v1.5.2 — SSR, Architect profile, aurora

Follow-ups to v1.5.1:

Fixed: forum post SSR streamed "Post not found" (self-fetch hit the deployment-protected Vercel URL → 401; SSR + RSC clients now execute GraphQL in-process via SchemaLink, verified under both bundlers with real streamed HTML) · admin profile showed Level 1 (the account had never been promoted — new db:promote-admin run; ADMIN now renders Level 101 — Architect everywhere on the profile) · sign-in skip link double-locale.

Changed: forum background — the grain was a real bug (noise tile stretched viewport-wide), now tiles correctly; color shift rebuilt as a three-blob OKLCH aurora (typed @property hue animation, compositor-only, reduced-motion safe, zero JS) · ROADMAP: competitive backlog filled from the July 2026 analysis.

Full detail: CHANGELOG.md · PR #76

v1.5.1 — Post-release hotfix

Hotfix for the 8 production issues reported after v1.5.0 — each systematically root-caused (only one was v1.5.0 code; the rest were pre-existing defects the release unmasked, including comment upvotes which had never worked due to a schema FK defect).

Fixed: all avatars (restored DB-referenced level icons + OAuth-sync guard + CSP allow-list + onError fallbacks) · comment upvotes (schema FK conflict removed; button rewritten) · comment posting collapsing the thread (suspense refetch in transition; SSR absolute-URL fix) · Lorenz GPU particles invisible under three r184+ (now render upright, verified with a 50K-particle swarm) · ODE view auto-fit · PDE 3D isosurface colormap.

Added: admin-only avatar icon picker (server-enforced role gate + strict whitelist).

Full detail: CHANGELOG.md · PR #75

v1.5.0 — Evergreen Sweep 2026-07

Evergreen sweep per the bleeding-edge operating principles: every dependency at its absolute-newest published version in any channel, an every-package idiom audit, a dead-code purge (net −9k lines), a docs overhaul, and a competitive-accuracy benchmark locked in as a regression suite — followed by a pre-merge adversarial review pass (6 dimension finders + 36 verify votes across 42 agents) whose confirmed findings were all fixed before the branch was merged.

Headline dependency moves

• TypeScript 7.1 nightly (native Go compiler) is the typecheck gate for 8 of 10 packages — full-workspace typecheck ~6 min → ~22 s (web + plot-engine stay on tsc 6.0.3; upstream blockers documented in the CHANGELOG).
• pnpm 11.0 alpha → 11.11.0 GA with supply-chain defaults (minimumReleaseAge + recorded exclusions).
• next 16.3.0-canary.81 · react 19.3 canary · graphql 17 · vitest 5 beta · workers-types v5 · hono 4.12.28 (security fixes) · immer 11.1.11 (prototype-pollution fix) · ~45 more; all ^ ranges pinned exact.

Features

• React Compiler enabled across the web app.
• GraphQL fragment masking + useFragment (upstream client-preset blocker resolved in 6.1.0).
• Complex.pow for arbitrary real/complex exponents; compound unit expressions (km/h, kg*m/s^2).
• Real cross-instance GraphQL subscriptions (Redis Streams actually consumed; overlap-proof tip-anchored poller).
• Real Apollo cache control (@cacheControl inheritance; hasUpvoted explicitly PRIVATE), 4 new DataLoaders, WorksheetShare.worksheet resolver, worksheets page + 10 algorithm pages → Server Components, use cache on reference API routes.
• 16-problem competitive-accuracy regression suite (ground truths hand-verified vs Wolfram Alpha/Symbolab/GeoGebra).

Notable bugs fixed (found by the review pass + verification)

• CAS polynomial division returned reversed quotients and lcmPolynomials hung forever (pre-existing synchronous infinite loop — masked until now by CI's unconditional timeout-is-success guard, which is also fixed to require a failure-free log).
• Cross-instance subscription events were 100% dropped — the initial implementation double-parsed payloads the Upstash client had already deserialized; test mocks encoded the wrong contract and are corrected.
• Worksheet.version existed only in the codegen schema, not the executable one — the exact runtime validation failure this sweep set out to fix; a new schema-parity test kills the two-sources drift class permanently.
• Apollo Server double-start on the shared instance (logged an error in every build); handlers now own their server.
• Adaptive sampler refinement criterion was inverted (smooth curves refined to the 8193-point cap, spikes accepted); golden-ratio subdivision probe kills grid-resonance aliasing (sin(10πx) no longer renders flat); discontinuity break markers restore asymptote gaps in all three 2D renderers; sample cache is a bounded LRU.
• i18n: entire 24-key worksheets namespace was missing in ru/es/uk/de (+2 keys in all 8 locales) — added, properly translated.
• .gitignored generated service worker actually untracked (git rm --cached); stale doc references to files deleted this sweep; dead deploy:staging scripts removed.

