Changelog

All notable changes to Generous.nz are recorded here, grouped by version. Every deployed build has a version number, a git tag, and an entry below.

Versioning scheme

Versions follow MAJOR.MINOR.PATCH:

0.x — pre-launch. Minor bumps mark a completed build phase or major feature set; patches are bug fixes on the current build.
1.0.0 — first public launch.
1.x+ — post-launch: minor = new features, patch = fixes, major = breaking changes or significant re-architecture.

Each version is tagged in git (v0.2.0) and the current version is kept in package.json. See docs/version-control.md for how to cut a release.

HTTPS security header consolidation.

Added a one-year HSTS policy at the HTTPS reverse proxy.
Made Nginx the sole source of the public security headers, removing the duplicate and conflicting Nginx/Next.js X-Frame-Options, Referrer-Policy, and related headers.

Public release history.

Published the complete changelog at /changelog, including a clear current version panel sourced from package.json.
Added a Changelog footer link and made the footer version badge link to the public release history.

IndexNow rewrite narrowing.

Restricted the IndexNow verification rewrite to valid key formats, so it no longer intercepts robots.txt or other static text routes.

Private-route indexing controls.

Disallowed API, administration, dashboard, account, sign-in, registration, and password-reset routes in robots.txt.
Added X-Robots-Tag: noindex, nofollow, noarchive headers to those routes.
Added page-level noindex metadata to the authenticated and account layouts.

Public-page metadata improvements.

Added clean, content-specific descriptions and canonical URLs to public fundraiser, organisation, and wholesale-product pages.
Aligned wholesale-product metadata with the public-page availability rules, so unavailable deals no longer publish indexable metadata.

Public sitemap quality fix.

Added approved, active, unexpired wholesale products from approved wholesalers to the sitemap.
Excluded organisation storefronts with no approved campaigns, removing empty and duplicate wholesale-brand pages from search indexing.

IndexNow verification-file routing fix.

Run the /<key>.txt IndexNow rewrite before the custom-domain catch-all route and pass the key as a route parameter, allowing search engines to retrieve the required verification file.

Security dependency remediation.

Updated Nodemailer to 9.0.5, which resolves the high-severity raw-message file-read/SSRF advisory affecting 8.0.11.
Overrode Prisma's transitive deepmerge-ts dependency to 8.0.2, resolving its high-severity recursive-object stack-exhaustion advisory without downgrading Prisma.
Added a documented npm peer-resolution setting: Auth.js v5 beta's optional Nodemailer peer range stops at v8 even though the application and Auth.js import checks pass with the patched v9 release.