What nhost/nhost shipped
Written by FoxPlug from public releases; not affiliated with Nhost. An automatic summary of the public release, pull request and commit data of github.com/nhost/nhost. Nhost did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Functions now pin npm 11 in the shared dependency installer to prevent execution of untrusted code during deploy when using file: or git dependencies. Pull request #5014
- Dashboard permission editing no longer unintentionally broadens access when modifying compound permissions. Pull request #5062
- Auth 0.52.1-beta1 released with AUTH_SMS_PASSWORDLESS_ENABLED renamed to AUTH_OTP_SMS_ENABLED for general use. Release
- PostgreSQL updated to 17.11. Pull request #5070
- Nix flake now validates the overlay it publishes to prevent unintended exports from shadowing nixpkgs toolchains. Pull request #5069
- Old PostgreSQL versions have been restored. Pull request #5066
- Dashboard tests now use jsdom's native PointerEvent instead of mocks. Pull request #5068
- CI configuration updated to allow dependabot to trigger builds. Pull request #5055
Why it matters
Security improvements in function deployments prevent unintended code execution, dashboard fixes prevent accidental permission escalation, and infrastructure updates bring better stability and tooling validation.
Changelog entry
- Functions: pin npm 11 in shared dependency installer to prevent untrusted code execution during deploy Pull request #5014
- Dashboard: fix permission editing to prevent unintended access broadening Pull request #5062
- Auth: 0.52.1-beta1 released with AUTH_OTP_SMS_ENABLED variable renaming Release
- PostgreSQL updated to 17.11 Pull request #5070
- Nix: validate overlay exports and remove deprecated stdenv checks Pull request #5069
- Restore old PostgreSQL versions Pull request #5066
- Dashboard: use jsdom native PointerEvent in tests Pull request #5068
This week: npm 11 pinning prevents untrusted code execution in functions, permission editing fixes prevent unintended access broadening, and Nix validation hardens overlay exports.
This week's updates focus on security and reliability. Function deployments now pin npm 11 to prevent untrusted code execution when using file or git dependencies. Dashboard permission editing has been fixed to prevent unintentional access broadening. Infrastructure improvements include PostgreSQL 17.11 support, Nix flake overlay validation, and better CI automation with dependabot integration.
Week of September 14, 2026
What shipped
- MCP service version 0.3.0 released with unauthenticated /healthz endpoint for probes and publication to the official MCP Registry [1]. Release
- PostgreSQL upgraded to 18.6 with support for versions 16 and 17 dropped [16]. Pull request #5020
- Auth version 0.52.0 released with generic SMS support, SMS deanonymization, and phone number change capabilities [25]. Release
- Dashboard project settings sidebar redesigned with docked layout and independent scrolling content [3]. Pull request #4993
- Dashboard Events page migrated to new layout pattern [5]. Pull request #4965
- Auth settings migrated to new dashboard layout with dedicated Auth settings route [12]. Pull request #4933
- Functions development runtime image fixed to include glibc dynamic loader for dynamically linked ELF binaries [23]. Pull request #5006
- Constellation fixed to resolve
foreign_key_constraint_onrelationships against the exact constraint [0]. Pull request #5028 - Sign-in page now displays a LAST USED badge on the sign-in method used previously [29]. Pull request #4984
- CI pipeline enhanced with betterleaks secret scanning on pull requests [21]. Pull request #4962
Why it matters
This week brought significant upgrades to core infrastructure with PostgreSQL 18.6 and continued dashboard modernization across multiple settings sections. Auth gained SMS capabilities and the development experience improved with fixes to functions runtime and constraint resolution.
Changelog entry
- mcp@0.3.0: Added unauthenticated /healthz endpoint for probes, published MCP service to official MCP Registry Release
- PostgreSQL: Upgraded to 18.6, dropped support for versions 16 and 17 Pull request #5020
- PostgreSQL CI: Retired version 16 and 17 image jobs Pull request #5021
- auth@0.52.0: Added generic SMS support, SMS deanonymization, and phone number changes Release
- functions@2.3.0: Fixed Yarn Classic pinning, normalized dependency installation, added chokidar polling for hot-reload Release
- functions@2.3.1: Added glibc dynamic loader to dev runtime image Release
- cli@1.51.1: Released with reference updates and provenance check fixes Release
- Dashboard: Project settings sidebar now docked with independent scrolling content Pull request #4993
- Dashboard: Auth settings migrated to new layout with dedicated route Pull request #4933
- Dashboard: GraphQL settings migrated to new layout Pull request #4932
- Dashboard: Storage settings migrated to new layout Pull request #4934
- Dashboard: Functions settings migrated to new layout Pull request #4935
- Dashboard: Run settings migrated to new layout Pull request #4936
- Dashboard: Deployments settings migrated to new layout Pull request #4937
- Dashboard: Metrics settings migrated to new layout Pull request #4938
- Dashboard: Events page migrated to new layout Pull request #4965
- Dashboard: AI pages migrated to new layout Pull request #4964
- Dashboard: Sign-in page shows LAST USED badge for previously used sign-in method Pull request #4984
- Constellation: Fixed
foreign_key_constraint_onresolution against exact constraint Pull request #5028 - Dashboard: Fixed unscheduled deployments hiding live deployment Pull request #5023
Week 32: MCP 0.3.0 published, PostgreSQL 18.6 upgrade, auth gains SMS features, dashboard settings redesigned, and secret scanning added to CI.
This week's updates focus on infrastructure and developer experience. PostgreSQL upgraded to 18.6, MCP service published to official registry, auth adds SMS deanonymization and phone number changes, dashboard continues modernization with docked settings sidebar, and CI gains automated secret scanning. Functions runtime fixed for dynamically linked binaries.