What’s fixed

• The focal point editor is readable on any image, in light and dark. Crops of many shapes fill the screen, and a column beside them holds the image, with a marker that shows on light and dark pictures alike (drag it, click, or use the arrow keys), and a zoom slider that follows the pointer.
• Cropping starts with a selection in the middle of the image, so it’s clear at once what to drag. Everything outside it is dimmed, and the rule-of-thirds guides and handles show on light images too.
• Reupload asks first. It offers only files of the asset’s kind, says which file takes its place, whether its extension changes, and that the current file can’t be brought back, then shows the upload’s progress.
• Replace says what it did. Its picker names the asset being replaced, choosing that same asset explains why nothing happens, and afterwards it reports how many places changed, or that nothing used the asset. When some can’t be changed, it names them instead of “Request failed”, and keeps the original.
• The asset editor has a Close button beside Save, and a click on the backdrop no longer closes it, so a stray click can’t throw away an edit.
• Live Preview updates in place as you type, keeping its scroll position, instead of reloading blank each time. A theme’s layout needs PreviewBar for this; without it the preview reloads as before.
• A preview is marked with a Preview ribbon across the top corner, which pulses while a change applies.
• The dashboard’s At a glance tiles show a count and its period, “Last 30 days”, without a comparison that read as “0 the 30 before”.

Changed

• Rails’ settings are all in a site’s own files. Nibble keeps none of its own: storage, mail delivery, the job schedule, Inertia, passkeys and the content security policy are written into config/ at install, each under a # Nibble: comment that says why, and the time zone is Rails’ config.time_zone in config/application.rb rather than a key in config/nibble.yml. In production, Nibble names a job missing from config/recurring.yml, or passkeys that don’t allow the site’s URL, at boot and in nibble:check.

• Uploaded files are served from /media/:uuid/…, and Rails’ asset pipeline has /assets back.

• /up is the site’s route, in config/routes.rb as Rails writes it, and the Active Storage migration is in the site’s db/migrate/.

• The control panel is the Control Plane, at /cp. Every screen, sign-in and password reset moved from /admin to /cp; its controllers are Nibble::Cp::, its screens vendor/nibble/frontend/nibble-cp/pages/cp/, and a screen a site replaces lives at site/cp/pages/cp/<same path>.vue. /admin is no longer reserved.

  Upgrade: move any site/cp/pages/admin/ screens to site/cp/pages/cp/, and update bookmarks.

• Nibble holds none of the names Rails generates. Its base classes, users, roles, sessions, sign-in and mailers are Nibble:: (Nibble::User, Nibble::ApplicationController, Nibble::PasswordsMailer…), its identity tables are nibble_users, nibble_sessions and the rest, and its migrations are named Nibble…, and its sign-in cookie is nibble_session_id, so a site can run bin/rails generate authentication for accounts of its own. A new site starts with Rails’ own ApplicationController, ApplicationRecord, layouts and PWA views. Email layouts and views a site replaces live at app/views/layouts/nibble/mailer.* and app/views/nibble/<mailer>/.

  Upgrade: run bin/rails db:migrate; everyone signs in again once. Move app/views/layouts/mailer.* and any email views you replaced under nibble/, then run bin/rails nibble:install --only=app/ to write the base classes a site doesn’t have yet.

• The Control Plane uploads through its own route, and Rails’ public direct-upload endpoint, which takes uploads from anyone, is closed.

  Upgrade: take the offered config/environments/production.rb, config/recurring.yml, config/routes.rb and config/initializers/content_security_policy.rb. Write the files a site doesn’t have yet with bin/rails nibble:install --only=config/initializers/ and bin/rails nibble:install --only=db/migrate/. Move time_zone from config/nibble.yml to config.time_zone in config/application.rb.

Security

• An idle Control Plane session ends on the server. After session.idle_minutes without activity (120 by default, in config/nibble.yml) the session is gone, so reloading the page asks for sign-in; before, the lock lived only in the browser. A minute before, a warning offers to extend it, and afterwards a dialog signs back in, with the two-factor code when it’s on, without leaving the page.

  Upgrade: run bin/rails db:migrate.