0.2.18

Three fixes, one of which stops generated projects from starting — upgrade if you generated anything since 28 July 2026.

Generated apps with pagination would not start (#136)

fastapi-pagination 0.15.16, released 28 July, is incompatible with every FastAPI below 0.140.5 — which this template's pin (fastapi>=0.135.3,<0.137) guarantees. Its ImportError fallback binds FastAPI's public get_body_field but still flags the new signature, so add_pagination(app) passes a body_params kwarg that version does not accept and app.main raises TypeError on import. Nothing in the generated code was wrong. Pinned fastapi-pagination<0.15.16.

Also in that PR: deepagents 0.7 dropped the runtime argument from StateBackend.__init__ and switched create_deep_agent to take a backend instance instead of a factory, so the DeepAgents build failed type checking and would have raised at the first agent call; and RedisClient.get no longer leans on a type: ignore that had stopped applying.

Docker deployments only worked on localhost (#135, reported in #132)

Reaching a Docker Compose deployment from anything other than the Docker host gave a dead chat page — input disabled, status "Offline", /api/auth/me looping on 401. Two independent causes:

• NEXT_PUBLIC_* is inlined at build time, and the frontend service in docker-compose.prod.yml passed no build: args at all, so images baked ws://localhost:8000 and every visitor's browser dialled its own machine. Both compose files now pass the full set as build args — https://api.${DOMAIN} / wss://api.${DOMAIN} behind a proxy, ${PUBLIC_HOST} with published ports otherwise — each overridable per variable.
• The auth cookies were Secure whenever NODE_ENV=production, and browsers discard a Secure cookie delivered over http://. On a LAN IP login appeared to succeed and then every request 401'd, so the token never refreshed. New COOKIE_SECURE: unset follows NODE_ENV, false opts an HTTP deployment out, an unrecognized value keeps the safe default.

Plus: nginx set the WebSocket Upgrade headers on /ws while the endpoints live under /api/v1/ws; BACKEND_WS_URL was documented in five places and read in none (removed, with NEXT_PUBLIC_AUTH_ENABLED); the white-label brand vars had the same missing-build-arg gap; and the generated docs/deploy.md gained a "Serving from a host that isn't localhost" section, since neither failure names its own cause.

Upgrading

NEXT_PUBLIC_* values only change on a fresh image:

docker compose -f docker-compose.prod.yml build --no-cache frontend

Serving over plain HTTP on a trusted network additionally needs COOKIE_SECURE=false — TLS is the better answer.

Full changelog: https://github.com/vstorm-co/full-stack-ai-agent-template/blob/main/CHANGELOG.md