Daily Engineering Digest — 2026-10-08

Date range

2026-10-07T17:00:28Z → 2026-10-08T17:00:28Z (UTC)

main had no new merges and no commits in this window. The latest merge on main remains #23 — fix(deps): close patchable prod audit findings (merged 2026-10-07T07:10:14Z), before this digest period.
New billing fix in review: #28 — fix(billing): prevent Plus demotion on duplicate checkout expiry opened 2026-10-08T11:17:08Z. It blocks new checkout when subscription is already active_plus or grace_period, and restores subscription from entitlement on abandoned checkout expiry instead of downgrading to free — a follow-on to #13. Touches packages/db/src/platform.ts, apps/api/src/billing-routes.ts, and adds regression tests in platform.test.ts.
Scheduled CI stayed green: nightly verification completed successfully at 2026-10-08T09:09:20Z on main.
In-flight dependency/security PRs (unchanged on main, still open): #26 fix(deps): resolve remaining Dependabot security update blockers and #25 chore(deps): bump source-map-js show passing CI; #24 fix(deps): align Node 24 and overrides for Dependabot security CI still has Unit tests and Validate app image failures on the PR checks.
Auth documentation still pending merge: #21 docs: auth email, sessions, and rate limits remains open with green CI (auth landed via #12 on 2026-10-07, outside this window).

#28 — lint/typecheck failing on PR CI while unit tests, Postgres journeys, production builds, and Web E2E pass. Billing regression is user-visible for Plus customers; do not merge until static checks are green.
#24 — Dependabot/Node alignment still blocked on failing unit tests and app image validation; security dependency automation may remain stuck until this is resolved.
Billing state machine — two related fixes (#13 merged, #28 pending) in the same area; worth a focused review of checkout + expiry paths before the next production deploy.

Automated daily digest (cron). Evidence: gh pr list, git log origin/main, GitHub Actions run history.