This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+8 more
ReleasePort's take
Light signalActions now employ a schema‑driven registry and enforce save‑time validation on explicit Save clicks.
Why it matters: Validate actions at save to prevent runtime errors; update consumers to trigger the explicit Save interaction before upgrading.
Summary
AI summaryActions are now schema-driven with save-time validation, package layering was flattened and codified in an RFC, and predefined events received descriptions.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Actions now use a schema-driven registry, replacing the legacy ContentActions component. Actions now use a schema-driven registry, replacing the legacy ContentActions component. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Save-time validation gates on every consumer using explicit Save click for actions. Save-time validation gates on every consumer using explicit Save click for actions. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Restored v1 mutex semantic allowing Dismiss flow and Start new flow to coexist. Restored v1 mutex semantic allowing Dismiss flow and Start new flow to coexist. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Every predefined event now ships with a one-line passive description in Events settings page. Every predefined event now ships with a one-line passive description in Events settings page. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Dismissing action chip remove button rebuilt as a plain <button> matching other chip variants. Dismissing action chip remove button rebuilt as a plain <button> matching other chip variants. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Promoted generic UI primitives to @usertour-packages/ui with userId prop for ColorPicker. Promoted generic UI primitives to @usertour-packages/ui with userId prop for ColorPicker. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Events list query gained secondary id order key to prevent reshuffling on refresh. Events list query gained secondary id order key to prevent reshuffling on refresh. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
SDK version bumped to 0.6.9. SDK version bumped to 0.6.9. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Dependency | Medium |
Actions chip's isEqual now routes through @usertour/helpers re-export instead of undeclared fast-deep-equal. Actions chip's isEqual now routes through @usertour/helpers re-export instead of undeclared fast-deep-equal. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Performance | Medium |
Launcher behavior's debounced auto-save now gates on validateActions check. Launcher behavior's debounced auto-save now gates on validateActions check. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Performance | Medium |
Switched project-init event seed to per-event upsert, improving backfilling for existing rows. Switched project-init event seed to per-event upsert, improving backfilling for existing rows. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Flattened packages/shared/* into packages/*, dropping unnecessary shared prefixes. Flattened packages/shared/* into packages/*, dropping unnecessary shared prefixes. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Refactor | Medium |
Outer red indicator reflects actual chip state inside for Actions. Outer red indicator reflects actual chip state inside for Actions. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Tailwind content globs collapsed to packages/**/src/** in apps/web and apps/sdk. Tailwind content globs collapsed to packages/**/src/** in apps/web and apps/sdk. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Other | Medium |
Added layering RFC defining L0–L5 package dependency rules and decision tree. Added layering RFC defining L0–L5 package dependency rules and decision tree. Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
This release brings the same schema-driven rewrite to Actions that v0.7.2 brought to Conditions, lands a long-overdue package-layering pass
that flattens shared/ and codifies the architecture in an RFC, and finally seeds and stabilizes the predefined-event list so Events settings
reads cleanly.
What's Changed
🧱 Actions (schema-driven replacement for the hand-rolled list)
- Replaced the legacy ContentActions component with a schema-driven registry parallel to Conditions: each action type (Step goto / Flow
dismiss / Flow start / Page navigate / JavaScript evaluate / Launcher / Banner / Checklist dismiss) is now a self-contained schema with its
own Summary, Editor, validate and normalize. - Save-time validation gates on every consumer with an explicit Save click — flow trigger, checklist item, launcher behavior, resource-center
block, step builder — so incomplete chips can't slip through. - Outer red indicator on button / question elements now reflects the actual chip state inside, keeping the visible error consistent with what
reaches storage. - Restored the v1 mutex semantic: Dismiss flow + Start new flow can coexist again (encoded as two pairwise sets against Step goto instead of
one transitive 3-set). - Launcher behavior's debounced auto-save now gates on the same validateActions check so partial chips never reach the DB, with the validator
hoisted to LauncherBuilder so subpage switches (Target / Tooltip modes) don't bypass it. The gate also respects actionType so a stale action
list under SHOW_TOOLTIP no longer blocks tooltip saves. - Dismiss-chip remove button rebuilt as a plain matching the other chip variants (the previously
pinned height to 24px and didn't snap to the chip edge).
📦 Package layering
- Flattened packages/shared/* into packages/* and dropped the shared- prefix where it had stopped carrying meaning: shared-editor → editor,
shared-hooks → hooks, shared-components → business-components; builder, contexts, finder, gql, i18n, assets move up to top level. - Promoted generic UI primitives (SelectPopover, ColorPicker, DateTimePicker, LoadingContainer, LocateSelect, ScaledPreviewContainer,
ErrorTooltip) from shared-components into @usertour-packages/ui. ColorPicker took a userId prop so it no longer drags useCurrentUserId() and
the Apollo hook tree into L1 UI. - Added a layering RFC at docs/architecture/packages.md that defines L0–L5, the dependency rules, the decision tree for new packages, and the
known drift it accepts.
🗂 Predefined events
- Every predefined event (PAGE_VIEWED, FLOW_STARTED, FLOW_ENDED, FLOW_STEP_, LAUNCHER_, BANNER_, RESOURCE_CENTER_, CHECKLIST_*,
QUESTION_ANSWERED, TOOLTIP_TARGET_MISSING) now ships with a one-line description written in agent-agnostic passive voice — meaning it stays
accurate whether the event is fired by the SDK, by user code via usertour.track(), or by the server-side API. Events settings page surfaces
them directly under each event name. - Switched the project-init event seed from a one-shot createMany to a per-event upsert, mirroring the existing attribute init, so re-running
init backfills displayName + description on existing predefined rows. - Events list query gained a secondary id order key so the predefined block stops reshuffling on every page refresh (a quirk left over from
the original createMany clustering every row at the same createdAt).
🧹 Misc
- Tailwind content globs in apps/web and apps/sdk collapsed to packages//src/ so package relocations don't silently drop styles again.
- Actions chip's isEqual now routes through @usertour/helpers' existing re-export instead of pulling fast-deep-equal as an undeclared
transitive. - SDK bumped to 0.6.9.
Full Changelog: https://github.com/usertour/usertour/compare/v0.7.2...v0.7.3
Breaking Changes
- Legacy ContentActions component replaced by schema‑driven action registry
- Save‑time validation gates all consumer saves (flow trigger, checklist item, launcher behavior, etc.) preventing incomplete chips
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About usertour
Usertour is an open-source user onboarding platform. It allows you to create in-app product tours, checklists, and surveys in minutes—effortlessly and with full control.The open-source alternative to Userflow and Appcues
Related context
Related tools
Beta — feedback welcome: [email protected]