Changelog

October 29, 2026

avo-custom_controls 4.3.2

🤖 Maintenance

chore(avo-custom_controls): action link specs match the action, not the whole URL @Paul-Bob (#457)

avo-dashboards 4.3.3

🐛 Bug Fixes

Fix clipped text descenders in dashboard list cards @adrianthedev (#461)

Avo 4.3.10

Release notes

For more information and the release video check out the full release page

🎸 Features

Add opt-in commit and push to avo:update @adrianthedev (#4956)

✨ Enhancements

enhancement: select all on the grid view @Paul-Bob (#4955)
enhancement: index_query in action fields, messages, and the grid view @Paul-Bob (#4949)

✏️ Docs

docs(skills): an Avo 4 trial beside Avo 3 is a third amber trial state @Paul-Bob (#4952)

🤖 Maintenance

[js] Update all Yarn dependencies (2026-10-29) @depfu (#4953)

avo-licensing 4.3.4

🎸 Features

feat(avo-licensing): the trial notice asks an Avo 4 trial beside Avo 3 to migrate on Avo HQ @Paul-Bob (#458)

October 28, 2026

avo-kanban 4.3.4

🐛 Bug Fixes

fix(avo-kanban): a card's # tag shows the record's to_param, not its primary key @Paul-Bob (#456)

avo-record_reordering 4.3.2

🐛 Bug Fixes

fix(avo-record_reordering): the reorder endpoint refuses a move when the license lacks record reordering @Paul-Bob (#449)

avo-collaboration 4.3.3

🐛 Bug Fixes

fix(avo-collaboration): a reaction can only be added with an emoji the resource offers @Paul-Bob (#450)

avo-kanban 4.3.3

🐛 Bug Fixes

fix(avo-kanban): a card hides Remove and dragging when the policy refuses them, and a column counts only the cards the user sees @Paul-Bob (#452)

avo-scopes 4.3.1

🐛 Bug Fixes

fix(avo-scopes): a scope count asks the same policy as the index it counts @Paul-Bob (#432)

🤖 Maintenance

chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering)

avo-notifications 4.3.1

🐛 Bug Fixes

fix(avo-notifications): a user can only open, delete or act on their own notifications @Paul-Bob (#427)
fix(avo-notifications, avo-calendar_view): bulk actions and calendar navigation stay in their own has_many panel @Paul-Bob (#386) (also in avo-calendar_view)

🤖 Maintenance

chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

🐛 Bug Fixes

fix(avo-menu): a sidebar action shows only when the resource's policy allows act_on? @Paul-Bob (#445)
fix(avo-kanban): kanban routes and all_boards follow the board policy, and cards their record's policy @Paul-Bob (#438) (also in avo-kanban)

🤖 Maintenance

chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

avo-record_reordering 4.3.1

🐛 Bug Fixes

fix(avo-record_reordering): moving a record needs reorder? on its policy and redirects back only within the app @Paul-Bob (#434)

🤖 Maintenance

chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-scopes)

avo-forms 4.3.1

🐛 Bug Fixes

test: follow core's 403 refusal and act_on? on runs @Paul-Bob (#447) (also in avo-ai, avo-authorization, avo-nested)
fix(avo-forms): a form can set self.authorize to refuse opening, submitting and listing it @Paul-Bob (#439)

🤖 Maintenance

Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-cli, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters)
chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

avo-http_resource 4.3.1

🐛 Bug Fixes

fix(avo-http_resource): the debug console runs a probe only when the policy allows that action @Paul-Bob (#435)

🤖 Maintenance

chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

avo-nested 4.3.2

🐛 Bug Fixes

test: follow core's 403 refusal and act_on? on runs @Paul-Bob (#447) (also in avo-ai, avo-authorization, avo-forms)
fix(avo-nested): a nested form writes only the children the user may update or create @Paul-Bob (#430) (also in avo-authorization)

🤖 Maintenance

chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

avo-dynamic_filters 4.3.1

🐛 Bug Fixes

fix(avo-dynamic_filters): a filter applies only the conditions it offers @Paul-Bob (#429)

🤖 Maintenance

Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-cli, avo-collaboration, avo-custom_controls, avo-dashboards, avo-forms)
chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

avo-api 4.3.1

🐛 Bug Fixes

fix(avo-authorization): with a client set, a lapsed license refuses every resource instead of turning policies off @Paul-Bob (#444) (also in avo-authorization, avo-kanban, avo-mcp_server)
fix(avo-api): the shipped initializer no longer sets the authorization client @Paul-Bob (#446)
fix(avo-api): association fields follow view_? and the related policy scope @Paul-Bob (#431)
fix(avo-api): a belongs_to id that matches no record answers 422 naming the field @Paul-Bob (#389)
fix(avo-ai, avo-mcp_server): AI and MCP writes go through your resource's fields @Paul-Bob (#385) (also in avo-ai, avo-mcp_server)

🤖 Maintenance

Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-authorization, avo-calendar_view, avo-cli, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms)
chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

avo-audit_logging 4.3.1

🎸 Features

Audit logging: record activity from your own code, with or without a user @Paul-Bob (#414)

🐛 Bug Fixes

fix(avo-audit_logging): Undo needs a user allowed to update the record, and the activity payload hides fields they may not see @Paul-Bob (#440)

🤖 Maintenance

Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-advanced_search, avo-ai, avo-api, avo-authorization, avo-calendar_view, avo-cli, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms)
chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

avo-dashboards 4.3.2

🐛 Bug Fixes

fix(avo-dashboards): a card's URL asks what the page that renders it asks @Paul-Bob (#437)
fix(avo-dashboards): a card keeps to the ranges it lists @adrianthedev (#422)

🤖 Maintenance

Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-cli, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-forms)
chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

avo-collaboration 4.3.2

🐛 Bug Fixes

fix(avo-collaboration): timeline requests need access to the record and its timeline @Paul-Bob (#433)

🤖 Maintenance

Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-cli, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms)
chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)