Changelog

October 14, 2026

avo-dashboards 4.3.1

🐛 Bug Fixes

test(avo-dashboards): cover resource cards on the page behind an action modal @Paul-Bob (#376)

avo-nested 4.3.1

🐛 Bug Fixes

Keep field autofocus out of AI chat cards and nested and reactive forms @Paul-Bob (#355) (also in avo-ai, avo-reactive_fields)

avo-reactive_fields 4.3.1

🐛 Bug Fixes

Reactive fields post only when a watched field changes, keep focus where you moved it, and render answers in order @Paul-Bob (#379)
Keep field autofocus out of AI chat cards and nested and reactive forms @Paul-Bob (#355) (also in avo-ai, avo-nested)

avo-advanced_search 4.3.1

🐛 Bug Fixes

Searchable belongs_to: only the visible search input carries the field id @Paul-Bob (#374)

avo-authorization 4.3.1

🐛 Bug Fixes

fix(avo-authorization): agent skill tells Action Policy clients to pass the rule as a Symbol @Paul-Bob (#382)

Avo 4.3.1

Release notes

For more information and the release video check out the full release page

Sync shipped skills with docs through 372e001 (2026-10-14) @adrianthedev (#4889)
Sync shipped skills with docs through 67e0e5d (2026-10-13) @adrianthedev (#4881)
chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates @dependabot (#4879)
Sync shipped skills with docs through 8e4140b (2026-10-07) @adrianthedev (#4874)
Sync shipped skills with docs through c73b294 (2026-10-06) @adrianthedev (#4814)

🎸 Features

feat(key_value): suggest keys and values while editing @nnegi88 (#4866)
Add autofocus field option @Shub3am (#4853)

✨ Enhancements

Badge field: select on forms with show_on: :forms @Shub3am (#4858)

🐛 Bug Fixes

fix(i18n): store set_locale only after authentication (GHSA-h7x6-9mqf-vgmx) @Paul-Bob (#4893)
fix(i18n): ignore unknown locales in set_locale and force_locale, deprecate set_locale @bruno-costanzo (#4886)
fix: stop mapping budget and money columns to the removed currency field @afurm (#4890)
Reactive fields post only when a watched input changes @Paul-Bob (#4887)
Fix country field default storing the country name instead of the code @Paul-Bob (#4885)
Fix accessibility gaps: name the modal dialog, give tabs unique ids, point belongs_to labels at the select, name icon-only actions @Paul-Bob (#4880)
fix(index): keep selected rows and scroll position when going back from a record @nnegi88 (#4867)

✏️ Docs

Mark set_locale deprecated in the i18n skill @Paul-Bob (#4892)
Stop the admin-config skill tying config.currency to removed currency fields @Paul-Bob (#4891)

🤖 Maintenance

[js] Update all Yarn dependencies (2026-10-08) @depfu (#4875)

Avo 3.33.1

Release notes

For more information and the release video check out the full release page

🚨Security

fix(i18n): validate set_locale and force_locale, store set_locale only after authentication (GHSA-h7x6-9mqf-vgmx) @Paul-Bob (#4894)

Avo 3.33.0

Release notes

For more information and the release video check out the full release page

🐛 Bug Fixes

Load resource cards behind an action modal @Paul-Bob (avo-hq/avo-dashboards#78, fixes #4884)

October 6, 2026

avo-mcp_server 4.3.0

🎸 Features

feat(avo-mcp_server): add a rowless count_records tool @Paul-Bob (#362)
feat(avo-api, avo-mcp_server): show each credential's access level on the index @Paul-Bob (#338) (also in avo-api)
feat: policy-declared field authorization across every Avo surface @Paul-Bob (#289) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-http_resource, avo-kanban, avo-nested, avo-notifications, avo-query, avo-record_reordering, avo-scopes)
avo-mcp_server: change a connection's entitlements from its card (AVO-1813) @Paul-Bob (#307)
Index status badges say when a token or MCP connection was revoked @Paul-Bob (#298) (also in avo-api)
feat(avo-mcp_server): name every connection, and have the session announce it (AVO-1814) @Paul-Bob (#295)
feat(avo-mcp_server): record client disconnects and say whether a connection can still call (AVO-1801) @Paul-Bob (#276)
feat(avo-mcp_server): let an app register its own MCP tools, shared with avo-ai (AVO-1783) @Paul-Bob (#265) (also in avo-ai)
feat(avo-audit_logging,avo-mcp_server,avo-api,avo-ai): trace an audited change back to the connection, token or chat that made it (AVO-1779) @Paul-Bob (#259) (also in avo-ai, avo-api, avo-audit_logging)
feat(avo-mcp_server): reorder the connect tabs and add Amp @Paul-Bob (#261)
feat(avo-mcp_server): read a connection's grant back as an entitlements matrix @Paul-Bob (#257)
feat(avo-mcp_server): live connection log on a connection's page (AVO-1788) @Paul-Bob (#256)
feat(avo-mcp_server): show a connection's tools on its page, grouped by grant (AVO-1785) @Paul-Bob (#249)
feat(avo-mcp_server): expose an Avo panel as a remote MCP server (AVO-1466) @Paul-Bob (#163) (also in avo-advanced_search, avo-ai)

