Issues

• cli: the dev loop moves the committed migrations/app/refs/db.json, breaking every documented pnpm migrate after the first

  needs-triage
  OpenSaasAU/stack#1832 · Filter by author borisno2 opened on Oct 10, 2026

• cli: opensaas dev reconciles the Dev database while the app silently runs against DATABASE_URL from .env.local

  needs-triage
  OpenSaasAU/stack#1831 · Filter by author borisno2 opened on Oct 10, 2026

• Release: no 0.43 → 0.44 upgrade guide, and the generated CHANGELOG will contradict itself (superseded changesets)

  needs-triage
  OpenSaasAU/stack#1827 · Filter by author borisno2 opened on Oct 10, 2026

• auth/MCP: createBetterAuthMcpAdapter checks DPoP proofs against a synthetic POST <resource>, rejecting valid proofs on GET/DELETE

  needs-triage
  OpenSaasAU/stack#1823 · Filter by author borisno2 opened on Oct 10, 2026

• auth: default email senders log password-reset and verification URLs (bearer tokens) to stdout, including in production

  needs-triage
  OpenSaasAU/stack#1822 · Filter by author borisno2 opened on Oct 10, 2026

• auth/MCP: a client_credentials (no-user) token is mapped to a signed-in session with userId = client_id

  needs-triage
  OpenSaasAU/stack#1821 · Filter by author borisno2 opened on Oct 10, 2026

• core: removeRelated with parentId confirms (and clears) a link to a row the session cannot see

  needs-triage
  OpenSaasAU/stack#1818 · Filter by author borisno2 opened on Oct 10, 2026

• core: relationship picker fails entirely when the session cannot read the related list's label field

  ready-for-agent
  OpenSaasAU/stack#1817 · Filter by author borisno2 opened on Oct 10, 2026
  

• templates: starter-auth/with-auth let any signed-in user author posts as, reassign posts to, and plant notes for another user

  needs-triage
  OpenSaasAU/stack#1816 · Filter by author borisno2 opened on Oct 10, 2026

• core: NOT: [a, b] lowers to NOT(a AND b), widening access filters written the Prisma/Keystone way

  needs-triage
  OpenSaasAU/stack#1813 · Filter by author borisno2 opened on Oct 10, 2026

• core: checkbox() without defaultValue is NOT NULL with no default, but its schema lets callers omit it, so creates fail with a database error

  needs-triage
  OpenSaasAU/stack#1810 · Filter by author borisno2 opened on Oct 10, 2026

• MCP: 401 challenge carries no resource_metadata and mcp-demo has no OAuth discovery routes

  needs-triage
  OpenSaasAU/stack#1809 · Filter by author borisno2 opened on Oct 10, 2026

• mcp-demo: any signed-in user can create or reassign a post under another user's name

  ready-for-agent
  OpenSaasAU/stack#1807 · Filter by author borisno2 opened on Oct 10, 2026
  

• MCP: custom tools with no declared scopes need no OAuth scope, so a read-only token can run write tools (mcp-demo publishPost/unpublishPost)

  needs-triage
  OpenSaasAU/stack#1805 · Filter by author borisno2 opened on Oct 10, 2026

• core: update/delete access check races the write — the ORM drops the Access Filter from the UPDATE/DELETE statement

  needs-triage
  OpenSaasAU/stack#1803 · Filter by author borisno2 opened on Oct 10, 2026

• rag: searchable() over a non-string source (richText/json) never embeds and never warns

  needs-triage
  OpenSaasAU/stack#1800 · Filter by author borisno2 opened on Oct 10, 2026

• storage: multi-column image() with transformations uploads variants it never records, orphaning them

  needs-triage
  OpenSaasAU/stack#1798 · Filter by author borisno2 opened on Oct 10, 2026

• storage: active-content upload refusal is a blocklist that +xml MIME types bypass (stored XSS when served same-origin)

  needs-triage
  OpenSaasAU/stack#1797 · Filter by author borisno2 opened on Oct 10, 2026

• Release gate: move off Prisma 8 RC to stable Prisma 8 before publishing the rebuild

  needs-triage
  OpenSaasAU/stack#1794 · Filter by author borisno2 opened on Oct 10, 2026