Core release
Railbase core v0.5.11
Bug-fix / hardening release. No new features; safe in-place upgrade from v0.5.10.
Admin panel
- Invite & password-reset links now use the server's real host instead of a hardcoded
localhost— fixes "can't invite users" on deployed sites. - Records data grid shows the real row count and working pagination (was stuck at "0 record(s)" with dead paging).
- Record save errors surface the server's real reason instead of a generic "Save failed."
- Notifications work on the Vault store again (an index key exceeded Vault's 64-byte document-id cap → notifications were silently dead).
- Tenants list/restore, digest-preview, and files-list decode fixes (CBOR/JSON mismatches).
- Webhook HMAC secret is no longer returned on list (display-once enforced).
- RBAC role-set updates no longer leave a stale role on rollback; cron missing-schedule returns 404.
- Admin user-management for the built-in
_userscollection (invite + list) fixed.
Security
- CSP
frame-srcallows the vendor origin so in-app marketplace install works.
Quality
- Backed by a new 4-layer admin test suite (Go L1 + vitest L2 + Playwright L3 + auth-matrix L4), now gating CI.
SHA-256 checksums in checksums.txt (also at https://railbase.app/dl/checksums.txt).