Changelog

All notable changes to Generous.nz are recorded here, grouped by version. Every deployed build has a version number, a git tag, and an entry below.

Versioning scheme

Versions follow MAJOR.MINOR.PATCH:

0.x — pre-launch. Minor bumps mark a completed build phase or major feature set; patches are bug fixes on the current build.
1.0.0 — first public launch.
1.x+ — post-launch: minor = new features, patch = fixes, major = breaking changes or significant re-architecture.

Each version is tagged in git (v0.2.0) and the current version is kept in package.json. See docs/version-control.md for how to cut a release.

Public-page metadata improvements.

Added clean, content-specific descriptions and canonical URLs to public fundraiser, organisation, and wholesale-product pages.
Aligned wholesale-product metadata with the public-page availability rules, so unavailable deals no longer publish indexable metadata.

Public sitemap quality fix.

Added approved, active, unexpired wholesale products from approved wholesalers to the sitemap.
Excluded organisation storefronts with no approved campaigns, removing empty and duplicate wholesale-brand pages from search indexing.

IndexNow verification-file routing fix.

Run the /<key>.txt IndexNow rewrite before the custom-domain catch-all route and pass the key as a route parameter, allowing search engines to retrieve the required verification file.

Security dependency remediation.

Updated Nodemailer to 9.0.5, which resolves the high-severity raw-message file-read/SSRF advisory affecting 8.0.11.
Overrode Prisma's transitive deepmerge-ts dependency to 8.0.2, resolving its high-severity recursive-object stack-exhaustion advisory without downgrading Prisma.
Added a documented npm peer-resolution setting: Auth.js v5 beta's optional Nodemailer peer range stops at v8 even though the application and Auth.js import checks pass with the patched v9 release.

AI handoff document refresh.

docs/AI-HANDOFF.md updated to current state (v0.9.133): Stripe Connect activated, webhooks fixed, DeepSeek key valid, background AI moderation for all content types, fundraiser/wholesale go-live checklists, automatic fundraiser submission, service worker stale-code fix, and updated known issues and next steps.

Fix stale cached code after deploys.

The service worker previously served cached JavaScript "stale-while- revalidate", so browsers could keep running old page code after a deploy (which is why an unchanged error message appeared even though the footer showed the new version). Static assets are now network-first with the cache used only as an offline fallback, so visitors always get the latest code after a deploy.

Reliable wholesale product saves.

Background AI reviews now run fire-and-forget instead of via the after hook, removing any chance the response is delayed or interrupted by the review infrastructure.
The wholesale product form now reports the actual HTTP status if a save fails (e.g. "Something went wrong (500)") and gives up after 30 seconds instead of hanging, so future errors are immediately diagnosable.

Fundraiser go-live checklist.

New "Go-live checklist" page for fundraiser accounts, mirroring the wholesale one: connect Stripe payout, add platform fee card, create a fundraiser, get it approved, keep it active, and list a first product. Done items show a tick with strikethrough; each item links to where it's done.
An amber banner appears at the top of the fundraiser dashboard while the checklist is incomplete, with a link to the checklist. The sidebar link disappears once everything is complete.
The payment prerequisites (payout account + fee card) are the hard gate — until both are done, donations and orders are blocked.