What’s New
Everything that has shipped in both versions, newest first, with the date it landed.
The free starter
The open-source starter — the landing page, the tooling, the tests, and the accessibility and performance work that runs on every push. Every change below is public: the full commit history lives in the GitHub repository.
- Added
Screenshots of what Pro actually looks like
The Pro page now shows the dashboard, the admin panel, and a CRUD flow rather than describing them, and the free-versus-Pro comparison table fits a phone screen instead of scrolling sideways.
- Maintenance
Test runs made deterministic in CI
The CI container is pinned to the same version as the Playwright test runner, so a dependency bump can no longer leave the workflow with no browser to launch. Screenshot specs now verify each image by fetching it instead of polling for its dimensions.
- Changed
The home page leads with a hero
The landing page opens on a hero with the headline and calls to action instead of dropping straight into the About section, so what this is and what to do next are both above the fold.
- Changed
Honest wording on what cookieless analytics can measure
The privacy notice claimed more than the setup delivers. It now states accurately that no location is derived from your IP address, and documents what cookieless measurement costs in return — returning visitors are counted as new ones after the hash rotates.
- Fixed
Integration card navigation and a Safari transparency bug
The integration cards on the Pro page scroll to their own section when activated, and a Safari-only bug that left the header stuck transparent over page content is fixed.
- Changed
The PostHog variable matches PostHog's documentation
The analytics variable is now NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN, matching the name PostHog's own documentation uses, so pasting a value from their setup guide lands in the right place. A same-origin /ingest proxy was trialled the same week and reverted — it cost a serverless hop on every event without meaningfully improving delivery.
- Added
Cookieless analytics and a privacy notice
Vercel Analytics is replaced by PostHog in cookieless mode: nothing is written to your device, so the site needs no cookie banner. A /privacy notice ships with it, linked from every page, and it reads the analytics configuration rather than asserting it — switch analytics off and the notice says so.
- Fixed
Structured data that the validator accepts
Three properties in the structured data were rejected by Google's Rich Results validator. All three are corrected, so the page's SoftwareApplication and FAQ markup now parses cleanly.
- Changed
Rewritten About copy and SEO cleanup
The About section was rewritten around what you get and who it is for, and ends at two calls to action instead of none. Assorted SEO work landed with it, including a restored header border on scroll.
- Added
Lighthouse budgets enforced on every push
Lighthouse now runs in CI with score thresholds that fail the build, which caught and fixed a broken heading hierarchy. Linting in CI uses the project's own ESLint toolchain rather than a separate action, and supply-chain hardening moved onto the npm install path so it applies to every install.
- Added
A real Pro landing page, and an upsell you can switch off
The Pro pitch became a full page — comparison, integrations, delivery terms, and FAQ — and the whole upsell surface became opt-in. With no NEXT_PUBLIC_PRO_URL set, the teaser, the navigation entries, and the /pro and /thanks routes all switch off together, so a project scaffolded from this starter never ships someone else's sales pitch.
- Added
MIT license
The repository carries an explicit MIT license, so what you may do with it is written down rather than assumed.
- Security
Security updates to dependencies
Next.js, PostCSS, js-yaml, and brace-expansion were upgraded to clear reported vulnerabilities.
- Added
A post-purchase page and cross-route section links
A post-purchase page for buyers returning from checkout, and a fix for section links that previously did nothing when clicked from a route other than the home page — they now route home first, then scroll.
- Added
Pro upsell content
The first Pro upsell content landed on the landing page, describing what the paid version adds.
- Fixed
Native build scripts allowed for sharp and unrs-resolver
sharp and unrs-resolver are allowlisted to run their native build scripts, which unblocks image optimization on a fresh install.
- Added
Vercel Speed Insights
Vercel Speed Insights was wired up to report real-user performance. It was superseded by PostHog's cookieless performance measurement in August.
- Fixed
A CI suite that finishes
The Playwright job runs in Playwright's official container with browsers prebaked, which fixed a CI hang during browser installation, and the dark-mode accessibility scan was stabilized across all three browsers.
- Changed
Landing page upgrades and repository rename
A pass over the landing page sections and the repository rename that this project now lives under.
NextStarter Pro
Pro is a private repository, so its changelog and releases are visible only to buyers. This list is the public record of what has shipped into it — the SaaS foundation the free starter does not carry, and the maintenance that keeps it current. It reached 1.0.0 on 2 September 2026, and buyers take every change here with a git pull rather than waiting for a release.
- Release
NextStarter Pro 1.0.0
The first stable release, tagged nextstarter-v1.0.0, gathering everything below into one version. Access is by git pull from the repository's main branch, so this is not a drop of new code — the version number is there so a project can record which release it started from, and so future updates can be described against it.
- Added
A landing page written for your product, not ours
The landing page you inherit opens with a hero carrying the page's only h1, three proof points, and neutral placeholder copy — “Ship your product, not the plumbing”, with the brand taken from your own environment variables. The price and the purchase button exist only inside the upsell branch, so a project with no checkout configured inherits a hero with no sales copy in it at all.
- Added
Page metadata a crawler can use
Complete page metadata in the locale layout: keywords, publisher, explicit robots directives — including googleBot with max-image-preview, max-snippet, and max-video-preview — the Open Graph fields that were missing (type, url, siteName, locale), and a Twitter title and description.
