@django-stack/cli 0.8.1 → 0.9.0

package/dist/index.d.ts

@@ -158,7 +158,7 @@ export declare const STACK_OPTIONS: readonly [{
     readonly value: "on";
     readonly label: "On";
     readonly hint: "in the admin and by email";
-    readonly generated: false;
+    readonly generated: true;
   }, {
     readonly value: "off";
     readonly label: "Off";
@@ -233,6 +233,28 @@ export declare const STACK_OPTIONS: readonly [{
     readonly hint: "any S3-compatible service; credentials later";
     readonly generated: true;
   }];
+}, {
+  readonly key: "errors";
+  readonly flag: "--errors";
+  readonly message: "Error reports";
+  readonly description: "How you hear about errors in production";
+  readonly bits: 2;
+  readonly values: readonly [{
+    readonly value: "email";
+    readonly label: "Email";
+    readonly hint: "to the superusers, and in the admin";
+    readonly generated: true;
+  }, {
+    readonly value: "sentry";
+    readonly label: "Sentry";
+    readonly hint: "or GlitchTip, with SENTRY_DSN";
+    readonly generated: false;
+  }, {
+    readonly value: "off";
+    readonly label: "Off";
+    readonly hint: "the logs only";
+    readonly generated: true;
+  }];
 }];
 type Options = (typeof STACK_OPTIONS)[number];
 type StackKey = Options["key"];
@@ -272,6 +294,10 @@ interface ScaffoldOptions {
   localS3?: boolean;
   /** Page analytics with the bundled Umami (the `analytics` profile). */
   analytics?: boolean;
+  /** Content Studio's notifications app; on by default. */
+  notifications?: boolean;
+  /** How errors are reported in production; by email by default. */
+  errors?: Stack["errors"];
   /** The cache backend; the database by default. */
   cache?: Stack["cache"];
   /** The task queue; Huey where the cache is by default. */
@@ -295,6 +321,11 @@ interface ScaffoldResult {
 }
 /** The `.env` values of a cache and a task queue: CACHE_URL, TASKS_URL and TASK_WORKERS. */
 export declare function cacheEnv(stack: Pick<Stack, "cache" | "tasks">): Record<string, string>;
+/**
+ * Adds or removes Content Studio's notifications app in the text of
+ * `backend/config/settings.py`. Throws when it can't find where it goes.
+ */
+export declare function setNotificationsApp(settingsText: string, on: boolean): string;
 /** Whether `.env` values use the Valkey service (the `valkey` profile). */
 export declare function usesValkey(env: Record<string, string | undefined>): boolean;
 /** A valid project name from a directory name: `My Site` becomes `my-site`. */

package/dist/index.js

@@ -1 +1 @@
-export { P as DEFAULT_STACK, i as FRONTENDS, F as NAMED_PRESETS, L as STACK_OPTIONS, v as VERSION, o as cacheEnv, z as decodePreset, B as encodePreset, b as generateProjectSecrets, x as generateSecret, l as normalizeDatabaseUrl, et as parseEnv, V as pendingChoices, n as productionEnv, H as resolvePreset, Y as runDoctor, d as scaffold, nt as setEnvValues, p as toProjectName, h as usesValkey, r as validateDomain, g as validateProjectName } from "./production-CGkI7oNe.js";
+export { F as DEFAULT_STACK, i as FRONTENDS, I as NAMED_PRESETS, R as STACK_OPTIONS, y as VERSION, o as cacheEnv, B as decodePreset, V as encodePreset, x as generateProjectSecrets, S as generateSecret, l as normalizeDatabaseUrl, tt as parseEnv, H as pendingChoices, n as productionEnv, U as resolvePreset, X as runDoctor, d as scaffold, rt as setEnvValues, f as setNotificationsApp, m as toProjectName, g as usesValkey, r as validateDomain, _ as validateProjectName } from "./production-M2SsuuBb.js";

