Highlights

• 🐛 Self-update command fixed — the ./vendel update flow no longer risks overwriting the binary with unverified bytes or blowing up inside a Docker overlayfs. Checksum is now mandatory and Docker/NixOS are detected up front.
• ⬆️ PocketBase 0.36.9 → 0.37.3 — admin dashboard rewritten from scratch with dark mode, basic responsive support, a lighter rules autocomplete, and an ERD-like view of collections. SQLite bumped to 3.53.0.
• ⚡ Frontend build: Vite 7 → 8 — moved to the Rolldown + Oxc bundler and swapped @vitejs/plugin-react-swc for @vitejs/plugin-react, which now uses Oxc for Fast Refresh.

Fixes

Self-update reliability (backend/commands/update.go, backend/services/updater.go, backend/main.go)

• AddCommand registration restored in main.go — it was silently dropped during an unrelated merge, so ./vendel update had been returning unknown command for weeks.
• A failing checksums.txt fetch no longer returns an empty checksum — the installer now refuses to download without a published SHA256.
• filepath.EvalSymlinks runs before creating the temp dir, so the atomic os.Rename always stays on one filesystem.
• Early abort on Docker (/.dockerenv) and NixOS (/etc/NIXOS) with a message pointing to docker compose pull && docker compose up -d or your Nix config.

Dependency bumps

• github.com/pocketbase/pocketbase 0.36.9 → 0.37.3
• vite 7.3.2 → 8.0.8 (Rolldown + Oxc)
• @vitejs/plugin-react-swc replaced by @vitejs/[email protected]
• react-i18next 17.0.2 → 17.0.4
• typescript 6.0.2 → 6.0.3
• @biomejs/biome 2.4.11 → 2.4.12
• @types/node 25.5.2 → 25.6.0

Highlights

• 🧙 New device onboarding wizard — replaces the single-form dialog with a 4-step flow (choose type → install app/agent → enter details → scan QR). Solves the common confusion of users creating a device before downloading the Vendel Android app, by making the download part of the required path.
• 🛠️ One-command local dev — new scripts/run-development.sh starts backend (:8090) and frontend (:5173) in parallel with clean Ctrl+C shutdown.
• 📸 Updated homepage screenshot in the README and updated deployment section (deploys to Render and Cloudflare Pages are now manual).
• ⬆️ PocketBase 0.36.9 and multiple frontend dep bumps (TanStack Router, react-i18next, lucide-react, Biome).

Features

Device creation wizard (frontend/src/components/Devices/AddDevice.tsx)

• Step 1 — Type: selectable cards for Android Phone / USB Modem with descriptions.
• Step 2 — Install first: shows AndroidAppDownload or ModemAgentDownload based on the chosen type, with an explicit "I've installed it" advance button.
• Step 3 — Details: name + phone number form; device is created on submit.
• Step 4 — Connect: QR code (Android only) + copy-to-clipboard API key.
• Progress indicator bar across all steps; full i18n support (en/es).

Developer experience

• scripts/run-development.sh — checks for go and bun in PATH, runs bun install if needed, boots both servers in parallel with a proper trap for cleanup.

Highlights

• Promo codes — Admins can create promo codes that credit user balances; redeemable from the dashboard (BalanceCard + navbar popover)
• Per-user quota cycles — SMS quota now resets every 30 days per user (from their activation date), not globally on the 1st of each month
• Contacts & groups — Full contact management with vCard import, group support, and export
• SMS templates — Per-recipient variable interpolation for personalized bulk messaging
• SMS status endpoints — Look up delivery status for single messages or entire batches
• Backend test suite — 127 tests covering core services and handlers

Features

• Add promo code system: POST /api/promos/redeem with admin-managed promo_codes collection, per-user redemption tracking, expiration, and max redemption limits
• Align SMS quota reset with per-user 30-day cycle instead of global monthly reset
• Add contacts and groups with vCard import, export, and search
• Add SMS template interpolation with per-recipient variable support ({{name}}, etc.)
• Add SMS status endpoints: single message (GET /api/sms/:id/status) and batch lookup
• Add group_ids support to send_sms and send_template MCP tools
• Add SDK cards and API docs link to integrations page
• Add configurable announcement banner
• Add backend test suite (127 tests) with CI workflow

Fixes

• Fix admin cannot delete users: update collection rules for superusers
• Fix responsive page headers: stack on mobile, wrap buttons
• Strip secret values from admin config API and add rate limits

Infra & Dependencies

• Bump PocketBase to v0.36.8
• Migrate release workflow from npm to bun
• Bump TypeScript to 6.0.2, Tailwind CSS to 4.2.2, Vite to 7.3.2
• Bump lucide-react to 1.7.0 (replace deprecated icon aliases)
• Switch Dependabot frontend ecosystem from npm to bun
• Bump go-jose/v4 to 4.1.4

Vendel v0.1.0

The first stable release of Vendel — a self-hosted SMS gateway platform that turns Android phones and USB modems into programmable messaging infrastructure.

