🔒 Security + ✨ Features
Security
- RBAC enforcement — Role-based access control now enforced across all admin and API routes. Viewers can no longer access user management, modify content, or change collection schemas. (#736)
New Features
- Collapsible grouped fields — Object field groups, blocks, and repeaters now have collapsible UI with persistent state per document. (#739, by @bobbwal)
- QR Code Generator plugin — Create and manage QR codes from the admin interface. (#738, by @ahaasco)
Docs
- Security documentation page — Comprehensive security architecture docs covering auth, RBAC, CSRF, CORS, rate limiting, and responsible disclosure policy.
Installation
npm create sonicjs@latest my-appOr update:
npm install @sonicjs-cms/core@2.10.0⚠️ Action Required
Ensure these environment variables are set for production:
wrangler secret put JWT_SECRET
wrangler secret put CORS_ORIGINS