Skip to content
Veltic

Changelog

Every visible change, in the order it shipped

Fixes, additions and security changes to the platform, the dashboard and the command line. Longer write-ups of the harder ones are on the blog.

September 2026

  1. Added

    Product analytics, off until you allow it

    Veltic now measures how the dashboard and the public pages are used. Nothing is loaded and no cookie is written until you enable the analytics category in the cookie banner.

    • Ingestion runs exclusively against the European endpoint, and a host outside the European Union fails the build rather than sending data
    • Session recording is disabled in code, automatic click and text capture is off, and the visitor address is discarded before an event is stored
    • Content never leaves the platform: statements from the SQL console, log lines, connection strings and file names are rejected by a guard before sending
    • Deployment outcomes are reported from the server keyed to the project, never to a person
    • Dashboard
    • Platform
  2. Fixed

    A deployment no longer costs a certificate

    Application hostnames are served by a single wildcard certificate. Previously every application requested its own, which exhausted a limit shared by all customers after roughly twenty deployments.

    • A custom domain still receives its own certificate
    • One hundred and twelve superseded certificate lineages were removed after classification
    • Renewal runs over the DNS challenge and was verified end to end
    • Applications
    • Platform
  3. Fixed

    Rate limiting is scoped per application again

    The per-application rate limit was keyed on the visitor address alone, so a load test against one application consumed the budget of every application behind the same edge node.

    • The limit is now keyed on address and hostname together
    • An exhausted limit answers 429 with a retry hint and the correct cross-origin headers instead of an opaque 503
    • The mapping from zone name to key is frozen by a test, because a zone cannot be re-keyed without a rename
    • Applications
  4. Fixed

    A container that never started keeps its output

    A failed start removed the container and its log with it, so the logs command returned nothing exactly when it mattered most.

    • The last 64 KB are written to disk before the container is removed
    • A successful start clears the stored output again, so an old crash never masks a running container
    • Applications
    • Functions
  5. Fixed

    PHP applications without a public directory deploy again

    An application whose entry file sits at the root rather than in a public directory was rejected as an attempt to escape its deployment directory.

    • The deployment directory itself is a valid path, and an empty relative path now resolves to the workspace root
    • Applications
  6. Fixed

    A dropped connection is no longer reported as a failed deployment

    Builds longer than five minutes reported failure while the application was starting normally. The command line now queries the real state after a transport error instead of assuming the worst.

    • Affected the compiled runtimes most, where a cold build regularly exceeds the client timeout
    • CLI
  7. Fixed

    Ignore patterns no longer reach into dependencies

    An excluded source directory was stripped at every level of the archive, including inside installed dependencies, which broke applications at their first import.

    • The file list is built by the command line itself, so the behaviour is identical on every platform
    • Below the dependency directory only version control and operating system artefacts are ignored
    • A leading slash anchors a pattern at the project root, and build output is never filtered by source tree rules
    • CLI
  8. Security

    Push deployments always verify their signature

    The signature of an incoming push was only checked when a secret had been stored. An application without one could trigger a deployment unverified.

    • The signature is now validated before any database access
    • A database constraint makes the state of a repository without a secret impossible
    • Existing secrets were rotated, so affected webhooks must be set up again
    • Applications
    • Platform
  9. Security

    Platform-wide routes require the operator account

    Telemetry, monitoring and the diagnostic endpoints were reachable with a permission that every role holds, which exposed server metrics to any tenant.

    • The audit log is now scoped to the calling account, with the platform-wide view reserved for the operator
    • Dashboard
    • Platform
  10. Fixed

    Resource quotas count against the project owner

    Quotas were checked against the acting user, so a collaborator without projects of their own could keep creating resources inside an exhausted project.

    • Counting and creating now happen inside one transaction with an advisory lock, so concurrent creations cannot both pass the same check
    • The command line path is covered as well, where the application quota was previously bypassed entirely
    • Platform