- Changed
The PostHog variable matches PostHog's documentation
The analytics variable is now NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN, the name PostHog's own dashboard and documentation use. Rename it in your .env when you pull this update: with the old NEXT_PUBLIC_POSTHOG_KEY still set, analytics silently stays off rather than failing loudly.
- Added
JSON-LD structured data and a generated share card
SoftwareApplication and Organization structured data on the public routes only — never the auth-gated dashboard and admin trees — plus a generated Open Graph share card. Payloads are escaped through a serializer, so a site name containing markup cannot break out of the script tag.
- Added
A privacy notice that reads your configuration
A privacy notice that derives its claims from your configuration instead of asserting them: each section is gated on the same guard that switches its integration on, so a keyless install truthfully says it collects nothing and enabling Stripe makes the payments section appear. It is jurisdiction-neutral and ships behind a visible “review before you launch” banner, isolated in one component so removing it is one import and one line.
- Fixed
WCAG AA contrast on every gradient button
Every orange gradient button fell short of the 4.5:1 WCAG AA ratio at its right-hand end, and all of them failed in dark mode against a colour class that had never resolved. Both are fixed, and a spec now samples every gradient control's stops in both themes so a regression fails the build — axe-core cannot evaluate contrast against a gradient and had been passing straight over them.
- Added
Lighthouse CI on mobile and desktop
Lighthouse CI runs on both the mobile and desktop presets, with thresholds that fail the build. Mobile performance on the home page is a known open issue and is tracked as a warning rather than being quietly ignored.
- Fixed
A level-one heading on every route
Moving the site h1 into the landing hero left the auth, admin, billing, projects, and waitlist “not configured” notices with no level-one heading at all, failing 24 accessibility checks across eight routes and three browsers. Each notice now owns the page heading, and the dashboard's heading levels no longer skip.
- Fixed
Accessibility scans that wait for the repaint
Accessibility scans were landing mid-repaint after the theme toggle, reporting page-wide contrast failures against blended colours belonging to neither theme. A shared helper now waits for every transition to finish before scanning, which ended the intermittent Firefox failures.
- Changed
Selling the starter separated from billing your app
Polar and Stripe both appeared in the example environment file with nothing saying which was which. The docs now separate selling this starter from billing your own application, and name the section to delete once you own the code.
- Changed
The refund guarantee written into the license
The 14-day refund guarantee is stated in the license itself rather than only on the sales page.
- Fixed
A first run that works before you configure anything
With no .env file, the very first npm run dev after a clone rendered an error page instead of the landing page. Environment values now fall back to documented defaults, so a keyless first run looks like a configured one.
- Security
Security updates to dependencies
Dependencies were upgraded to close published advisories: Next.js 16.2.6 to 16.3.1, Prisma 7.8.0 to 7.9.1, DOMPurify 3.4.11 to 3.4.13, plus postcss, brace-expansion, fast-uri, socket.io-parser, and valibot.
- Security
Admin access requires a verified email address
Admin access is now granted only against a verified email address, and the Clerk webhook no longer persists unverified addresses to the database; both paths are covered by unit tests. Shipped alongside two smaller pieces of hardening: .gitignore now covers every .env variant rather than the bare file — vercel env pull writes .env.local, which the old pattern missed — and dangerouslySetInnerHTML is now an ESLint error, which keeps the no-raw-HTML precondition the content security policy depends on enforced rather than assumed.
- Changed
How repository access actually arrives, described accurately
The documentation said buyers are added as a collaborator, implying the invite fires on payment alone. It does not — you connect a GitHub account in the customer portal first, and the invitation follows. All four buyer-facing places now describe the same flow, confirmed against a test purchase.
- Fixed
A lockfile that installs the same way everywhere
npm ci aborted before any CI job ran, taking linting, Playwright, and code review down with it: an optional peer dependency resolved differently for Dependabot than for npm, so a lockfile regenerated on one side failed on the other. Pinning @swc/helpers through an overrides entry settled it, and the tree no longer depends on how a given resolver treats optional peers.
- Fixed
Locale-aware canonical URLs and hreflang alternates
Localized pages emitted a locale-less canonical URL that only redirected. Every public page now self-references its own locale and advertises hreflang alternates for the others.
- Added
A commercial license and an updates guide
A single-developer commercial license covering unlimited personal and commercial projects, plus a written guide to pulling updates into a project you have already started building on.
- Added
Documentation for every integration
A full documentation set in the repository — setup, a guide per integration, environment variables, and deployment walkthroughs for Vercel and for self-hosting — versioned alongside the code it describes.
- Added
Internationalization with RTL support
Internationalization with next-intl: locale-prefixed routing, message catalogues, and right-to-left support.
- Added
API rate limiting, security headers, and input sanitization
Rate limiting on the API routes, security headers including a content security policy, and input sanitization on the paths that accept user content.
- Added
Admin panel, waitlist, and error tracking
An admin dashboard behind an email allowlist, a waitlist with CSV export, and optional Sentry error tracking that stays inert until you supply a DSN.
- Added
Product analytics
PostHog product analytics, wired up and switched off by default until configured.
- Added
Form handling and an MDX blog
Server-validated form handling with typed errors, and an MDX blog with the routing, metadata, and feed already built.
- Added
The dashboard app shell
The authenticated application shell — navigation, layout, and the project CRUD screens the rest of the dashboard is built on.
- Added
Row Level Security documented
Row Level Security is documented, so the database policies that keep one tenant's rows away from another are explained rather than left to be inferred.