deploybase Release Notes

Fixed projects created since 1 September deploying without their sites.deploybase.eu address: the build finished, but the dashboard showed no URL and the site returned a 404. New branch previews and share links had the same problem, and single-page apps deployed in that window did not get their deep-link fallback. Existing sites were not affected. The cause was on our side: the deep-link fix from 1 September configured CDN rules in a way our provider accepts for updates but rejects for new sites. If a project you created this week has no public URL, deploy it once more and the address appears within a minute.

Reloading or sharing a URL like yoursite.eu/dashboard/settings on a single-page app returned a 404 instead of your app. The first page load worked, so it only showed up on a refresh or a pasted link, and it affected production URLs, branch previews and custom domains alike. Custom 404.html pages had the same problem. The cause was on our side: the CDN rule that falls back to your app shell was configured in a way that never actually fired. If your build output has a 200.html, a _redirects catch-all, or a 404.html, redeploy once after this release and deep links will work.

deploybase.eu/open now shows the same numbers we look at every day: deployments, build minutes, success rate, bandwidth, form submissions and more, straight from the production database that serves the product. Nothing on the page is hand-edited, and we will not quietly drop a metric in a bad month. Every figure is served by a public API endpoint, so you can verify our claims yourself instead of taking our word for them. Only aggregate platform totals appear, never anything about your team or your sites. The page also explains why we publish this; the short version is that we think the internet gets better when companies show their work.

You can now add any email address as a recipient of a form's submissions, no deploybase account needed. Add your client's address in the form's settings and they get one confirmation email; nothing is sent until they click it. After that, every submission arrives in their inbox with the full content, so they never have to log in anywhere. Existing forms are unchanged until you add a recipient, and adding or removing one needs the admin role. Built for agencies: you run the site, your client answers the enquiries.

Creating an account is now protected against automated signups, and the check runs entirely on our own infrastructure. There's no puzzle to solve and no images to click — your browser quietly does a small piece of maths while you fill in the form. Nothing about you is sent to Google, Cloudflare, or any other bot-detection service, because there isn't one in the path. Signing in and signing up were already free of third-party requests; this keeps them that way. One thing to know: signing up with email and password now needs JavaScript enabled. Signing up with GitHub works either way.

When you point a domain at our nameservers, we now confirm the change by asking your domain's registry directly instead of waiting for public DNS caches to catch up. Delegation is typically confirmed within a minute of your registrar applying the change, where it could previously take hours. A new Check now button runs the same check on demand and, if your domain still points elsewhere, shows the exact nameservers we found so you know what's left to change. We also warn you when DNSSEC is enabled at your registrar, which silently blocks delegation until you turn it off there. Applies to domains using 'We host your DNS'; domains already connected are unaffected.

You can now let deploybase host your domain's DNS, in beta. Choose 'We host your DNS' when adding a custom domain and delegate your nameservers to us once. The apex domain and www are wired up automatically, SSL is issued without any verification records, and your domain stays registered where it is. This is the way around the classic apex problem: if your DNS provider doesn't support ALIAS records, the root domain simply couldn't point at us before. Domains already connected keep their current setup. This option appeared in our docs earlier but was never switched on in production. It's enabled now.

Every subprocessor we use is now listed publicly at deploybase.eu/subprocessors: what each one does, where it runs, and the legal basis for any data transfer. Each vendor has a stable deep link you can cite in your own privacy policy or DPA review. Most platforms bury this in a PDF or behind a sales call. We think you should be able to check it in ten seconds, no signup, no email gate.

Fixed search on docs.deploybase.eu hanging on 'Searching…' forever — the search index was silently missing from our docs builds, and every release now verifies it exists before shipping. The docs also got a redesign along the way: a landing page that shows the path from git push to live, clearer navigation with visibly clickable links throughout, and full keyboard and screen-reader support meeting WCAG 2.1 AA. Thanks to the user who reported the broken search.

Clicking a project's URL in the projects list now opens your live site, and clicking the repository name opens the repository — each in a new tab, marked with a small external-link icon. Clicking anywhere else on the row still opens the project itself. Projects with a failed or in-progress build now sort to the top of the list, so anything that needs your attention is the first thing you see. The framework badge is gone (the icon already told you), and the docs are now one click away from the top navigation, wherever you are in the app. Suggested by one of our first users.

You can now use Bun as your project's package manager. If your repository has a bun.lock or bun.lockb lockfile, builds detect it and install dependencies with bun install, frozen to your lockfile so versions resolve exactly as they do on your machine. You can also pick Bun explicitly in your project's build settings. As with every package manager, dependency lifecycle scripts stay disabled during install, so a compromised package can't run code in your build. Existing projects are unaffected, and if you set a custom build command as a Bun workaround, it keeps working — you can simply remove it now.

You can now erase your account and everything in it from Settings → Account, covering your right to erasure under GDPR Article 17 without emailing support. Requesting deletion starts a 14-day grace period: nothing is removed during it, your sites stay online, and you can cancel with one click. Once the period ends, erasure runs automatically and removes your projects, deployments, stored files, custom domains, form submissions, team data, and your sign-in identity. Invoices stay with Creem, our payment provider, for the 7 years tax law requires, and we keep one anonymous record that the deletion happened. Download your data first if you want a copy.

You can now upgrade, downgrade, or switch between monthly and annual billing directly from the billing page. Changes apply immediately: the unused portion of your current plan is prorated against the new price and settled on your existing payment method, with no new checkout. Previously, changing plans as an existing subscriber could start a second checkout and, in the worst case, charge you twice. That path is now closed: if you already have a subscription, starting a checkout is refused and the billing page routes you through the plan change instead. Moving to the Free plan works through cancellation, so you keep your paid features until the end of the period you've paid for.

Settings → Account now shows every record that identifies you as a person — your profile, the teams you belong to, invitations sent to your address, and feedback you've sent us — and lets you download the lot as JSON. That covers your right of access and data portability under GDPR Articles 15 and 20, without emailing support and waiting. Work owned by a team, like projects, deployments and forms, isn't part of it: those stay with the team when you leave. Downloading changes nothing, and support@deploybase.eu still handles anything the page doesn't cover.

If your account has a passkey, deploybase now asks for it as soon as you've entered your email — one tap with Face ID, Touch ID, or your security key instead of typing a password. Password and two-factor sign-in keep working exactly as before. You can add a passkey any time in your account's security settings.

You can now create your deploybase account and sign in with GitHub — no password to invent, and you're ready to connect a repository the moment you land in the dashboard. Existing email accounts keep working unchanged.

Builds now detect your package manager from your lockfile — pnpm, npm, Yarn, or Bun — and install dependencies with it, so lockfiles resolve exactly as they do on your machine. Existing projects keep their configured install command; you can override the detected choice in your project's build settings.

You can now point any HTML form at a deploybase endpoint and collect submissions. They're stored in the EU, filtered for spam without CAPTCHAs, and emailed to your team.

You can now deploy and manage your sites without leaving the terminal. Log in, trigger deploys, tail build logs, check status, and open your site — all from the CLI.