package/dist/{production-CGkI7oNe.js → production-M2SsuuBb.js}

@@ -582,7 +582,7 @@ const STACK_OPTIONS = [
 			value: "on",
 			label: "On",
 			hint: "in the admin and by email",
-			generated: false
+			generated: true
 		}, {
 			value: "off",
 			label: "Off",
@@ -665,6 +665,33 @@ const STACK_OPTIONS = [
 			hint: "any S3-compatible service; credentials later",
 			generated: true
 		}]
+	},
+	{
+		key: "errors",
+		flag: "--errors",
+		message: "Error reports",
+		description: "How you hear about errors in production",
+		bits: 2,
+		values: [
+			{
+				value: "email",
+				label: "Email",
+				hint: "to the superusers, and in the admin",
+				generated: true
+			},
+			{
+				value: "sentry",
+				label: "Sentry",
+				hint: "or GlitchTip, with SENTRY_DSN",
+				generated: false
+			},
+			{
+				value: "off",
+				label: "Off",
+				hint: "the logs only",
+				generated: true
+			}
+		]
 	}
 ];
 /**
@@ -945,7 +972,8 @@ function projectManifest(project) {
 function projectStack(project) {
 	const fromEnv = {
 		analytics: project.profiles.includes("analytics") ? "umami" : "off",
-		...project.env.CACHE_URL === void 0 ? {} : cacheStack(project.env)
+		...project.env.CACHE_URL === void 0 ? {} : cacheStack(project.env),
+		...notificationsStack(project)
 	};
 	const { preset } = projectManifest(project);
 	if (preset) try {
@@ -960,6 +988,12 @@ function projectStack(project) {
 		storage: project.profiles.includes("s3") ? "s3" : "local"
 	};
 }
+/** Notifications are on when the backend's INSTALLED_APPS has Content Studio's notifications app. */
+function notificationsStack(project) {
+	const settings = join(project.directory, "backend", "config", "settings.py");
+	if (!existsSync(settings)) return {};
+	return { notifications: /^ *["']content_studio\.notifications["'],/m.test(readFileSync(settings, "utf8")) ? "on" : "off" };
+}
 const REDIS = /^(redis|rediss|valkey|valkeys):/;
 /**
 * The cache and the tasks a project's `.env` runs. Projects from before 0.7
@@ -1155,6 +1189,25 @@ function cacheEnv(stack) {
 		...TASK_ENV[taskQueue(stack)]
 	};
 }
+/** The line of Content Studio's notifications app in the backend's INSTALLED_APPS. */
+const NOTIFICATIONS_APP = "    \"content_studio.notifications\",  # notifications in the admin and by email\n";
+const NOTIFICATIONS_PATTERN = /^ *["']content_studio\.notifications["'],.*\n/m;
+/**
+* Adds or removes Content Studio's notifications app in the text of
+* `backend/config/settings.py`. Throws when it can't find where it goes.
+*/
+function setNotificationsApp(settingsText, on) {
+	const present = NOTIFICATIONS_PATTERN.test(settingsText);
+	if (!on) return settingsText.replace(NOTIFICATIONS_PATTERN, "");
+	if (present) return settingsText;
+	const after = [
+		/^ *["']content_studio\.contrib\.password_reset["'],.*\n/m,
+		/^ *["']content_studio\.media_library["'],.*\n/m,
+		/^ *["']content_studio["'],.*\n/m
+	].find((pattern) => pattern.test(settingsText));
+	if (!after) throw new Error("backend/config/settings.py has no \"content_studio\" in INSTALLED_APPS; add \"content_studio.notifications\" there yourself.");
+	return settingsText.replace(after, (line) => line + NOTIFICATIONS_APP);
+}
 /** Whether `.env` values use the Valkey service (the `valkey` profile). */
 function usesValkey(env) {
 	return [env.CACHE_URL, env.TASKS_URL].some((url) => /^(redis|rediss|valkey|valkeys):\/\/cache[:/]/.test(url ?? ""));
@@ -1256,6 +1309,10 @@ function scaffold(options) {
 		const rendered = render(text, values);
