Issues

• Allow configuring the transaction timeout for the implicit per-write $transaction

  OpenSaasAU/stack#2024 · Filter by author borisno2 opened on Oct 24, 2026

• To-one relationship null on update is passed to Prisma unchanged (should mean disconnect, or be rejected clearly)

  OpenSaasAU/stack#2003 · Filter by author borisno2 opened on Oct 23, 2026

• storage: image transformations without a format are stored under a composite extension (photo.png-thumb)

  bugready-for-agent
  OpenSaasAU/stack#1983 · Filter by author borisno2 opened on Oct 22, 2026

• storage: maxFileSize is checked against the File-like's declared size, never the bytes read

  bugready-for-agent
  OpenSaasAU/stack#1982 · Filter by author borisno2 opened on Oct 22, 2026

• storage: cleanupOnDelete/cleanupOnReplace delete an asset a sudo-created row shares with another row

  bugready-for-agent
  OpenSaasAU/stack#1981 · Filter by author borisno2 opened on Oct 22, 2026

• core/auth MCP: a __proto__ claim in an accepted JWT sets the context session's prototype

  bugready-for-agent
  OpenSaasAU/stack#1979 · Filter by author borisno2 opened on Oct 22, 2026

• auth: email is lowercased on write but a secured-surface where is not normalised — document or lower it case-insensitively

  documentationready-for-agent
  OpenSaasAU/stack#1977 · Filter by author borisno2 opened on Oct 22, 2026

• auth: extendUserList can redeclare email/name/image, dropping the unique index, isRequired and the lowercase hook (#1966 guard is a proxy condition)

  bugready-for-agent
  OpenSaasAU/stack#1976 · Filter by author borisno2 opened on Oct 22, 2026

• core: concurrent first get() on an empty singleton throws UniqueConstraintViolation from a read

  bugready-for-agent
  OpenSaasAU/stack#1974 · Filter by author borisno2 opened on Oct 22, 2026

• core: explicit undefined on a kind: 'columns' field nulls every part column on update (storage db.columns orphans the asset)

  bugready-for-agent
  OpenSaasAU/stack#1973 · Filter by author borisno2 opened on Oct 22, 2026

• core: a caught nested tx.transaction() rejection commits the inner unit's writes

  bugready-for-agent
  OpenSaasAU/stack#1972 · Filter by author borisno2 opened on Oct 22, 2026

• core: password() is admitted in where/orderBy/distinct, so an MCP client can extract the hash with contains

  bugready-for-agent
  OpenSaasAU/stack#1971 · Filter by author borisno2 opened on Oct 22, 2026

• core: paging a synthetic back-relation under a row-dependent source read rule is an existence oracle (limit/offset sibling of #1964)

  bugready-for-agent
  OpenSaasAU/stack#1970 · Filter by author borisno2 opened on Oct 22, 2026

• core: combine() rows branch bypasses the declared-dependency rule view — the #1811 read-gate hole reopened under combine()

  bugready-for-agent
  OpenSaasAU/stack#1969 · Filter by author borisno2 opened on Oct 22, 2026

• core: combine() rows branch skips narrowUnincludedForeignKeys, returning raw foreign keys of rows the session cannot read

  bugready-for-agent
  OpenSaasAU/stack#1968 · Filter by author borisno2 opened on Oct 22, 2026

• Release: new vite 7.3.6 / launch-editor 2.14.1 advisories (20–21 Oct) fail check:security-audit; both pinned by the repo's overrides

  bugdependenciesready-for-agent
  OpenSaasAU/stack#1967 · Filter by author borisno2 opened on Oct 22, 2026

• stack-tiptap: server-side read-only renderer for richText() honouring its feature set

  enhancementready-for-agent
  OpenSaasAU/stack#1954 · Filter by author borisno2 opened on Oct 21, 2026
  1

• cli: opensaas dev applies Prisma's non-destructive schema changes to an external DATABASE_URL at startup with no plan or consent

  ready-for-agent
  OpenSaasAU/stack#1930 · Filter by author borisno2 opened on Oct 18, 2026
  1

• core: caller where predicates have no nesting depth cap (cost / DoS via MCP)

  ready-for-agent
  OpenSaasAU/stack#1929 · Filter by author borisno2 opened on Oct 18, 2026
  1

• core: an access rule returning null/undefined throws a raw TypeError and breaks reads of unrelated lists

  ready-for-agent
  OpenSaasAU/stack#1928 · Filter by author borisno2 opened on Oct 18, 2026
  1

• core: an update whose payload is all undefined still fires afterOperation/afterTransaction as committed

  ready-for-agent
  OpenSaasAU/stack#1927 · Filter by author borisno2 opened on Oct 18, 2026
  1

• core: a write that returns null after its hooks ran commits the hooks' writes, and afterTransaction reports rolled-back

  ready-for-agent
  OpenSaasAU/stack#1925 · Filter by author borisno2 opened on Oct 18, 2026
  1

• storage: generateUniqueFilenames: false lets one row's upload overwrite and then delete another row's file

  ready-for-agent
  OpenSaasAU/stack#1923 · Filter by author borisno2 opened on Oct 18, 2026
  1

• auth: magic-link / email-OTP / SIWE fail because better-auth's reservation id doesn't fit the uuid id column

  ready-for-agent
  OpenSaasAU/stack#1918 · Filter by author borisno2 opened on Oct 18, 2026
  1

• core: combine() pairs reduction rows by index after Field Visibility dropped rows, attaching one row's counts to another

  ready-for-agent
  OpenSaasAU/stack#1911 · Filter by author borisno2 opened on Oct 18, 2026