Highlights

• Contacts & Groups — Manage contacts, organize them into groups, import from vCard, and send bulk SMS to entire groups
• SMS Templates — Create reusable message templates with variable interpolation ({{name}}, {{phone}}, custom vars)
• Message Status API — Track delivery status of individual messages or entire batches via dedicated endpoints
• Official SDKs — JavaScript/TypeScript, Python, and Go client libraries (v0.3.0), plus an MCP server for AI assistants (v0.2.0)
• 127 backend tests with CI pipeline

Features

• SMS Gateway — Send and receive SMS via Android devices or USB modems with automatic device selection and retry logic
• Multi-device support — Register multiple devices, route messages to specific devices or let the system auto-select
• Scheduled SMS — One-time or recurring messages with cron expressions and timezone support
• Webhooks — Real-time event notifications (sent, delivered, failed, received) with HMAC signature verification
• Contacts & Groups — Full CRUD, vCard import, CSV/vCard export, search, group filtering, and group-based sending
• Templates — Saved message templates with per-recipient variable interpolation
• API Key Authentication — Integration API keys (vk_ prefix) with expiration and usage tracking
• Quota Management — Per-plan SMS limits, device limits, and monthly auto-reset
• Subscription Billing — QvaPay, Stripe, and TronDealer payment providers with balance top-ups
• Multi-user — User registration, email verification, OAuth2 (Google, GitHub), password recovery
• Admin Dashboard — System settings, user management, payment provider configuration, maintenance mode
• Announcement Banner — Configurable site-wide banner for notices
• i18n — English and Spanish translations
• Responsive UI — Mobile-friendly dashboard with collapsible sidebar

API Endpoints

All endpoints support both JWT and API key authentication.

Security

• API key auth with automatic expiration
• HMAC-SHA256 webhook signatures
• Secret values stripped from admin API responses
• Rate limiting on auth endpoints
• Security headers middleware

Infrastructure

• Backend: PocketBase v0.36.8 (Go) with SQLite
• Frontend: React 19, TypeScript 6, TanStack Router/Query, Tailwind CSS 4, shadcn/ui
• Deployment: Docker Compose, Render, Cloudflare Pages
• CI: GitHub Actions with 127+ backend tests

Changelog

• 730550a Fix QR code missing server_instance in production build
• f271ce0 Fix admin settings crash and CSP blocking GitHub API
• 093d8d8 Regenerate bun.lock after dependency bumps
• beabf95 Merge pull request #122 from JimScope/chore/cleanup
• 20ec9f3 Fix label checker to allow multiple labels (one_of → any_of)
• 0d87ba7 Remove vendored deps from modem-agent, refactor SendSMS
• 64915a8 Merge pull request #121 from JimScope/feat/self-update
• c863591 Add self-update CLI command: ./vendel update
• 7eb73d9 Merge pull request #114 from JimScope/feat/trondealer-payment-provider
• ef9ed10 Expand privacy policy and terms of service
• b7a9e4e Bump Go version to 1.26.1
• f7eaa5d Update xlab/at to latest — drop vendored patches
• 26705c6 Make sender email configurable via system_config
• 9ccd747 Fix email sender to always use [email protected]
• 505f359 Add Content-Security-Policy header
• 07c994d Fix payment security and reliability issues from code review
• a453c8a Decouple top-up from subscriptions and add batch admin config
• 075db6e Bump golang.org/x/image from 0.37.0 to 0.38.0 in /backend
• dc7aa00 ⬆ Bump dotenv from 17.2.3 to 17.3.1 in /frontend
• ff034e8 ⬆ Bump @tanstack/react-query from 5.94.5 to 5.95.2 in /frontend
• 9707772 ⬆ Bump @types/node from 25.2.2 to 25.5.0 in /frontend
• c270d05 ⬆ Bump i18next from 25.8.20 to 26.0.1 in /frontend
• 936932c ⬆ Bump react-hook-form from 7.71.1 to 7.72.0 in /frontend
• 6684f6d ⬆ Bump picomatch in /frontend
• 406c99f Add TronDealer env vars to .env.example
• a54c824 Fix TronDealer webhook parser based on real payload testing
• c941b7d Add TronDealer payment provider with unified balance system