Removed

~115 dead files (orphaned level-icon subsystem, unused components/hooks, favicon explorations, duplicate seeds, dead shader exports), typedoc, unused d3 (−71 packages).

Verification

• turbo run typecheck lint build — all tasks green; web builds 352 pages.
• Tests: math-engine 49 files / 2,202 tests in 2.3 s (the suite's historical "teardown hang" was the LCM infinite loop — gone), plot-engine 17 files / 362 tests, api 8 files / 522 tests, web + workers green.
• graphql-codegen output verified byte-identical after schema directive additions.
• Full CHANGELOG entry under Unreleased.

Full changelog: CHANGELOG.md · PR #74

v1.4.0 — Idiom Modernization + Forum Localization Fix

This release is an idiom-modernization follow-up to v1.3.0's push-to-newest dependency sweep: code is rewritten to the newest idioms of each already-pinned dependency, all behavior-preserving — with one genuine user-facing fix. The pre-push gate (typecheck, lint, build) and tests are green.

Bug fix

• Forum now displays in your selected language. Post view counts, upvote counts, and relative timestamps were being formatted with the runtime default locale rather than your active one, so they rendered incorrectly in all 7 non-English locales (ru, es, uk, de, fr, ja, zh). All six forum components now format through next-intl's useFormatter, which binds the active request locale automatically — making the bug structurally impossible to reintroduce. Number, relative-time, and date output is otherwise unchanged, and relative times are now hydration-stable.

Behavior-preserving modernization

Everything below is an idiom upgrade with no functional change:

• Zod 4 — top-level format helpers (z.url(), z.uuid()) and z.ZodType.
• motion — framer-motion imports moved to the mandated motion/react entry (93 specifiers, 92 files).
• Tailwind v4 — bg-linear-to-*/oklab gradients (byte-identical oklab interpolation) and size-* shorthand.
• Prisma — dropped three GA'd preview features; kept only the still-required partialIndexes.
• React 19.3 — useEffectEvent adopted where it genuinely fits, eliminating two dependency suppressions.
• shadcn/ui — the current data-slot convention added across all standard UI primitives (additive only).
• Hono — all three Cloudflare Workers migrated to the idiomatic zValidator middleware, with byte-identical 400 responses.
• TS7-forward — the advisory tsgo (TypeScript 7 native preview) typecheck is green again, scoped past the two packages whose Three.js TSL types the native compiler can't yet resolve.

New under the hood

• Real Sentry capture — manual error capture, breadcrumbs, error boundaries, and onRequestError now actually report to Sentry (previously console-only), via a code-split adapter.
• instrumentation-client.ts — replaces the deprecated sentry.client.config.ts, which didn't run under Turbopack, restoring client-side error and navigation tracing in dev.

Full changelog: CHANGELOG.md · Compare: v1.3.0...v1.4.0

---

🤖 Generated with Claude Code

v1.3.0 — Modernization Foundation

NextCalc Pro v1.3.0 — Modernization Foundation

A large, bleeding-edge modernization of the entire monorepo. Every dependency was pushed to its absolute-newest published version and the code rewritten to each version's newest idioms, followed by a full code-quality, accessibility, auth, and documentation hardening pass. No user-facing breaking changes.

🚀 Dependencies (push-to-newest)

Upgraded the whole stack to its newest channels — Next.js 16.3, React 19.3, TypeScript 6.0.3, Apollo Server 5.5.1 / Client 4.3, Prisma 7.9 (dev), Tailwind 4.3, Three.js 0.184, Biome 2.5.1, Vitest 5 (beta), next-intl 4.13, Hono 4.12, Wrangler 4.104, and more — with code migrated to each version's current idioms. See the CHANGELOG for the full table.

