security
A test DOM that stopped loading by default
A grouped minor and patch update lands with a major version of the test DOM, which stops loading stylesheets and iframes unless it is told to.
When one DNS answer was not enough
A devcontainer firewall update replaces a point-in-time DNS assumption with published ranges for shared Google infrastructure.
A passkey with a name of its own
New passkeys now carry a device label into the authenticator, so a password manager can tell registrations apart.
An account without Google
Passkeys arrive alongside Google sign-in as an independent credential type, with an in-page modal chosen over a dedicated route and throwaway prototypes shaping the flow.
Three aliases, one posture
Fixing a mount-namespace bug that broke git worktrees across autonomous CLI aliases, dropping phantom sandboxes, and persisting workspace ownership across container rebuilds.
Primary sources behind the firewall
Opening outbound access for primary compliance documentation through the devcontainer firewall, balancing a default-deny sandbox with authoritative research.
No email required
Cross-device player accounts arrive via Google sign-in, chosen over a magic link or a sync code, plus the claim-or-discard flow, GDPR deletion, and the review findings that shaped the implementation.
The first thing it caught
Client-side error monitoring finally gives the solo maintainer visibility into what breaks in players' browsers, and catches a real bug within hours of shipping.
Healthy before active
Turning shared MCP servers into reviewed, age-gated installations that only become active after a real protocol handshake.
Minimum release age gate for developer CLI auto-updates
A supply-chain mitigation that delays devcontainer CLI updates until they are at least three days old.