Public changelog
Shipped, dated, verifiable.
Every public release since the first installers explains what changed, why it changed, and how it was verified. Written from the release ledger, not from marketing. When we break something, the fix lands here with its root cause.
Releases
Every entry cross-checks against the published artifacts and the SHA-256 hashes on the download page.
Current release
v0.2.0
Windows 10-11 · NSIS + MSI · hashes published
v0.2.0September 18, 2026
The first Vendale-branded release
- Complete Thread CRM → Vendale rename sweep across the application, installers, and release artifacts.
- Fresh NSIS + MSI installers built in API mode and published with published SHA-256 hashes on the download page.
- Release contract verified byte-for-byte: a fresh public download matched the local build hash; superseded artifacts return HTTP 404.
- SmartScreen status for unsigned installers is documented directly on the download page. No fine print is buried in a PDF.
v0.1.5August 18, 2026
Login boundary made honest
- Any 401 from the email sign-in route is now normalized to a clear invalid-credentials message at the login boundary.
- Refresh tokens and protected-route behavior deliberately left untouched; the fix was scoped to one route, not the auth system.
- Verified with focused auth/client tests 22/22 and the full desktop suite 570/570 before release.
v0.1.4August 18, 2026
Error bodies stopped being thrown away
- Root cause: the native WebView can hide Content-Type on failures, so real JSON error details were being discarded and misread as a generic sign-in loop.
- Defensive JSON parsing restored for every non-success response; HTML or malformed bodies still fall back to safe HTTP status text.
- Regression coverage added for a JSON 401 with no Content-Type header, the exact shape that broke real users.
v0.1.3August 18, 2026
The misleading message fixed
- A wrong-password rejection was being classified as authentication_required, telling users they needed to sign in while they were already signing in.
- New invalid_credentials state points users at email, password, and workspace URL instead of a loop.
- Safe live probes confirmed requests were reaching the active backend; the failure was classification, not connectivity.
v0.1.2August 18, 2026
Registration repaired end to end
- A registration call was hitting the marketing host and receiving HTML instead of API JSON. A real client screenshot surfaced the issue at sign-up step 4.
- Desktop HTTP handling now rejects a non-JSON success response as a safe unexpected_api_response instead of exposing a parser error.
- Production build validation now refuses to build against a non-API origin, preventing this class of misrouting at build time.
Before the version numbers
The platform milestones.
PlatformSeptember 2026
Named, provisioned, and pointed at real infrastructure
- Vendale named; zero-cost platform architecture accepted and provisioned (V0).
- Full Thread CRM → Vendale rename sweep across the entire application.
- First Vendale-branded installers published with published hashes.
TrustAugust 2026
Verified messaging identity
- Canonical Instagram tenant identifier gate shipped after a full inbound-trace investigation.
- Instagram webhook signature verification, event-key schema validation, and duplicate-callback repair landed.
- Instagram Login uses dedicated app credentials, separate from Facebook.
ProductionJune 2026
De-mocked for real customers
- Demo data removed; every dashboard surface verified against real API responses.
- Release hygiene pass: artifact integrity, branded installers, icon layers verified at every Windows size.
- Desktop validation: lint, 141 tests, production build, desktop installer build, dependency audit, artifact scan.
Request the current release.
Every release carries published SHA-256 hashes. Verify before you run.