 		if (rendered !== text) writeFileSync(file, rendered);
 	}
+	if (options.notifications === false) {
+		const settings = join(target, "backend", "config", "settings.py");
+		writeFileSync(settings, setNotificationsApp(readFileSync(settings, "utf8"), false));
+	}
 	if (options.timeZone && options.timeZone !== "UTC") {
 		const settings = join(target, "backend", "config", "settings.py");
 		const text = readFileSync(settings, "utf8");
@@ -1285,6 +1342,7 @@ function scaffold(options) {
 	env = setEnvValues(env, { COMPOSE_PROFILES: profiles.join(",") });
 	if (options.ports) env = setEnvValues(env, portValues(parseEnv(env), options.ports));
 	if (!options.demoContent) env = setEnvValues(env, { SEED_DEMO_CONTENT: "0" });
+	if (options.errors === "off") env = setEnvValues(env, { ERRORS: "off" });
 	writeFileSync(join(target, ".env"), env, { mode: 384 });
 	writeFileSync(join(target, ".env.example"), envExample);
 	rmSync(join(target, "env.example"));
@@ -1441,4 +1499,4 @@ function productionEnv(devEnv, options) {
 		todo
 	};
 }
-export { isDockerDown as $, projectUrls as A, encodePreset as B, RUN_ENV as C, findProjectDirectory as D, composeOutput as E, NAMED_PRESETS as F, chooseFreePorts as G, resolvePreset as H, PROMPT_ORDER as I, portValues as J, describeMove as K, STACK_OPTIONS as L, readProject as M, runningServices as N, parseProfiles as O, DEFAULT_STACK as P, dockerRunning as Q, applies as R, RUN_DOMAIN as S, compose as T, stackOption as U, pendingChoices as V, DEV_PORTS as W, checkTools as X, runDoctor as Y, dockerNotRunning as Z, validateTimeZone as _, LOCAL_S3 as a, generateProjectSecrets as b, lockBackend as c, scaffold as d, parseEnv as et, timeZones as f, validateProjectName as g, usesValkey as h, FRONTENDS as i, readLocalRun as j, projectStack as k, normalizeDatabaseUrl as l, umamiEnv as m, productionEnv as n, setEnvValues as nt, cacheEnv as o, toProjectName as p, envPorts as q, validateDomain as r, localS3 as s, missingS3 as t, quoteEnvValue as tt, relativeDirectory as u, CLI_VERSION as v, activeProject as w, generateSecret as x, PACKAGE_NAME as y, decodePreset as z };
+export { dockerRunning as $, projectStack as A, decodePreset as B, RUN_DOMAIN as C, composeOutput as D, compose as E, DEFAULT_STACK as F, DEV_PORTS as G, pendingChoices as H, NAMED_PRESETS as I, envPorts as J, chooseFreePorts as K, PROMPT_ORDER as L, readLocalRun as M, readProject as N, findProjectDirectory as O, runningServices as P, dockerNotRunning as Q, STACK_OPTIONS as R, generateSecret as S, activeProject as T, resolvePreset as U, encodePreset as V, stackOption as W, runDoctor as X, portValues as Y, checkTools as Z, validateProjectName as _, LOCAL_S3 as a, PACKAGE_NAME as b, lockBackend as c, scaffold as d, isDockerDown as et, setNotificationsApp as f, usesValkey as g, umamiEnv as h, FRONTENDS as i, projectUrls as j, parseProfiles as k, normalizeDatabaseUrl as l, toProjectName as m, productionEnv as n, quoteEnvValue as nt, cacheEnv as o, timeZones as p, describeMove as q, validateDomain as r, setEnvValues as rt, localS3 as s, missingS3 as t, parseEnv as tt, relativeDirectory as u, validateTimeZone as v, RUN_ENV as w, generateProjectSecrets as x, CLI_VERSION as y, applies as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@django-stack/cli",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "The production-ready Django, batteries included stack. Create and manage DjangoStack projects: a Django backend, a frontend, Postgres and Docker Compose in one command.",
   "license": "MIT",
   "author": "Leon van der Grient",