🐛 Bug Fixes

avo-ai, avo-mcp_server: an action run by an agent sees the view the panel would have started it from @Paul-Bob (#317) (also in avo-ai)
avo-mcp_server: unrestricted entitlements mean read and write on everything, not a level (AVO-1813) @Paul-Bob (#309)
avo-mcp_server: announce the connection's name once, on first use, not on every connect (AVO-1829) @Paul-Bob (#306)
Make every gem template compile through Herb @adrianthedev (#301) (also in avo-advanced_search, avo-ai, avo-api, avo-calendar_view, avo-dynamic_filters, avo-http_resource)
fix(avo-mcp_server): name the connection in server/discover, where Claude Code actually reads it (AVO-1814) @Paul-Bob (#296)
fix(avo-mcp_server,avo-api): owner links through to its resource on Rails 8.2 hosts (AVO-1815) @Paul-Bob (#294) (also in avo-api)
fix(avo-mcp_server): keep a long connection log inside its card instead of stretching the page (AVO-1796) @Paul-Bob (#275)
fix(avo-mcp_server): answer a bare posted create with the connect page instead of 400 @Paul-Bob (#267)
fix(avo-mcp_server): gate the connect page on index? instead of create? (AVO-1792) @Paul-Bob (#263)
fix(avo-mcp_server): serve no subscriptions/listen stream (AVO-1787) @Paul-Bob (#255)
fix: resolve the conflict markers committed into two .evocation configs @adrianthedev (#253) (also in avo-ai)

🤖 Maintenance

Prepare fresh orbs for workspace development @adrianthedev (#297) (also in avo-calendar_view)
chore(avo-mcp_server): fold the events table into the one install migration @Paul-Bob (#262)
chore(avo-mcp_server): say what a connection's entitlements do to its tools @Paul-Bob (#258)

avo-reactive_fields 4.3.0

🐛 Bug Fixes

Stop Avo add-ons tripping Rails 8.2's early load hook guard at boot @adrianthedev (#302) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-forms, avo-licensing, avo-record_reordering, avo-scopes)

avo-record_reordering 4.3.0

🎸 Features

feat: policy-declared field authorization across every Avo surface @Paul-Bob (#289) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-http_resource, avo-kanban, avo-mcp_server, avo-nested, avo-notifications, avo-query, avo-scopes)

🐛 Bug Fixes

Stop Avo add-ons tripping Rails 8.2's early load hook guard at boot @adrianthedev (#302) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-forms, avo-licensing, avo-reactive_fields, avo-scopes)

avo-scopes 4.3.0

🎸 Features

feat: policy-declared field authorization across every Avo surface @Paul-Bob (#289) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-http_resource, avo-kanban, avo-mcp_server, avo-nested, avo-notifications, avo-query, avo-record_reordering)

🐛 Bug Fixes

Stop Avo add-ons tripping Rails 8.2's early load hook guard at boot @adrianthedev (#302) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-forms, avo-licensing, avo-reactive_fields, avo-record_reordering)

avo-dynamic_filters 4.3.0

🎸 Features

feat: policy-declared field authorization across every Avo surface @Paul-Bob (v.4.2.1 #289) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-http_resource, avo-kanban, avo-mcp_server, avo-nested, avo-notifications, avo-query, avo-record_reordering, avo-scopes)

🐛 Bug Fixes

test(avo-dynamic_filters): keep the date filter calendar attached to its input on scrolled pages @Paul-Bob (v.4.2.1 #341)
fix(avo-dynamic_filters): reset filters reloads only its own association frame @Paul-Bob (v.4.2.1 #340)
fix(avo-dynamic_filters): hide the value input on boolean filters with custom conditions @Paul-Bob (v.4.2.1 #339)
Stop Avo add-ons tripping Rails 8.2's early load hook guard at boot @adrianthedev (v.4.2.1 #302) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-forms, avo-licensing, avo-reactive_fields, avo-record_reordering, avo-scopes)
Make every gem template compile through Herb @adrianthedev (v.4.2.1 #301) (also in avo-advanced_search, avo-ai, avo-api, avo-calendar_view, avo-http_resource, avo-mcp_server)

avo-forms 4.3.0

🐛 Bug Fixes

Stop Avo add-ons tripping Rails 8.2's early load hook guard at boot @adrianthedev (#302) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-licensing, avo-reactive_fields, avo-record_reordering, avo-scopes)
fix(avo-forms): stop a stray navigation call from doubling a page's menu @Paul-Bob (#268)

avo-notifications 4.3.0

🎸 Features

feat: policy-declared field authorization across every Avo surface @Paul-Bob (v.4.2.1 #289) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-http_resource, avo-kanban, avo-mcp_server, avo-nested, avo-query, avo-record_reordering, avo-scopes)

