Changelog

All notable changes to Generous.nz are recorded here, grouped by version. Every deployed build has a version number, a git tag, and an entry below.

Versioning scheme

Versions follow MAJOR.MINOR.PATCH:

0.x — pre-launch. Minor bumps mark a completed build phase or major feature set; patches are bug fixes on the current build.
1.0.0 — first public launch.
1.x+ — post-launch: minor = new features, patch = fixes, major = breaking changes or significant re-architecture.

Each version is tagged in git (v0.2.0) and the current version is kept in package.json. See docs/version-control.md for how to cut a release.

Integration setup visibility.

Added Admin → Integrations with live, non-secret readiness indicators and production setup instructions for Google login, Apple login, and web push.

Production log hygiene.

Suppressed only Auth.js's acknowledged experimental-webauthn notice; passkeys remain enabled and all other authentication warnings and errors continue to be logged.

Footer accessibility and asset optimisation.

Raised footer and footer-link contrast to accessible dark ink colours.
Replaced the 133 KB AdvertiseOnline PNG with a 7 KB, appropriately sized WebP logo and added intrinsic image dimensions to prevent layout shift.

HTTPS security header consolidation.

Added a one-year HSTS policy at the HTTPS reverse proxy.
Made Nginx the sole source of the public security headers, removing the duplicate and conflicting Nginx/Next.js X-Frame-Options, Referrer-Policy, and related headers.

Public release history.

Published the complete changelog at /changelog, including a clear current version panel sourced from package.json.
Added a Changelog footer link and made the footer version badge link to the public release history.

IndexNow rewrite narrowing.

Restricted the IndexNow verification rewrite to valid key formats, so it no longer intercepts robots.txt or other static text routes.

Private-route indexing controls.

Disallowed API, administration, dashboard, account, sign-in, registration, and password-reset routes in robots.txt.
Added X-Robots-Tag: noindex, nofollow, noarchive headers to those routes.
Added page-level noindex metadata to the authenticated and account layouts.

Public-page metadata improvements.

Added clean, content-specific descriptions and canonical URLs to public fundraiser, organisation, and wholesale-product pages.
Aligned wholesale-product metadata with the public-page availability rules, so unavailable deals no longer publish indexable metadata.