1.2.1
September 29, 2026
Fixes
API
- Metered API usage resets on renewal A Stripe renewal now starts the new billing period at zero for metered features such as API requests. Seat counts still carry into the next period.
Frontend
- Email change links confirm the new address Opening a change-email link now submits the code to the email-change check. The new address is saved instead of being sent through signup verification.
- Child teams require parent access Creating a child team now requires permission to update the parent team. A signed-in user who is not a current member of that parent can no longer attach a child team to it.
- Turning off two-factor authentication accepts a correction A mistyped authenticator code when turning off two-factor authentication now shows an invalid-code message. The setting stays on so you can try again with the right code.
- OAuth sign-in stops when a security check fails Google and GitHub sign-in no longer finishes if the check for two-factor authentication cannot be read. The sign-in stops with an error instead of issuing a session.
- Removed team members lose access Removing someone from a team now drops them from permission checks and the member list immediately. A removed member can no longer keep using their previous role on team routes.
- Signup verification requires the email address Signup verification now requires the email address. A request that leaves it off is rejected, so it cannot search the code or lock other pending signups.