✅ Code quality

• Re-enabled exactOptionalPropertyTypes, noPropertyAccessFromIndexSignature, and noUnusedLocals across apps/web + apps/api (143 real fixes — zero as any/ignores).
• math-engine: iterative cycle-detection DFS (no recursion-depth limits); astEquals deduplicated to a single canonical, unary-aware implementation.
• cas-service no longer leaks err.message in 500 responses (now matches the other workers).

♿ Accessibility

• The ZKP commitment-cell grid was restructured to a correct WAI-ARIA grid/row/gridcell pattern (axe-core verified, with a regression test).

🔐 Auth

• Client session migrated to NextAuth (Auth.js v5) SessionProvider + a thin useSession adapter — a single shared session context replaces per-component fetch/poll.

🎨 Design

• Topic colors moved to semantic OKLCH category tokens; rgba() box-shadows converted to oklch() — verified pixel-identical (zero visual change).

📚 Documentation

• Codebase-verified audit of all 38 Markdown files: corrected GraphQL examples, i18n namespaces, worker endpoints, setup/deploy commands, agent personas, and version references; the GitHub wiki was re-synced to match.

---

🤖 Generated with Claude Code

v1.2.2 — Comprehensive Test Overhaul

Test Coverage Overhaul

Massive expansion of the test suite across the entire monorepo — from ~900 tests to 2,300+ tests across 55 test files.

New Test Coverage by Package

Package	Tests	Files	Key Areas
API	491	6	DataLoaders, cursor pagination, error classes, Zod validation, Redis cache
Web	266	12	Zustand stores, RBAC, Redis utilities, auth hooks
Math Engine	1,039	19	Abstract algebra (groups/rings/fields), propositional logic prover, symbolic simplification
Plot Engine	323	13	Buffer pools, marching squares, shader cache, CSV/SVG export
Workers	187	5	Sliding window rate limiting, R2 storage utilities
Total	2,306	55

Highlights

• 30+ new test files covering previously untested production code
• Abstract algebra suite (190 tests): groups, rings, fields, homomorphisms, Galois theory
• Logic prover suite (112 tests): formula construction, truth tables, inference rules, proof search
• Symbolic simplification (91 tests): constant folding, identity rules, expand/factor/substitute
• API infrastructure (491 tests): full coverage of GraphQL error hierarchy, DataLoader batching, cursor pagination, input validation
• Zustand stores (55+ tests): calculator store with Immer, bookmarks, worksheets, collaboration
• Fixed parser test bug: extractVariables correctly excludes pi as a known constant
• Fixed TypeScript 6.0 strict mode issues in test files (vi.stubEnv instead of direct process.env assignment)

Infrastructure

• Standardized Vitest configs across all packages
• Disabled typecheck in math-engine vitest config (causes indefinite hang — use tsc --noEmit separately)
• Cleaned up unused mocks in web vitest setup

v1.1.3 — Performance Audit & Documentation Overhaul

🚀 Performance Audit Release

Comprehensive codebase audit covering performance, security, and modernization across all 574 source files and 30+ documentation files.

⚡ Performance

Optimization	Impact
Fix bookmarks store with useShallow	5× fewer re-renders
Dynamic import KaTeX	~280 KB deferred from initial bundle
4 new DataLoaders	Eliminate N+1 queries in GraphQL resolvers
Promise.all parallelization	Worksheet, forum, profile resolvers 2-3× faster
Typed arrays (Uint8Array/Float64Array)	Cache-friendly prime sieve & PageRank
Factorial memoization	Series computation O(1) cache hits
Canvas2D grid batching	Single stroke per axis direction
Three.js sprite dispose	Fix GPU memory leak on unmount
loading.tsx skeletons	Instant visual feedback for async routes

🔒 Security

• Timing-safe admin key comparison — SHA-256 hash + XOR via crypto.subtle
• CORS hardening — return empty string for non-matching origins (not first allowed origin)
• Recursive query complexity — depth-weighted GraphQL selection analysis (1000-point limit)
• Worker information leakage prevention — remove prettyJSON, sanitize all error responses