Changelog

• c37efda Use window.location.origin as default PocketBase URL
• a639559 Fix frontend embed in release workflow
• d6016e3 Regenerate bun.lock after dependency bumps
• 303d10e Annotate vendor patches with upstream PR references
• 100f65a Add YAML config, SIM PIN unlock, and generic modem profile to modem-agent
• 945260a Add modem-agent section to READMEs
• bea8bd3 Add related repositories section to READMEs
• ea11445 ⬆ Bump pocketbase from 0.25.2 to 0.26.8 in /frontend
• 3026824 ⬆ Bump @tanstack/react-query-devtools from 5.91.1 to 5.94.5 in /frontend
• de8b031 ⬆ Bump tailwind-merge from 3.4.0 to 3.5.0 in /frontend
• eda4188 ⬆ Bump @vitejs/plugin-react-swc from 4.2.2 to 4.3.0 in /frontend
• bd9f615 ⬆ Bump lucide-react from 0.563.0 to 0.577.0 in /frontend
• ddbf8cc ⬆ Bump litestream/litestream from 0.5.9 to 0.5.10

Changelog

• ce2de70 Show first-time welcome message for new users on dashboard
• c7eb331 Fix password validation mismatch between frontend (8 chars) and backend (10 chars)
• 61e3104 Remove sdks/ directory, now in separate repos
• 3290449 Move SDK publish workflows to individual repos
• 6882394 Add CI workflows for SDK publishing (npm, PyPI, Go mirror)
• 5923ff3 Add .gitignore to each SDK directory
• 3f7a66e Remove unused Items collection from frontend
• 041854c Remove key prefix column from API keys table
• b91a25d Update API key QR code text to be integration-agnostic
• 0972cd2 Revert "Remove key prefix column from API keys table"
• b6c1e6b Remove key prefix column from API keys table
• b03e6c8 Add language switcher to sidebar footer
• 82b22de Replace GettingStartedCard with onboarding checklist
• 71f6e2d Fix account deletion and email verification URLs
• a24078e Update PR labeler to use standard GitHub labels
• 7562639 Add i18next dependencies to package.json and lockfiles
• 3256f63 Add i18n support with English and Spanish translations
• e026f8c Fix webhook logs sheet closing immediately on open
• 39effc9 Bump google.golang.org/grpc from 1.72.0 to 1.79.3 in /backend

Changelog

• Add internationalization (EN, ES)
• Fix webhook logs sheet closing immediately on open

