Skip to main content

Changelog

What's new with Paddle Conditions.

Jul 31, 2026

Improvement
Spot Pages Match the Published Directory — The spot endpoint served every water body in the catalogue, not just the ones we publish. It now serves the curated list, matching the directory and the map.
Improvement
Tighter Limits on Sign-In Attempts — Sign-in, registration and password-reset attempts are now capped per network address as well as per email address, and the service refuses to start in production without bot protection configured.
Improvement
Accessibility Pass — The billing toggle now works with arrow keys the way a real radio group should, and announces the new price. Docs pages no longer nest two main regions. The FAQ keeps its focus outline, the mobile menu sits inside a proper navigation landmark, form labels are tied to their fields, icon-only buttons have names, and the location settings panel behaves like a real dialog with focus trapping and Escape to close.
Bug Fix
Signing In With Google No Longer Dead-Ends — If you registered with a password and then tried Google or Apple on the same address, you were told to verify your email first. No verification email was ever sent, so there was no way to do it. The email now goes out, and the message points somewhere real.
Bug Fix
Dam Release Warnings Now Show on the Dashboard — A reservoir with a dangerous dam release showed the warning on its own page but an ordinary score on the dashboard, because the dashboard was scoring without the release threshold. Both views now use the same information, so a no-go is a no-go wherever you see it.
Bug Fix
Weather Outages No Longer Look Like Calm Water — When a weather service was unreachable, the blank result was saved as if it were a real reading and served for up to a day. A failed fetch is now treated as a failure: the last good reading stays put and the system retries on a schedule instead of overwriting it with nothing.
Bug Fix
One Bad Station Stops Taking the Others Down With It — If a single river gauge was down, the readings from every other source for that spot were skipped too. Each source now stands on its own, so one outage costs you one reading instead of all of them.
Bug Fix
Sign-In Handoff No Longer Puts Tokens in the URL — Signing in on the website used to hand your session to the web app through the address bar. It now passes a single-use code that expires in a minute and can only be redeemed once, and the app trades that code for your session directly with the server. Nothing sensitive travels in a link any more.
Bug Fix
New Locations Stop Disappearing From the Dashboard — A location whose conditions could not be worked out yet was quietly left off the dashboard, which made a spot you had just added look like it never saved. It was saved the whole time. Locations now always show up, with the score held back until the data lands.

Jul 30, 2026

Improvement
Social Images Are JPEG and Actually Ship — Per-spot social images are now generated during deploy instead of being quietly dropped, so spot pages stop pointing at images that were never there. They are JPEG rather than PNG now, which roughly halves the size of each one.
Improvement
Faster Spot Pages — The map on a spot page now loads when you scroll near it rather than on arrival, so the page is interactive sooner.
Infrastructure
Supply Chain and Dependency Cleanup — All deploy workflows install with scripts disabled, React Router moved to a patched release, and a mismatched image library version that left the website's dependency tree in a broken state is resolved.
Bug Fix
Hardened Spot Names Against Injection — Spot names come from third-party station listings, so they are now treated as untrusted everywhere they are rendered. Page titles, meta tags, structured data and map popups all escape or strip markup. Three separate injection paths closed.
Bug Fix
Spot Pages No Longer Vanish When the API Hiccups — The spot directory, state pages and spot sitemap used to swallow API failures and build a perfectly happy site with zero spots in it. A failed build is now a failed build, and at request time an outage returns a 503 that tells crawlers to come back instead of a cacheable 200 that told them the spot was gone.
Bug Fix
Sign-In Reliability and Session Safety — Parallel requests could each try to renew your session at once, which the server read as a stolen token and signed you out everywhere. Renewals are now shared. A dropped connection or a rate limit no longer ends a valid session, signing out clears cached data so a shared browser cannot leak the previous account's spots, and signing out now revokes the session on the server too.

Apr 21, 2026

Infrastructure
Universal Links Groundwork — Added the Apple App Site Association (AASA) endpoint at paddleconditions.com/.well-known/apple-app-site-association. Stays 404 until the APPLE_APP_ID env var is set, so there's no risk of Apple's CDN caching a placeholder. Flips live automatically once App Store Connect provisions the real bundle ID. Foundation work for the upcoming native mobile apps.
Infrastructure
Shared Voice Lint Pipeline — Changelog and docs scaffolding now share one voice lint. Internal skills catch issues earlier and keep site updates consistent.

Apr 10, 2026

New Feature
Dam Release Safety Veto — River spots downstream of a dam now automatically get a NO_GO rating when the release rate exceeds a configured threshold. South Fork American River kicks to NO_GO above 3,000 CFS, Lake Natoma above 10,000 CFS. Applies only to downstream-of-dam water bodies where high releases create dangerous conditions.
New Feature
Five New California Reservoirs — Shasta Lake, Trinity Lake, New Melones Lake, Don Pedro Reservoir, and Pine Flat Lake are now live with CDEC reservoir monitoring. Adds about 12.4 million acre-feet of coverage across NorCal and Sierra paddling destinations.
New Feature
Curated Explore Map — The nearby spots map and directory now only show water bodies we have manually curated with data sources. Cuts out the noise from non-paddle-appropriate entries that were imported from public waterway databases but never vetted. Direct spot lookups and search are unchanged.
Infrastructure
Smarter Refresh Backoff — When a water body's data refresh fails repeatedly (bad station config, upstream down, permanent outage), the refresh loop now backs off exponentially instead of retrying every 15 minutes forever. 15 min for the first two failures, then 1 hour, then 6 hours, then 24 hours, then it gives up after about 10 days of consecutive failures. Successful fetches reset the counter. Cuts wasted API calls on broken spots and speeds up the refresh job for healthy ones.
Infrastructure
Station Allowlists for Setup — The reservoir setup script now accepts a stations allowlist so cross-watershed and unrelated stations do not pollute monitoring data. Large reservoirs like Shasta that sit near other facilities get only their own stations.
Infrastructure
Cross-Repo Dev Docs — CLAUDE.md files in each repo now cross-link to the workspace root, making shared conventions discoverable when working inside a single repo.
Bug Fix
Faster First Fetch for New Spots — Brand-new water bodies now populate data on the next refresh tick instead of waiting 24 hours after the first user adds them. Also fixes the case where a visitor browses a never-fetched spot from the directory: the fetch pipeline is nudged in the background so returning visitors see live conditions.

Apr 9, 2026

New Feature
Lake Oroville — Lake Oroville now available with full CDEC reservoir monitoring: storage, elevation, inflow/outflow, water temperature, and water quality from 9 nearby stations.
Infrastructure
Reservoir Setup Script — New reusable setup-reservoir script automates CDEC station discovery for adding future reservoirs. Discovers stations, probes sensors, and generates SQL in one command.