package/templates/backend/Dockerfile

@@ -20,16 +20,15 @@ WORKDIR /app
 FROM base AS deps
 COPY pyproject.toml uv.lock* ./
 COPY vendor/ vendor/
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --no-dev --no-install-project
+# No BuildKit cache mounts: Railway rejects them, and the layer is cached anyway.
+RUN uv sync --no-dev --no-install-project --no-cache
 
 # Development runs as root, so files the container writes into the mounted
 # source (such as new migrations) work on every host. Production does not.
 # The entrypoint runs with sh, so it works without the executable bit (the
 # mounted source keeps the host's file modes).
 FROM deps AS dev
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --no-install-project
+RUN uv sync --no-install-project --no-cache
 ENTRYPOINT ["sh", "/app/entrypoint.sh"]
 CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
 
@@ -44,4 +43,4 @@ EXPOSE 8000
 HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=5 \
     CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/readyz', timeout=4)"
 ENTRYPOINT ["sh", "/app/entrypoint.sh"]
-CMD ["gunicorn", "config.asgi:application", "--worker-class", "uvicorn_worker.UvicornWorker", "--bind", "0.0.0.0:8000", "--workers", "3", "--access-logfile", "-", "--no-control-socket"]
+CMD ["gunicorn", "config.asgi:application", "--worker-class", "uvicorn_worker.UvicornWorker", "--bind", "0.0.0.0:8000", "--workers", "3", "--no-control-socket"]

package/templates/backend/config/settings.py

@@ -38,6 +38,7 @@ INSTALLED_APPS = [
     "content_studio",
     "content_studio.media_library",
     "content_studio.contrib.password_reset",
+    "content_studio.notifications",  # notifications in the admin and by email
     "django_stack",
     "content",
     # Last: builds the API routes once every model is exposed.
@@ -45,6 +46,7 @@ INSTALLED_APPS = [
 ]
 
 MIDDLEWARE = [
+    "django_stack.logs.RequestIdMiddleware",  # request IDs and the access log
     "django.middleware.security.SecurityMiddleware",
     "whitenoise.middleware.WhiteNoiseMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",

package/templates/backend/config/studio.py

@@ -10,12 +10,16 @@ from content_studio.contrib.huey import HueyAdapter
 from content_studio.dashboard.tasks import TaskDashboard
 from content_studio.extensions import UserMenuLink
 from django_stack.analytics import UmamiProvider
+from django_stack.studio import SystemLink, SystemPage
 
 
 class SiteStudio(ContentStudioSite):
     extensions = [
         TaskDashboard(adapter=HueyAdapter()),
         UserMenuLink(url="/tasks/", label="Tasks", icon="ph-bold ph-queue"),
+        # Superusers only: the health checks and the latest error reports.
+        SystemPage(),
+        SystemLink(),
     ]
 
     # Page analytics from the bundled Umami when UMAMI_URL is set (see

package/templates/backend/content/apps.py

@@ -1,6 +1,10 @@
-from django.apps import AppConfig
+from django.apps import AppConfig, apps
 
 
 class ContentConfig(AppConfig):
     name = "content"
     verbose_name = "Content"
+
+    def ready(self):
+        if apps.is_installed("content_studio.notifications"):
+            from . import notifications  # noqa: F401 - registers the events

package/templates/backend/content/notifications.py

@@ -0,0 +1,36 @@
+"""
+The notifications of the site, with Content Studio's notifications app
+(`content_studio.notifications` in INSTALLED_APPS). Editors get them in
+the admin and, when they leave them unread, in an email digest. Each
+editor picks which events they get on their settings page.
+
+Register your own events here, and send them with notify(); see
+https://djangocontentstudio.org for the API.
+"""
+
+from content_studio.notifications import notify, register_event
+from django.db.models.signals import post_save
+from django.dispatch import receiver
+from django.utils.translation import gettext_lazy as _
+
+from .models import FormSubmission
+
+FORM_SUBMITTED = register_event(
+    "site.form_submitted",
+    _("Contact form messages"),
+    _("A visitor sent a message with the contact form."),
+)
+
+
+@receiver(post_save, sender=FormSubmission, dispatch_uid="content_form_submitted")
+def notify_form_submitted(sender, instance, created, raw=False, **kwargs):
+    """Every editor who may read the messages hears about a new one."""
+    if created and not raw:
+        notify(
+            FORM_SUBMITTED.key,
+            title=_("Message from %(name)s"),
+            # The visitor's text goes in params: a "%" in it stays text.
+            body=_("%(message)s"),
+            params={"name": instance.name, "message": instance.message[:200]},
+            target=instance,
+        )

package/templates/backend/content/tests/test_api.py

@@ -5,6 +5,7 @@ Run them with `pnpm test` at the project root.
 """
 
 import pytest
+from django.apps import apps
 from django.conf import settings
 from rest_framework.test import APIClient
 
@@ -69,5 +70,22 @@ def test_contact_form(seeded):
     assert FormSubmission.objects.filter(email="ada@example.com").exists()
 
