Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@transloadit/convex@0.3.0

Minor Changes

• 6775ac9: Require convex 1.43 or newer (previously 1.24.8). Storage receipt pages use convex-helpers'
  paginator, and the tested convex-helpers release (0.1.124) declares a ^1.43.0 Convex peer.
  Upgrade convex before upgrading this package.
• e416c77: Allow trusted server callers to require matching Assembly fields when refreshing status, before
  persisting fetched results. This supports album and uploader access checks in applications.
• 6775ac9: Register Transloadit Storage receipts from completed Assemblies. With a configured Storage Workspace
  (storageWorkspace, or TRANSLOADIT_WORKSPACE), verified webhooks and refreshes store each
  canonical receipt once per Workspace, asset and version, with its Assembly provenance. A malformed or
  cross-Workspace receipt fails the whole status update. listStoredAssets pages an album's visible
  receipts newest first with Convex cursors (use usePaginatedQuery from convex-helpers/react), and
  getStoredAsset reads one exact version. A deletion ledger hides assets before Storage deletion,
  keeps them retryable until deletion is confirmed, and then leaves tombstones so late notifications
  cannot register deleted assets again. Tombstones keep the receipt without its ThumbHash, its Assembly
  provenance and its album and user linkage; nothing purges them. Receipts and ThumbHashes are private
  metadata: expose them only through application queries that authorize the viewer.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
convex	Ready	Preview	Sep 25, 2026 6:20pm UTC

[kvz]

Release verification

• Exact head: 4830676a94bc84b13d5a4ce1e1aa7196e19a85c9, GitHub-verified, directly based on current main. The diff contains only the expected 0.3.0 version, generated changelog and consumed changesets.
• Council review: no findings. Local yarn check: 178 tests / 26 files, no type errors, no formatting changes.
• CI 36172055478, attempt 3: fully green, including Node 24/26, codegen drift, package/example builds, browser tests and deployed preview QA.
• The first QA attempt exposed a missing branch-scoped NEXT_PUBLIC_CONVEX_URL; the release preview now points to its own CI-created backend. Only that public Preview config entry was added; no production settings, keys or local .env files changed. The preview was rebuilt and the failed QA job rerun against the unchanged commit. Tests were not weakened.
• The organization ruleset change and rollback record explains why standard Changesets updates now work while commit signatures and main/feature protection remain enforced. Uppy is unchanged.

Ready for the separate merge/publication decision. This verification did not publish npm packages or deploy production.

[kvz]

Release and production verification completed after Kevin approved the merge.

• Squash-merged with --admin, matching the reviewed head 4830676a94bc84b13d5a4ce1e1aa7196e19a85c9. Main/tag commit: f188ea92137cca83810e286b779c8600540abfee.
• Changesets release workflow: green. @transloadit/convex@0.3.0 is visible on npm under latest, with the matching gitHead and published provenance metadata. GitHub release v0.3.0 points to the same commit.
• Clean, registry-only consumer using Convex 1.43.0: installation, three import/metadata/component-definition smoke tests, and a subsequent immutable installation passed. This was not a local tarball or workspace link. The temporary consumer used exact age-gate exceptions only for the two reviewed, newly published packages (@transloadit/convex@0.3.0 and @transloadit/zod@5.0.1); repository and global Yarn settings were not changed. The component-definition smoke does not claim to replace a Convex runtime deployment.
• Main CI and automatic production deploy: green, including 178 tests on Node 24 and Node 26, codegen drift, builds, lint, and local browser checks.
• Convex backend deployed; Vercel Production deployment 6667491481 is successful for exact commit f188ea92137cca83810e286b779c8600540abfee.
• The workflow then ran its real production browser test: uploads wedding photos and videos passed (79.5 seconds). This verifies the existing demo configuration; no additional Storage-mode flags or credentials were enabled for this release.

No follow-up remains for this release/publication/deployment task.