logo-light
Buy Now

Changelog

FastReact is actively maintained. Here's what we've shipped, newest first.

November security updates

  • Patched two critical issues in the backend networking and certificate libraries, plus a batch of high-severity fixes across the backend and frontends
  • Updated Vite, Zod and the core backend libraries
  • The fastapi command now starts the app with its security headers in place

Security patches and the latest OpenAI SDK

  • Security patches for the login token library and other dependencies, reviewed and shipped as they came in
  • Upgraded to OpenAI SDK 3; the AI copilot works unchanged
  • Refreshed the generated API client, fixing a case where custom request headers could be silently dropped

Security updates and upkeep

  • Dependency security updates are reviewed and shipped as they come in, so what you download is current
  • A published security policy: how to report an issue, and how a fix reaches you even after you have customised the kit
  • A round of backend fixes from a full type-check of the codebase

Better instructions for your AI coding agent

  • The instructions file that ships with the kit no longer asks your agent to stop for approval before every change, so it gets on with the work
  • Added the things agents most often get wrong here: how errors are raised and returned to the frontend, and how pages load their data
  • Setting up a new project now keeps the link to the documentation index, so your agent reads the docs instead of guessing

Define a plan feature once and the whole app follows

  • Declare a feature in one place and the admin form, the billing page and the limits all follow, with no frontend work
  • The billing page now leads with your plan and shows live usage meters for every feature, not just AI tokens
  • Set a limit to -1 for unlimited, and switch AI on or off per plan tier, even for customers holding credits
  • Plan JSON with missing keys or typos no longer breaks anything: limits fall back safely and the admin form warns you as you type

Admin tables: sort, filter, and page through long lists

  • Organizations, users and members now sort by any column and page through results, so the admin screens stay usable as your data grows
  • Invitations show who has already joined next to who has not, with a status filter and live counts for pending, expired and accepted
  • Sending an invitation opens in a dialog, matching the rest of the admin screens, and the list gains its own search
  • Heads up if you call the API directly: the invitations endpoint is now /invitations instead of /invitations/pending

Billing reliability: credit purchases fulfill exactly once

  • Credit pack purchases now credit exactly once, even when Stripe redelivers the same webhook
  • The billing page verifies every purchase after checkout, so customers get their credits even if a webhook is lost
  • AI credit spending is atomic under concurrent calls, and the usage card reports a truthful state when no plan is assigned
  • New regression tests pin the critical auth, tenancy, and billing behaviors, and CI now fails if the generated API client drifts from the backend

Fully static frontends, no Node server

  • The app and the landing now build to plain static files: the only server you deploy is the FastAPI backend
  • The landing is prerendered at build time, so search engines get real HTML and pages serve instantly from any static host or CDN
  • Ready-made deploy configs ship in the repo (vercel.json, staticwebapp.config.json), so Vercel and Azure need no manual routing setup
  • Every deployment guide updated to match, including a rebuilt self-hosting guide with two ways to serve the frontends

Serve the app from a sub-path

  • Host the dashboard at yourdomain.com/app instead of its own subdomain: set the Vite base and router basename, and every link, redirect, image, and Stripe return URL follows
  • A lint rule now enforces base-safe redirects, so code you add stays sub-path ready
  • New deployment guide with the exact hosting change for each provider setup

Security hardening across the stack

  • Full security audit of authentication, sessions, Google sign-in, billing and the API surface, with every finding fixed and the accepted trade-offs documented
  • Google sign-in hardened against account takeover: unverified emails are rejected, and the sign-in flow is bound to the browser that started it
  • Rate limiting on abuse-prone endpoints, strict security headers on every response, password changes that require the current password and sign out other devices, and reset links that are useless if the database leaks
  • All dependencies patched against known vulnerabilities and monitored with automated security alerts

Refreshed app interface

  • A consistent page header and a centered, responsive layout on every page, so the app looks polished on laptops and wide screens alike
  • Cleaner forms and buttons with roomier spacing and inline validation, a reusable search-and-filter toolbar, and a tidy "..." menu for table row actions
  • Create Organization now opens in place as a modal instead of a separate page
  • A reworked note editor and AI copilot in an aligned two-panel layout

Streaming data loading

  • Routes fetch in React Router loaders and stream the result with Suspense, so navigation lands instantly and fills in, instead of waiting on a blank screen
  • Loading skeletons, error states and refresh-after-save come from the framework, so there is no loading flag or error flag left for you to write
  • Forms read their saved values from the loader, which turns "are there unsaved changes?" into a single comparison
  • One documented pattern across every route, with the reasoning written up in the architecture docs

Improved error handling

  • Clearer error messages across the app, so users see what actually went wrong
  • One consistent error format from the API, making failures easy to handle in your own code
  • Cleaner out of the box: lint, type checks and builds all run without a single warning

Node 24 LTS & landing refresh

  • Starter kit now runs on Node 24 LTS
  • Redesigned demo landing with new Pricing, Showcase, and Newsletter sections
  • Refreshed backend and frontend dependencies

Configurable AI model & credit packs

  • Choose the LLM your copilot uses with a single setting (FS_OPENAI_MODEL)
  • Define your own credit-pack tiers — token sizes and prices — without code changes
  • Ships current GPT-4.1 and GPT-5 model pricing, so usage costs are accurate out of the box

AI Copilot + usage-based billing

  • New AI copilot: draft, rewrite, summarize and change tone right inside your docs
  • Token-metered credit billing with purchasable credit packs
  • Admin AI-usage dashboard with per-user and per-organization token tracking
  • Refreshed demo landing with real product screenshots

Demo landing repositioned as an AI copilot

  • The bundled demo landing now presents AcmeAI as a B2B AI writing copilot
  • New hero, token-metered pricing tiers, and reframed feature & FAQ copy
  • Refined sun/moon theme toggle and a social-share preview image out of the box

SEO-ready landing page

  • Your starter-kit landing now ships SEO-optimized out of the box
  • Self-referencing canonical URLs and a single meta description on every route
  • Open Graph and Twitter card tags for rich social link previews

AcmeAI demo app & branding refresh

  • New AcmeAI sample application that shows the AI-ready backend in action
  • Refreshed logo, favicon, and landing-page screenshots
  • Reusable SEO component: self-referencing canonicals and one meta description per page
Initial release

FastReact launch

  • Production-ready FastAPI + React (Vite) foundation
  • Google OAuth and email/password authentication
  • Stripe billing, B2B multi-tenancy, and admin + user dashboards
  • AI-ready backend with a streaming notes demo

Want these updates in your inbox? Join the newsletter.

logo-light

Ship production-ready SaaS applications with FastAPI + React. Complete authentication, payments, multi-tenancy, and admin dashboards - deploy anywhere with zero vendor lock-in.

Product

Documentation Features Pricing Changelog Blog FastAPI + React React Boilerplate FastSvelte

Community

GitHub Newsletter Affiliates Support

Legal

Privacy Policy Terms of Service License

© 2026 FastReact. All rights reserved.

🌼 Made with daisyUI

FASTREACT