Changelog (docs)

2026-09-16 follow-up

• Real notification-test preparation found a second historical schema mismatch in notification_logs. Added an idempotent migration and canonical schema for both old table layouts, with real PostgreSQL tests. Audit failures no longer turn accepted pushes into failed sends or stop remaining devices; logFailures is separate.
• Crypto icons resolve against the bundled asset list before loading. Missing symbols and unbundled variants use the existing generic/color assets without repeated 404s; fallback image failures no longer loop. Update crypto-icon-assets.json when adding assets.
• Chinese documentation search now uses @orama/tokenizers/mandarin for both indexing and queries. English search remains separate. Search initialization errors return 500 instead of a false empty result.
• Removed the wallet direct-address and signature-failure login fallbacks. SIWE requires a valid signature, this site's domain/URI, a current signed Auth.js CSRF nonce, and a recent issued-at timestamp. Old wallet sessions must reauthenticate; database failures cannot mint fallback identities. Credential/signature/OAuth token payloads are no longer logged.
• Removed unused Web3Modal/Wagmi dependencies and their unreferenced configuration. The previously disabled wallet connector UI remains disabled; email/Google auth remains available.
• BlockBeats is explicitly disabled by default, reported in disabled_sources rather than repeatedly queried as a failed feed. PANews, TechFlow, Decrypt and Cointelegraph remain active.
• Upgraded compatible security fixes. Production dependency audit now has zero moderate advisories. The two image-size high findings are covered by the pinned local patch; five low findings remain in the legacy AI SDK used by template demo endpoints, which now return 404 in production.
• Disabled template AI/email demo endpoints in production. An unconfigured payment gateway returns 503 before creating an order. Payment transport and Web Push regression tests use mocks and never send real payments or notifications.
• Corrected module listing to retain empty modules and honor saved sorting; deletion now reports missing/unowned rows accurately and removes relations transactionally. Added isolated database persistence/ownership tests.
• Removed eight duplicate index declarations that conflicted with existing column uniqueness constraints and prevented a clean database installation. Column uniqueness is retained; no production data or indexes need to be removed.

2026-09-16

• Production browser verification found Cloudflare email obfuscation rewriting legal and documentation pages before React hydration. These responses now send no-transform; /sw.js bypasses locale routing and sends no-store so worker updates stay current.
• News cron: bounded RSS requests, partial-source isolation, truthful failure statuses, database advisory locks, batched inserts, and reminders after the HTTP response.
• Added an idempotent migration for the legacy Binance event schema and unique news links.
• Added direct Decrypt and Cointelegraph English feeds. BlockBeats empty responses were initially marked degraded; the follow-up above explicitly disables this source by default.
• Protected duplicate-event cleanup with cron authorization and bounded Web Push requests.
• Restored server-rendered public content by removing the disabled wallet SDK loading gate.
• SEO: one metadata authority, correct default-language canonicals and alternates, bilingual sitemap entries, no indexing of private workspaces, crawlable Next assets, and removal of unsupported structured-data ratings.
• Service worker now caches only local static assets; sessions, API payloads, HTML and RSC are never persisted. Language preferences are written in the browser so /en stays cacheable.
• Next.js 15.5.25 / Node.js 22 / pnpm 10.34.5; notification DB connections initialize on use, allowing builds without production secrets. CI validates builds; production deploys from Leo202403/link-nest:master through the existing Dokploy GitHub integration.
• Patched available critical/high dependency advisories, including Next.js, Auth.js, Drizzle, Nodemailer and transitive packages. Two high image-size@2.0.2 parser advisories have no upstream fix at review time and are covered by the locally pinned parser patch with malformed-image regression tests. Its use is in the repository MDX image build plugin.

2026-04

• Docs search: createFromSource now sets localeMap (zh/en → English Orama stemmer) so i18n index build no longer throws LANGUAGE_NOT_SUPPORTED for Chinese; status README blocker text updated.
• Lint / deps: eslint-config-next moved to devDependencies; admin presets / profile-stats / debug-modules and profile + [locale]/u/[shortId] pages cleaned for unused imports/dead code and stricter types.
• i18n / ops: i18n/request.ts fallbacks use routing.defaultLocale (not hardcoded zh); middleware sign-in / double-locale logs are dev-only (no full URL in prod); /u/[username] layout reads user-language-preference cookie then defaultLocale; ESLint added as devDependency so pnpm lint runs.
• Stability: Docs search GET /api/docs/search returns 500 on real failures (only empty hits for known unsupported-language errors); status README blocker text aligned with English-index behavior; architecture overview Web3 row uses NEXT_PUBLIC_WEB3_ENABLED (+ optional WEB3_ENABLED); profile UnifiedModulesDisplay reminder locale follows next-intl; Fumadocs docs layout uses explicit zh translations.
• Fumadocs: Fixed MDX body rendering in src/app/[locale]/(docs)/docs/[[...slug]]/page.tsx (use compiled page.data.body).
• Three layers: Entry (content/docs/index.mdx), Blueprint (architecture/index + architecture/*), Evolution (status/README.mdx + changelog).
• i18n: Loader languages en + zh for docs pages.