 
+@pytest.mark.skipif(not apps.is_installed("content_studio.notifications"), reason="notifications are off")
+def test_contact_form_notifies_the_editors(seeded, django_capture_on_commit_callbacks):
+    from content_studio.notifications.models import Notification
+    from django.contrib.auth import get_user_model
+
+    editor = get_user_model().objects.create_superuser("editor", "editor@example.com", "x")
+    with django_capture_on_commit_callbacks(execute=True):
+        APIClient().post(
+            "/api/content.formsubmission",
+            {"name": "Ada", "email": "ada@example.com", "message": "100% sure"},
+            format="json",
+        )
+    notification = Notification.objects.get(recipient=editor, event="site.form_submitted")
+    assert notification.get_title() == "Message from Ada"
+    assert notification.get_body() == "100% sure"
+
+
 def test_read_key_cannot_read_submissions(reader):
     assert reader.get("/api/content.formsubmission").status_code == 403

package/templates/backend/pyproject.toml

@@ -5,7 +5,7 @@ description = "The Django backend of {{project_name}}."
 requires-python = ">=3.12"
 dependencies = [
     "Django>=6.1,<6.2",
-    "django-stack[server,s3]>=0.8.1",
+    "django-stack[server,s3]>=0.9.0",
     "django-headless[schema]>=1.1.1",
     "django-content-studio[images,huey]>=1.11.0",
 ]

package/templates/base/Caddyfile

@@ -27,6 +27,12 @@
 	header ?X-Frame-Options "DENY"
 	header -Server
 
+	# A request ID for every request: Django and the frontend add it to
+	# their log lines and return it in X-Request-ID, and Caddy's own log
+	# line carries it as request_id. One sent by the client is replaced.
+	request_header X-Request-ID {http.request.uuid}
+	log_append request_id {http.request.uuid}
+
 	# Uploads, when media is stored on the server instead of S3. No scripts
 	# run from uploaded files, whatever their type.
 	handle_path /media/* {
@@ -59,6 +65,6 @@
 
 	log {
 		output stdout
-		format console
+		format json
 	}
 }

package/templates/base/compose.yaml

@@ -26,6 +26,14 @@ x-hardened: &hardened
   cap_drop:
     - ALL
 
+# Every service: Docker keeps at most 5 log files of 10 MB, so logs never
+# fill the disk.
+x-logging: &logging
+  driver: json-file
+  options:
+    max-size: 10m
+    max-file: "5"
+
 x-frontend-env: &frontend-env
   SITE_URL: ${SITE_URL}
   API_URL: http://backend:8000/api
@@ -60,6 +68,14 @@ x-backend-health: &backend-health
   start_period: 60s
   retries: 30
 
+# The worker stamps a heartbeat every minute; unhealthy when it stopped.
+x-worker-health: &worker-health
+  test: ["CMD", "python", "manage.py", "worker_alive"]
+  interval: 30s
+  timeout: 20s
+  start_period: 120s
+  retries: 3
+
 services:
   # Development ------------------------------------------------------------
 
@@ -78,6 +94,7 @@ services:
       - "127.0.0.1:${BACKEND_PORT:-8000}:8000"
     depends_on: *backend-depends
     healthcheck: *backend-health
+    logging: *logging
     restart: unless-stopped
 
   worker:
@@ -96,6 +113,8 @@ services:
     depends_on:
       backend:
         condition: service_healthy
+    healthcheck: *worker-health
+    logging: *logging
     restart: unless-stopped
 
   frontend:
@@ -112,6 +131,7 @@ services:
     depends_on:
       backend:
         condition: service_healthy
+    logging: *logging
     restart: unless-stopped
 
   mailpit:
@@ -119,6 +139,7 @@ services:
     image: axllent/mailpit:v1.27
     ports:
       - "127.0.0.1:${MAIL_PORT:-8025}:8025"
+    logging: *logging
     restart: unless-stopped
 
   # A local S3 service, so development runs the same storage code as
@@ -132,6 +153,7 @@ services:
       - s3data:/data
     ports:
       - "127.0.0.1:${S3_PORT:-8333}:8333"
+    logging: *logging
     restart: unless-stopped
 
   # Production -------------------------------------------------------------
@@ -160,6 +182,7 @@ services:
       resources:
         limits:
           memory: 768M
+    logging: *logging
     restart: unless-stopped
 
   worker-prod:
@@ -185,13 +208,13 @@ services:
     depends_on:
       backend-prod:
         condition: service_healthy
-    healthcheck:
-      disable: true
+    healthcheck: *worker-health
     deploy:
       replicas: ${TASK_WORKERS:-1}
       resources:
         limits:
           memory: 512M
+    logging: *logging
     restart: unless-stopped
 
   frontend-prod:
@@ -212,6 +235,7 @@ services:
       resources:
         limits:
           memory: 512M
+    logging: *logging
     restart: unless-stopped
 
