Changelog

🐛 Bug Fixes

• fix(avo-authorization): with a client set, a lapsed license refuses every resource instead of turning policies off @Paul-Bob (#444) (also in avo-api, avo-authorization, avo-mcp_server)
• fix(avo-kanban): kanban routes and all_boards follow the board policy, and cards their record's policy @Paul-Bob (#438) (also in avo-menu)

🐛 Bug Fixes

• test: follow core's 403 refusal and act_on? on runs @Paul-Bob (#447) (also in avo-ai, avo-forms, avo-nested)
• fix(avo-authorization): with a client set, a lapsed license refuses every resource instead of turning policies off @Paul-Bob (#444) (also in avo-api, avo-kanban, avo-mcp_server)
• fix(avo-nested): a nested form writes only the children the user may update or create @Paul-Bob (#430) (also in avo-nested)

🐛 Bug Fixes

• fix(avo-licensing): an anonymous visitor can no longer get the license blocked with a forged Host header @Paul-Bob (#441)

Release notes

For more information and the release video check out the full release page

🐛 Bug Fixes

• fix: run actions only on records the policy allows, and answer a refusal with nowhere to go back to with a 403 @Paul-Bob (#4951)

Release notes

For more information and the release video check out the full release page

🚨Security

• fix: close authorization gaps in update, association lists, charts and has_one routes (GHSA-5qcq-2vq9-62hj) @Paul-Bob (3e4b7c4d6)

Release notes

For more information and the release video check out the full release page

🚨Security

• fix: close authorization gaps in update, association lists, charts and has_one routes (GHSA-5qcq-2vq9-62hj) @Paul-Bob (93450a767)

🎸 Features

• feat: delete confirmation names the records the destroy cascades to @Paul-Bob (#4948)
• Add refresh_on_destroy option to has_many fields @Paul-Bob (#4947)

🐛 Bug Fixes

• test: scope the HABTM detach spec to the users panel @Paul-Bob (#4950)

Release notes

For more information and the release video check out the full release page

🤖 Maintenance

• Share the status page plugin list with avo-licensing @adrianthedev (#4946)

🤖 Maintenance

• Link plugins to their avohq.io gem pages on the licensing status page @adrianthedev (#418)

🎸 Features

• feat: plugin keyboard shortcuts can be rebound from config.hotkeys @adrianthedev (#404) (also in avo-advanced_search, avo-ai, avo-custom_controls)

🤖 Maintenance

• chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
• RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

🎸 Features

• feat: plugin keyboard shortcuts can be rebound from config.hotkeys @adrianthedev (#404) (also in avo-advanced_search, avo-ai, avo-kanban)

🤖 Maintenance

• Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-cli, avo-collaboration, avo-dashboards, avo-dynamic_filters, avo-forms)
• chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
• RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

🎸 Features

• feat: plugin keyboard shortcuts can be rebound from config.hotkeys @adrianthedev (#404) (also in avo-ai, avo-custom_controls, avo-kanban)

🤖 Maintenance

• Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-cli, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms)
• chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
• RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

🎸 Features

• feat(avo-licensing): build the HQ payload from core's static telemetry @adrianthedev (#412)

🤖 Maintenance

• RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)

🐛 Bug Fixes

• fix(avo-authorization): repeated Avo boots no longer stack copies of the items extension @Paul-Bob (#396)

✏️ Docs

• docs(avo-authorization): the agent skill says a policy scope filters has_many panels @Paul-Bob (#392)

💡 Refactor

• refactor(avo-ai, avo-mcp_server): authorize writes against the field that saves them @Paul-Bob (#390) (also in avo-ai, avo-mcp_server)

🤖 Maintenance

• Move Avo core and website clones to the workspace root @adrianthedev (#413) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-calendar_view, avo-cli, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms)
• chore: dummy apps boot on the next free port when theirs is taken @adrianthedev (#410) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-query, avo-reactive_fields, avo-record_reordering, avo-scopes)
• RubyGems homepage links now open each gem's page on avohq.io @adrianthedev (#406) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dashboards, avo-dynamic_filters, avo-forms, avo-http_resource, avo-kanban, avo-licensing, avo-mcp_server, avo-menu, avo-meta, avo-nested, avo-notifications, avo-permissions, avo-reactive_fields, avo-record_reordering, avo-scopes)
• Test that avo-authorization refuses denied records on the association show route @Paul-Bob (#387)

Release notes

For more information and the release video check out the full release page

• fix: make row clicks reliable and support middle-click @adrianthedev (#4939)
• fix(dummy): ArrayValues controller and Playground array field records @adrianthedev (#4938)
• chore: prepare repository for Amp orbs @adrianthedev (#4937)
• Link plugins on the status page to their avohq.io gem pages @adrianthedev (#4924)
• chore(deps): bump markdown-it from 14.3.2 to 14.3.3 in the npm_and_yarn group across 1 directory @dependabot (#4907)
• Test that a belongs_to target outside the user's policy scope is refused like a missing one @Paul-Bob (#4912)

🎸 Features

• feat: static telemetry counts scopes @adrianthedev (#4945)
• feat: static telemetry collector without identifying data @adrianthedev (#4940)
• feat: developers can rebind or disable any keyboard shortcut @adrianthedev (#4934)
• feat: array resources can paginate at the source with page and per_page @Paul-Bob (#4928)

