Changelog

All notable changes to Generous.nz are recorded here, grouped by version. Every deployed build has a version number, a git tag, and an entry below.

Versioning scheme

Versions follow MAJOR.MINOR.PATCH:

0.x — pre-launch. Minor bumps mark a completed build phase or major feature set; patches are bug fixes on the current build.
1.0.0 — first public launch.
1.x+ — post-launch: minor = new features, patch = fixes, major = breaking changes or significant re-architecture.

Each version is tagged in git (v0.2.0) and the current version is kept in package.json. See docs/version-control.md for how to cut a release.

Go-live documentation refresh.

Updated the go-live plan to v0.9.146 and the complete migration range (0001–0043), and aligned email, backup, and integrations guidance with the live platform.

Integration setup visibility.

Added Admin → Integrations with live, non-secret readiness indicators and production setup instructions for Google login, Apple login, and web push.

Production log hygiene.

Suppressed only Auth.js's acknowledged experimental-webauthn notice; passkeys remain enabled and all other authentication warnings and errors continue to be logged.

Footer accessibility and asset optimisation.

Raised footer and footer-link contrast to accessible dark ink colours.
Replaced the 133 KB AdvertiseOnline PNG with a 7 KB, appropriately sized WebP logo and added intrinsic image dimensions to prevent layout shift.

HTTPS security header consolidation.

Added a one-year HSTS policy at the HTTPS reverse proxy.
Made Nginx the sole source of the public security headers, removing the duplicate and conflicting Nginx/Next.js X-Frame-Options, Referrer-Policy, and related headers.

Public release history.

Published the complete changelog at /changelog, including a clear current version panel sourced from package.json.
Added a Changelog footer link and made the footer version badge link to the public release history.

IndexNow rewrite narrowing.

Restricted the IndexNow verification rewrite to valid key formats, so it no longer intercepts robots.txt or other static text routes.

Private-route indexing controls.

Disallowed API, administration, dashboard, account, sign-in, registration, and password-reset routes in robots.txt.
Added X-Robots-Tag: noindex, nofollow, noarchive headers to those routes.
Added page-level noindex metadata to the authenticated and account layouts.