Ascent's pricing selection is represented in the URL with ?cycle=monthly or ?cycle=yearly, so the choice survives refresh. Its stored theme preference is applied before styles and hydration to improve initial rendering.
Existing non-sensitive contact drafts, navigation preferences, and login-mode behavior remain part of the application experience. Passwords and verification codes are not persisted by these UI preferences.
Responsive checks cover narrow, tablet, and wide viewports. Existing tests exercise menu/dialog dismissal, focus return, validation, notifications, uploads, recovery, and account flows alongside the redesigned layouts.
Framework and build updates
Templates have been refreshed to current compatible dependency versions, including:
- Sails 1.5.18
- inertia-sails 1.6.0
- Inertia client adapters 3.7
- Shipwright 1.5.1 and the Rsbuild 2.2 toolchain
- Nodemailer 10.0.3
- Tailwind CSS 4.3
- Playwright 1.63
Vue, React, Svelte, and related framework plugins are updated within their supported version lines. The Svelte Tailwind formatter plugin was updated to retain compatibility with the refreshed Prettier version.
The template Node requirement remains ^20.19.0 || >=22.12.0, which also satisfies Nodemailer 10's Node 20 minimum.
Dependency audit reductions, with remaining work stated plainly
Full npm audit results from the dependency refresh, measured September 10, 2026 and including development dependencies:
| Template | Before | After |
|---|---|---|
| Mellow Vue | 40 | 0 |
| Mellow React | 32 | 0 |
| Mellow Svelte | 40 | 0 |
| Ascent Vue | 47 | 9 |
| Ascent React | 46 | 9 |
No critical findings remained in that audit. Each Ascent template still reported three high, five moderate, and one low finding inherited through:
sails-hook-uploads→b64/hoeksails-hook-content→plugin-sails-content/showdownskipper-s3→ AWS SDK v2 /uuid
These require upstream patches or tested replacements, including migration away from AWS SDK v2. They are not suppressed or represented as fixed. Counts describe dependency findings, not distinct exploitable application vulnerabilities, and can change as new advisories are published.
Targeted overrides retain patched qs and body-parser versions where upstream dependencies still pin older releases. The affected Mellow development CLI helper uses patched trim-newlines; Ascent's S3 adapter uses the newer AWS SDK within v2 to preserve its existing API. Template READMEs explain these decisions and when to revisit them.
See the remediation record in #112.
Fixes and validation improvements
- Extended Precognition coverage to the remaining templates.
- Completed template password-reset redirects.
- Corrected Mellow's expired-link page path.
- Fixed Ascent's shareable team-invitation lookup with the SQLite adapter while preserving disabled-link rejection.
- Added browser coverage for public/account layouts, recovery and invitation states, billing-cycle persistence, mobile navigation, and two-factor sign-in.
- Refreshed template README guidance, page inventories, customization notes, and preview screenshots.
The release work passed the adapter's type checks and 102 tests, plus the templates' 100 tests, lint checks, fresh installs, and production smoke checks. Local SMTP/MIME checks passed across all five templates, and local S3 adapter listing/read checks passed for both Ascent templates.
Getting started and upgrading
Create an application:
npm create sails@latestThe published CLI downloads templates from main. The release tag captures this release's source; it does not pin future CLI downloads to that snapshot. create-sails, create-sails-generator, and rsbuild-plugin-inertia do not need new npm releases for these template changes.
Upgrade the adapter in an existing application:
npm install inertia-sails@^1.6.0Use an Inertia client adapter at 3.6 or newer for DevTools. The shipped templates use 3.7.
Updating npm dependencies does not replace an existing application's pages, layouts, styles, or copied Klean components. Port the source changes you want, preserve your application's behavior, and follow the template's UI.md update guidance. Keep the documented security overrides until upstream constraints include the patched releases.
Run your application's tests, production build, and key auth/account flows after upgrading.
Not included
The proposed multiple-file upload helper in #122 remains separate. The shipped avatar and team-logo forms use single-file inputs; the reported multiple-file encoding mismatch should be reproduced against current dependencies before selecting a fix.