Daily Engineering Digest — 2026-10-07 #27

Date range

2026-10-06T17:04:46Z → 2026-10-07T17:04:46Z (UTC)

Highlights

• #12 feat(auth): email verification, password reset, rate limiting, and origin hardening — Largest merge of the window (~10.6k / ~5.9k lines, 100 files). Adds provider-neutral SMTP seam, better-auth email verification + password reset, explicit rate limits on auth and managed-AI routes, production-gated CORS/trusted-origin checks, and matching web flows (forgot/reset password, Indonesian catalog). Also carries accumulated capsule drift (executor, onboarding, approvals, bot avatar, locale). User impact: full email-based account recovery and stricter auth surface in production.

• #13 fix(billing): avoid grace period on abandoned checkout expiry — Adjusts platform billing logic so expired abandoned checkouts do not incorrectly enter a grace period (packages/db/src/platform.ts + tests). User impact: billing state stays accurate when checkout is abandoned.

• #18 chore(flags): remove deprecated rollout shims and aliases — Removes legacy feature-flag shims across adapters/core (composio-connector, executor, compose-update, etc.). System impact: fewer indirection paths; callers must use current flag names only.

• Dependency & security cluster (#19, #20, #23) — Unblocked Dependabot on main via .nvmrc (Node 24.21.0), root pnpm.overrides, and lockfile regen (#19). Dependabot grouped bump in packages/adapters (#20). Production audit pass closed patchable findings (e.g. critical proxy-addr, compression, undici@8, direct hono / nodemailer bumps) — 30 → 2 reported prod audit issues (#23).

• CI health — Nightly verification succeeded on schedule 2026-10-07T08:52:26Z after the merge batch landed on main.

• Throughput — Six commits merged to main in 24h (vs. none in the prior digest window); first substantial activity on main since PR fix(ci): skip Playwright report publish when S3 is unset #11 (2026-09-04).

Watchlist

1. Remaining Dependabot / audit tail — Open PRs #24, #25, #26 target further security-update blockers and source-map-js; #23 notes 2 unpatchable high findings (braces, node-forge) with no upstream fix yet.

2. Auth rollout — #12 touches API env, origins, SMTP, and web auth UX at scale; confirm production SMTP + TRUSTED_ORIGINS (or equivalent) before relying on email verification in live environments. Draft docs follow-up: #21.

3. Large sync regression risk — #12 bundles auth with unrelated product drift; smoke-test checkout/billing (#13), managed-AI rate limits, and integration connectors after deploy.

Automated daily digest (cron). Evidence: merged PRs and main commits in the window above.