Release v12.0.0 · alltuner/vibetuner

12.0.0 (2026-06-30)

htmx: htmx 4 server-side support — own request detection, drop dead response helpers (#2073)
security: Apps running with environment=prod now refuse to start if SESSION_KEY is still a known placeholder (old ct-!secret-must-change-me or new CHANGE_ME_RUN_vibetuner_crypto_generate). Set a unique SESSION_KEY (vibetuner crypto generate-key) before deploying. Auth endpoints (magic-link send, OAuth init) are now rate-limited to 5/minute per IP by default; tune via RATE_LIMIT_AUTH_LIMITS. See the v11->v12 upgrade guide (#2034).

api: export sse_endpoint, broadcast, create_crud_routes, require_htmx from the top-level package (#2021) (f8a1511)
htmx: htmx 4 server-side support — own request detection, drop dead response helpers (#2073) (e7812da)
ship a safe .worktreeinclude for worktree-based dev (#2064) (622000b)
targeted cache invalidation for vary'd keys and O(variants) pattern invalidation (#2009) (5d7a813)

cli: preserve scaffold error tracebacks and surface template-task execution (#2068) (bf567a7)
deps: update dependency htmx.org to v4.0.0-beta5 (#2062) (fd2d43c)
docker: run runtime image as non-root and add a HEALTHCHECK (#2019) (7a39121)
docker: run scaffolded template image as non-root with a HEALTHCHECK (#2067) (9602507)
htmx: don't swap 4xx/5xx error bodies into fragment targets (#2079) (d68c70b)
release: track scaffolded @alltuner/vibetuner pin in release-please extra-files (#2071) (ee48d32)
render future datetimes as "in N <unit>" in timeago filter (#2008) (593ad53)
rendering: log and narrow exception handling in date/timeago filters (#2074) (b20237e)
scope dprint yaml linting to non-gitignored project files (#2007) (1cbb86c)
security: allow enabled OAuth providers' avatar hosts in default CSP img-src (#2072) (4c0adec)
security: validate post-auth redirects, fail closed on default session key, rate-limit auth endpoints (#2020) (9f9b80c)
sse: log and back off when the Redis listener loses its connection (#2069) (d6a07f7)
worker: derive stream_timeout/max_idle_time from idle_timeout to prevent premature connection closure (#2070) (4b4010d)

deps: bump @alltuner/vibetuner from 10.22.4 to 11.1.0 in /vibetuner-template (#2039) (069d35f)
deps: bump aiohttp from 3.14.0 to 3.14.1 (#2053) (217255b)
deps: bump aiohttp from 3.14.0 to 3.14.1 in /vibetuner-py (#2054) (e5eb5ab)
deps: bump cloudflare from 5.2.0 to 5.3.0 (#2049) (b2e1f5f)
deps: bump cryptography from 48.0.0 to 49.0.0 (#2044) (b508f66)
deps: bump cryptography from 48.0.0 to 49.0.0 in /vibetuner-py (#2050) (f1ece7e)
deps: bump djlint from 1.39.0 to 1.39.2 in /vibetuner-py (#2048) (1d3f749)
deps: bump mailjet-rest from 1.6.0 to 1.7.0 (#2042) (f466fcd)
deps: bump mailjet-rest from 1.6.0 to 1.7.0 in /vibetuner-py (#2043) (765b1f8)
deps: bump pydantic-settings from 2.14.1 to 2.14.2 (#2058) (b2acde1)
deps: bump pydantic-settings from 2.14.1 to 2.14.2 in /vibetuner-py (#2057) (9ed083c)
deps: bump pytest from 9.0.3 to 9.1.0 in /vibetuner-py (#2045) (633506b)
deps: bump pytest from 9.0.3 to 9.1.1 (#2047) (ca6ff43)
deps: bump rumdl from 0.2.9 to 0.2.16 in /vibetuner-py (#2041) (238e12a)
deps: bump slowapi from 0.1.9 to 0.1.10 (#2052) (2f35e3c)
deps: sync vibetuner-py/uv.lock with bumped pytest floor (#2066) (d199d2c)
deps: update actions/checkout action to v7 (#2056) (eadaeb5)
deps: update anthropics/claude-code-action action to v1.0.159 (#2036) (94f70a3)
deps: update mongo docker tag to v8.3.4 (#2038) (c9241e5)

add framework upgrade workflow, v11 background-tasks migration callout, and troubleshooting page (#2076) (f33e1a6)
add v11 to v12 upgrade guide (#2034) (a6e3ccc)
htmx: document htmx 4 attribute-inheritance removal in migration guide and agent rules (#2075) (7b3707a)