✨ Enhancements

• enhancement: dropdown rows share one hover fill and drop the focus ring @adrianthedev (#4935)

🐛 Bug Fixes

• Trix uploads work on the New form and Action Text keeps every file type @Paul-Bob (#4921)
• fix: keep tab frame state when going back after switching tabs @Paul-Bob (#4941)
• fix: the index header no longer leaves a gap for an empty toolbar row @adrianthedev (#4933)
• fix: the tags field loading spinner is vertically centered on the text @Paul-Bob (#4932)
• fix: Backspace after pasting into a selected tag deletes one character, not the whole paste @Paul-Bob (#4931)
• fix: escape query values appended by URIService @RaphaelFakhri (#4926)
• fix: pasting into a tags field in select mode no longer drops the text @Paul-Bob (#4922)
• fix: development reloads no longer stack copies of Avo's turbo stream actions @Paul-Bob (#4929)
• fix: keep the required asterisk beside its label on a validation error @Paul-Bob (#4920)
• fix: a polymorphic belongs_to sent only a new type no longer links a record by the old id @Paul-Bob (#4917)
• A belongs_to among attach_fields now saves onto the join record @Paul-Bob (#4919)
• A form with a belongs_to that matches no record keeps the user's other edits @Paul-Bob (#4915)
• Attaching a has_many, has_one or HABTM record saves only what its attach_scope offers @Paul-Bob (#4916)
• A belongs_to value that matches no record is a form error, not a 404 @Paul-Bob (#4911)

✏️ Docs

• Add a spec that has_many panels apply the listed resource's policy scope @Paul-Bob (#4914)

💡 Refactor

• Resources get find_records, and bulk actions find the selected records with it @Paul-Bob (#4918)
• Save a form through the field declaration the form shows @Paul-Bob (#4913)

🤖 Maintenance

• The RubyGems homepage link now opens avohq.io/gems/avo @adrianthedev (#4936)

🎸 Features

• feat(avo-collaboration): watchers take an author proc and can hide values @adrianthedev (#395)

Release notes

For more information and the release video check out the full release page

• Link plugins on the status page to their avohq.io gem pages @adrianthedev (#4924)
• chore(deps): bump markdown-it from 14.3.2 to 14.3.3 in the npm_and_yarn group across 1 directory @dependabot (#4907)
• Test that a belongs_to target outside the user's policy scope is refused like a missing one @Paul-Bob (#4912)

🐛 Bug Fixes

• fix: keep the required asterisk beside its label on a validation error @Paul-Bob (#4920)
• fix: a polymorphic belongs_to sent only a new type no longer links a record by the old id @Paul-Bob (#4917)
• A belongs_to among attach_fields now saves onto the join record @Paul-Bob (#4919)
• A form with a belongs_to that matches no record keeps the user's other edits @Paul-Bob (#4915)
• Attaching a has_many, has_one or HABTM record saves only what its attach_scope offers @Paul-Bob (#4916)
• A belongs_to value that matches no record is a form error, not a 404 @Paul-Bob (#4911)

✏️ Docs

• Add a spec that has_many panels apply the listed resource's policy scope @Paul-Bob (#4914)

💡 Refactor

• Resources get find_records, and bulk actions find the selected records with it @Paul-Bob (#4918)
• Save a form through the field declaration the form shows @Paul-Bob (#4913)

Release notes

For more information and the release video check out the full release page

🚨Security

• fix: authorize the association show route (GHSA-x65r-p6hf-94hv) @Paul-Bob (be234d8d0)

Release notes

For more information and the release video check out the full release page

🚨Security

• fix: authorize the association show route (GHSA-x65r-p6hf-94hv) @Paul-Bob (8ea8476b4)

🐛 Bug Fixes

• Key association listings by field id @joeljunstrom (#4902)
• fix: let fill_field take typed JSON values, not only form strings @Paul-Bob (#4910)
• fix: enforce key_value field disable_* options when saving @Paul-Bob (#4909)

🤖 Maintenance

• Label docs-sync PRs as Chore @Paul-Bob (#4908)
• [ruby] Update all Bundler dependencies (2026-10-22) @depfu (#4906)
• [js] Update all Yarn dependencies (2026-10-22) @depfu (#4905)

Release notes

For more information and the release video check out the full release page

• Sync shipped skills with docs through f6cae23 (2026-10-14) @adrianthedev (#4896)

🐛 Bug Fixes

• fix: disable non-standalone actions on has_many panels until a record is selected @Paul-Bob (#4904)
• Allowlist dummy associations for Ransack 6 combinator searches @nnegi88 (#4901)

🤖 Maintenance

• [js] Update all Yarn dependencies (2026-10-15) @depfu (#4897)
• [ruby] Update all Bundler dependencies (2026-10-15) @depfu (#4898)

Release notes

For more information and the release video check out the full release page

🎸 Features

• Show date picker month and weekday names in the app locale @Shub3am (#4873)
• Use the model's attribute translations for field labels @Shub3am (#4869)
• Let actions hide the confirm and cancel buttons @Shub3am (#4868)
• Support link_to_record on number and date fields @Shub3am (#4871)

🐛 Bug Fixes

• Fetch tag suggestions again after a value is selected in select mode @Shub3am (#4872)
• fix: boolean group field stops writing an option's key twice, so json 3 can encode it @Paul-Bob (#4895)

🤖 Maintenance

• [ruby] Update all Bundler dependencies (2026-10-08) @depfu (#4876)