🛡️ Code Quality

• Fix 50+ type errors in CAS service (FactoryFunctionMap, SymbolNode, null checks)
• Fix all exactOptionalPropertyTypes violations across 3 Cloudflare Workers
• Replace React.EventType namespace with named imports (6 files)
• Replace slate-*/gray-* Tailwind with semantic tokens (3 pages)
• Add typecheck scripts to all worker packages
• Create tsconfig.typecheck.json for standalone web typechecking

🏗️ Infrastructure

• Turbo 2.8.12 → 2.8.13-canary.8
• CI Actions: checkout v4→v6, setup-node v4→v6, cache v4→v5
• Workers: compatibility_date → 2026-03-01
• Fix CORS port references 3020 → 3005

📚 Documentation Overhaul

• Refresh all 11 wiki pages with security patterns, DataLoader architecture, troubleshooting
• Update README with v1.1.3 highlights section
• Update ARCHITECTURE.md with Prisma 7 migration notes and DataLoader architecture
• Update CONTRIBUTING.md with i18n testing section
• Comprehensive CHANGELOG entry

Build & Deploy

• ✅ 21/21 turbo tasks pass (lint + typecheck + build)
• ✅ 161/161 API tests pass
• ✅ 66/66 Web tests pass
• ✅ CI pipeline 5/5 jobs green
• ✅ All 3 Cloudflare Workers deployed
• ✅ Vercel production deployment READY
• 🌐 Live at nextcalc.io

Full Changelog: v1.1.2...v1.1.3

v1.1.2

Bug Fixes

• Align API test mocks with security audit changes (IDOR, atomic counters, existence checks)
• Add account_id to all 3 worker wrangler.toml configs — fixes Cloudflare /memberships auth error
• Set fail-fast: false in deploy-workers matrix so each worker deploys independently

Infrastructure

• Set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID GitHub secrets for CI worker deploys
• All 3 Cloudflare Workers successfully deployed via CI

Documentation

• Updated CHANGELOG, wiki (Deployment, Cloudflare-Workers)
• Updated health endpoint version

Full Changelog: v1.1.1...v1.1.2

v1.1.1 - Fix Worker Deploy Workflow

What's Changed

Bug Fixes

• Fix deploy-workers GitHub Actions workflow: pnpm deploy → pnpm run deploy (pnpm 11 treats deploy as a built-in command)
• Fix root deploy:workers script with the same fix

Full Changelog: v1.1.0...v1.1.1

v1.1.0 - Security Audit & Dependency Updates

What's Changed

Dependency Updates (90+ packages)

• Next.js 16.2.0-canary.69, React 19.3.0-canary, TypeScript 6.0.0-dev.20260301
• Prisma 7.5.0-dev.32, Biome 2.5.0, Turborepo 2.8.12
• Hono 4.12.3, Wrangler 4.68.0, Vitest 4.1.0-beta.5, KaTeX 0.16.33
• Three.js 0.183.2, jose 6.1.3 (new dependency for JWT verification)

Security Hardening

• JWT verification: WebSocket auth now uses jose.jwtVerify() with signature verification (was base64 decode)
• IDOR fixes: Worksheet queries enforce ownership; unshareWorksheet validates shareId
• XSS prevention: Removed dangerouslySetInnerHTML for plain-text content
• Error leak prevention: Worker error responses no longer expose internal err.message
• Atomic counters: Forum post and worksheet view counters use atomic Prisma operations
• Profile fix: Corrected authorId → userId field reference

Math Engine Correctness

• modPow and lucasLehmer rewritten with BigInt (overflow-safe for all inputs)
• RSA key generation fixed for sizes >= 64 bits (randomBigIntBelow() helper)
• Limits: copy-paste bug fix (v1 → v2) and infinite recursion guard

Performance

• Iterative Tarjan SCC (no stack overflow on large graphs)
• O(1) topological sort dequeue (was O(V²) with Array.shift())
• Lazy-loaded Lorenz3DRenderer via next/dynamic
• Stack-safe Math.min/max with .reduce() for large arrays
• Rate limiter skips KV for unlimited tiers

Code Quality

• Number.isFinite()/Number.isNaN() across 12 files
• node: import protocol for Node.js builtins
• Removed redundant Prisma index, exported FavoriteType enum
• Sentry env vars in Turbo build cache keys

Full Changelog: v1.0.0...v1.1.0