Changelog

• ba8271f Replace webhook event text input with enum selector and payload preview
• a08ee66 Update docs and configs for embedded frontend
• e59949b Embed frontend build into Go binary via go:embed
• e5d310c Add branded email change confirmation template
• 42fb47a Add branded password reset email template
• 535a7e8 Add branded verification email template
• 3322268 Add plan-based limits for scheduled SMS and integrations
• e5555f8 Fix scheduled SMS using browser timezone instead of selected timezone
• 540dbc9 Fix device dialog closing on first creation, remove modem-agent from compose
• 8dec161 Format code with Biome
• 8629772 Fix multi-step dialogs closing immediately on content switch
• 2a1257d Fix GoReleaser binary names: pin microarch variants to single values
• a0548de Update GoReleaser configs to v2 format
• 805ae4c Bump PocketBase to v0.36.7
• d660783 Move device downloads to a popover in the page header
• 97a53bf Update READMEs: reflect Render/Cloudflare deployment and release workflow
• b6d6c48 Remove self-hosted deploy workflows
• e862352 ⬆ Bump @types/react from 19.2.7 to 19.2.14 in /frontend
• e2896fa ⬆ Bump docker/metadata-action from 5 to 6
• 6a6e38f ⬆ Bump docker/setup-buildx-action from 3 to 4
• 54c5edf ⬆ Bump docker/build-push-action from 6 to 7
• 82d182a ⬆ Bump actions/setup-node from 4 to 6
• b56ae70 ⬆ Bump docker/login-action from 3 to 4
• 41786fb ⬆ Bump @playwright/test from 1.57.0 to 1.58.2 in /frontend
• a26ed7f ⬆ Bump @tanstack/react-query from 5.90.12 to 5.90.21 in /frontend
• f66d52a ⬆ Bump @tanstack/react-router-devtools in /frontend
• 0c31e34 ⬆ Bump react-error-boundary from 6.0.0 to 6.1.1 in /frontend
• 289480e Fix pagination controls disappearing when page size exceeds total rows
• 2a21c9d Fix admin route not visible: remove Hidden flag from is_superuser field
• 05bc625 Extract inline queries and mutations to dedicated hooks
• 9083046 Include pre-releases when fetching latest Android APK
• 8eea288 Auto-select device when user has only one
• 514bbd8 Remove .agents directory
• b707697 Replace MultiSelect with simpler Command-based implementation
• 42c565c Add website and dashboard demo links to README headers
• afe20dc Use high-res PNG logo and move homepage screenshot below description
• 44ddf5f Replace old FastAPI screenshots with vendel.cc homepage capture
• dc54db8 Center README title with logo for both EN and ES versions
• 5b68fc9 Add Android app download card and fix Apple Silicon detection
• 73c00ee Update brand icon: add Libre Baskerville V with dark mode support
• 6755652 Fix seed to promote existing user to superuser on startup
• 73268d0 Add GHCR Docker image publishing workflow
• bed698f Remove design-system.html (lives in vendel-homepage)
• 032c5d5 Make superuser seeding idempotent for each collection
• 5308387 Seed app superuser in users collection on startup
• 5b2b404 Remove ANDROID_PLAN.md (app completed)
• 27c0d92 Change copyright to 2026 Jimmy Angel Pérez Díaz
• 3fae027 Remove uppercase doc duplicates (moved to docs/)
• a45d0d6 Add server release workflow, move docs to docs/ in English
• 9c3aca8 Add server release workflow and development/deployment docs
• 9b6604d Refactor frontend: type safety, shared components, and hook extraction
• e9f2f7b Add shared constants, performance indexes, and maintenance mode cache
• 3e3dfb2 Refactor handlers: extract utils, DRY auth/responses, move rotation to services
• 5eb17be Refactor services: DRY crypto, move webhooks, extract retry logic
• 720f9ef Decompose main.go into hooks/ and cronjobs/ packages
• 5498161 Add AES-GCM field-level encryption for SMS message bodies
• f56e772 Add export data button to settings danger zone tab
• 7505d52 Add GDPR data export endpoint (GET /api/user/export)
• 386eec4 Add cascade delete on user removal and default API key expiration
• 741340e Add configurable webhook payload and redact PII in delivery logs
• c31870d Add data retention cron job for SMS messages and webhook logs
• f218a46 Harden auth security: password policy, token lifetime, and login rate limit
• 606cf01 Add security headers middleware
• 80823d2 Add timestamp staleness check to Stripe webhook signature verification
• e2dfe4a Require WEBHOOK_ENCRYPTION_KEY at startup instead of silent plaintext fallback
• 321ba7f Remove dead localStorage access_token code
• 12faf74 Remove superuser password fallback from webhook encryption key derivation
• 756063e Fix SSRF via DNS rebinding and open redirect in webhook delivery
• 9a782fa Fix privilege escalation via user-settable is_superuser field
• e92a5b6 Replace bare goroutines with routine.FireAndForget for panic recovery
• 4e06314 ⬆ Bump pocketbase from v0.36.5 to v0.36.6
• e1d2f97 Replace flutter/python agents with golang-pro agent
• 026ebe5 🐛 Fix API key/QR code dialog closing immediately after creation
• 4bf5f6e ⬆ Bump actions/setup-go from 5 to 6 (#80)
• 6b4d295 ⬆ Bump @biomejs/biome from 2.3.8 to 2.3.14 in /frontend (#73)
• e98a97d ⬆ Bump react-hook-form from 7.68.0 to 7.71.1 in /frontend (#71)
• 2ae2a11 ⬆ Bump @tanstack/router-devtools from 1.140.0 to 1.158.4 in /frontend (#68)
• 572e032 ⬆ Bump playwright from v1.57.0-noble to v1.58.2-noble in /frontend (#66)
• fb59542 ⬆ Bump @types/node from 25.2.1 to 25.2.2 in /frontend (#64)
• d975122 ⬆ Bump rollup from 4.50.1 to 4.59.0 in /frontend (#78)
• cd64e41 chore(deps): bump go.opentelemetry.io/otel/sdk in /backend (#79)
• 2bbcec8 ⬆ Bump actions/checkout from 4 to 6 (#81)
• 7a26234 ⬆ Bump goreleaser/goreleaser-action from 6 to 7 (#82)
• c257ff0 chore: add Android app implementation plan (temporary)
• 58ff187 chore: rename project from Ender to Vendel
• 244d00f feat: add modem-agent binary downloads via GoReleaser
• 61bbb03 chore: use scratch image for modem-agent runtime
• dde6d7b security: strip sensitive data from FCM payload, use tickle pattern
• 1520766 chore: update dockerfile
• dc34d29 Rewrite backend from FastAPI/Python to PocketBase/Go (#77)
• 060e1a2 Clear QvaPay credentials in .env.example
• de6dd29 fix: update uv.lock to resolve remaining Dependabot alerts
• 874b438 fix: update frontend dependencies to resolve vulnerabilities
• 5030a98 Merge pull request #17 from JimScope/dependabot/github_actions/actions/upload-artifact-6
• ddb46fd Merge pull request #49 from JimScope/dependabot/npm_and_yarn/frontend/multi-c5fe2c841a
• 1cae147 Merge pull request #46 from JimScope/dependabot/uv/backend/starlette-0.52.1
• 1ea8eed Merge pull request #57 from JimScope/dependabot/uv/backend/wrapt-2.1.1
• f916f8e Merge pull request #51 from JimScope/dependabot/uv/backend/protobuf-6.33.5
• 4cece32 Merge pull request #50 from JimScope/dependa...