🐛 Bug Fixes

Align notification navbar control sizing @adrianthedev (#358)
Fix realtime notification updates @adrianthedev (#354)

avo-http_resource 4.3.0

🎸 Features

feat: policy-declared field authorization across every Avo surface @Paul-Bob (v.4.2.1 #289) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-kanban, avo-mcp_server, avo-nested, avo-notifications, avo-query, avo-record_reordering, avo-scopes)

🐛 Bug Fixes

Serve array and HTTP resources through the REST API @Mihai-Munteanu (#356) (also in avo-api, avo-cli)
List array and HTTP resources over the REST API instead of a 500 @Paul-Bob (v.4.2.2 #357) (also in avo-api)
Make every gem template compile through Herb @adrianthedev (v.4.2.1 #301) (also in avo-advanced_search, avo-ai, avo-api, avo-calendar_view, avo-dynamic_filters, avo-mcp_server)

avo-nested 4.3.0

🎸 Features

feat: policy-declared field authorization across every Avo surface @Paul-Bob (#289) (also in avo-advanced_search, avo-ai, avo-api, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-http_resource, avo-kanban, avo-mcp_server, avo-notifications, avo-query, avo-record_reordering, avo-scopes)

🐛 Bug Fixes

test(avo-nested): nested Trix field in the dummy app @Paul-Bob (#343)

avo-dashboards 4.3.0

🐛 Bug Fixes

fix(avo-dashboards): render resource cards inside has_many association tables @Paul-Bob (#342)
avo-dashboards: bust cached cards when Avo or a plugin is upgraded @Paul-Bob (#332)
fix(avo-dashboards): read rows as a ceiling on data cards, not a floor @Paul-Bob (v.4.2.1 #293)

avo-api 4.3.0

🎸 Features

Export the REST API as an OpenAPI 3.1 document @Mihai-Munteanu (#366) (also in avo-cli)
feat(avo-api, avo-mcp_server): show each credential's access level on the index @Paul-Bob (v.4.2.8 #338) (also in avo-mcp_server)
feat: policy-declared field authorization across every Avo surface @Paul-Bob (v.4.2.7 #289) (also in avo-advanced_search, avo-ai, avo-audit_logging, avo-authorization, avo-calendar_view, avo-collaboration, avo-custom_controls, avo-dynamic_filters, avo-http_resource, avo-kanban, avo-mcp_server, avo-nested, avo-notifications, avo-query, avo-record_reordering, avo-scopes)
avo-cli: terminal-aware tables, record view and write confirmations (AVO-1828) @Mihai-Munteanu (v.4.2.7 #304) (also in avo-cli)
Index status badges say when a token or MCP connection was revoked @Paul-Bob (v.4.2.5 #298) (also in avo-mcp_server)
avo-cli: a command line client for the Avo REST API, and the _schema endpoint it discovers apps through (AVO-1637) @Mihai-Munteanu (v.4.2.5 #248) (also in avo-cli)
feat(avo-audit_logging,avo-mcp_server,avo-api,avo-ai): trace an audited change back to the connection, token or chat that made it (AVO-1779) @Paul-Bob (v.4.2.2 #259) (also in avo-ai, avo-audit_logging, avo-mcp_server)

🐛 Bug Fixes

Serve array and HTTP resources through the REST API @Mihai-Munteanu (#356) (also in avo-cli, avo-http_resource)
fix(avo-api): send field_options.required only when true @Mihai-Munteanu (#349) (also in avo-cli)
List array and HTTP resources over the REST API instead of a 500 @Paul-Bob (v.4.2.9 #357) (also in avo-http_resource)
avo-ai: reads stay inside the policy scope, and the run ends the loader (AVO-1831) @adrianthedev (v.4.2.7 #315) (also in avo-ai)
Make every gem template compile through Herb @adrianthedev (v.4.2.7 #301) (also in avo-advanced_search, avo-ai, avo-calendar_view, avo-dynamic_filters, avo-http_resource, avo-mcp_server)
fix(avo-api): refuse a page or per_page the paginator cannot read, instead of answering 500 @Paul-Bob (v.4.2.7 #290)
fix(avo-mcp_server,avo-api): owner links through to its resource on Rails 8.2 hosts (AVO-1815) @Paul-Bob (v.4.2.5 #294) (also in avo-mcp_server)
fix(avo-api): draw routes without loading the host app's models @Paul-Bob (v.4.2.3 #264)

💡 Refactor

avo-api: null clears every field, and _schema drops shape and keys (AVO-1637) @Mihai-Munteanu (v.4.2.5 #299) (also in avo-cli)
refactor(avo-api): rename API token scopes to entitlements @Paul-Bob (v.4.2.1 #250)