September 8, 2026 · 3.0.0-alpha.28

The hardened boundary

A security pass over everything alpha.27 shipped: the packaged app now trusts only its own renderer, refuses DevTools and remote debugging, room joins are rate limited through a new Edge Function, CORS answers only allowlisted origins, and a secret-and-exposed-file gate guards the repository and its history.

• Improved

  Privileged IPC accepts frames from the packaged renderer entry exactly, not any file: URL

• Improved

  Packaged builds strip remote-debugging switches, block DevTools, and deny every permission check

• New

  Room joins run through velora-room-join: bearer-authenticated, shape-validated, and limited to ten joins per minute with a 429 retry-after

• Improved

  velora-brain and velora-entitlements echo only allowlisted browser origins instead of *

• New

  A dependency-free security gate blocks credential files, secret patterns across every reachable commit, and unsafe renderer sinks — wired into CI and the release path

• Improved

  The deprecated @base-ui-components/react package is gone and Playwright left production dependencies, after a clean advisory audit