   # The only service with public ports: HTTPS for SITE_URL with a
@@ -244,6 +268,7 @@ services:
       resources:
         limits:
           memory: 256M
+    logging: *logging
     restart: unless-stopped
 
   # Shared -----------------------------------------------------------------
@@ -276,6 +301,7 @@ services:
       resources:
         limits:
           memory: 512M
+    logging: *logging
     restart: unless-stopped
 
   db:
@@ -298,6 +324,7 @@ services:
       resources:
         limits:
           memory: 1G
+    logging: *logging
     restart: unless-stopped
 
   # Valkey (the valkey profile), for CACHE_URL or TASKS_URL redis://cache.
@@ -318,6 +345,7 @@ services:
       resources:
         limits:
           memory: 256M
+    logging: *logging
     restart: unless-stopped
 
 volumes:

package/templates/base/env.example

@@ -114,3 +114,20 @@ BACKUP_TIME=03:00
 BACKUP_KEEP=14
 BACKUP_MEDIA=1
 BACKUP_S3_BUCKET=
+# Requested after each daily backup: the URL of a Healthchecks.io check or
+# an Uptime Kuma push monitor, which alerts you when the pings stop.
+BACKUP_PING_URL=
+
+# Error reports (with DJANGO_DEBUG=0): each new error of the backend, the
+# worker or a backup is mailed to ERROR_EMAIL (comma separated) or, when it
+# is empty, to the superusers, and shows in the admin's notifications. The
+# same error is mailed once an hour at most. ERRORS=off turns it off.
+ERRORS=email
+ERROR_EMAIL=
+
+# Logs: one JSON object per line in production, plain text in development
+# (LOG_FORMAT=json or plain). LOG_ACCESS=0 turns off Django's access log.
+# See the logs page of the DjangoStack docs.
+# LOG_FORMAT=json
+# LOG_LEVEL=INFO
+# LOG_ACCESS=1

package/templates/frontend-astro/Dockerfile

@@ -9,8 +9,8 @@ ENV ASTRO_TELEMETRY_DISABLED=1
 FROM base AS deps
 COPY package.json package-lock.json* ./
 COPY vendor/ vendor/
-RUN --mount=type=cache,target=/root/.npm \
-    if [ -f package-lock.json ]; then npm ci; else npm install; fi
+# No BuildKit cache mounts: Railway rejects them, and the layer is cached anyway.
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
 
 FROM deps AS dev
 EXPOSE 3000

package/templates/frontend-astro/package.json

@@ -16,7 +16,7 @@
     "@astrojs/node": "^11.1.9",
     "@astrojs/rss": "^4.0.19",
     "@django-headless/client": "^1.1.1",
-    "@django-stack/utils": "^0.8.1",
+    "@django-stack/utils": "^0.9.0",
     "astro": "^7.4.5"
   },
   "devDependencies": {

package/templates/frontend-next/Dockerfile

@@ -9,8 +9,8 @@ ENV NEXT_TELEMETRY_DISABLED=1
 FROM base AS deps
 COPY package.json package-lock.json* ./
 COPY vendor/ vendor/
-RUN --mount=type=cache,target=/root/.npm \
-    if [ -f package-lock.json ]; then npm ci; else npm install; fi
+# No BuildKit cache mounts: Railway rejects them, and the layer is cached anyway.
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
 
 FROM deps AS dev
 EXPOSE 3000

package/templates/frontend-next/package.json

@@ -13,9 +13,9 @@
   },
   "dependencies": {
     "@django-headless/client": "^1.1.1",
-    "@django-stack/next": "^0.8.1",
-    "@django-stack/react": "^0.8.1",
-    "@django-stack/utils": "^0.8.1",
+    "@django-stack/next": "^0.9.0",
+    "@django-stack/react": "^0.9.0",
+    "@django-stack/utils": "^0.9.0",
     "next": "^16.4.4",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",

package/templates/frontend-nuxt/Dockerfile

@@ -9,8 +9,8 @@ ENV NUXT_TELEMETRY_DISABLED=1
 FROM base AS deps
 COPY package.json package-lock.json* ./
 COPY vendor/ vendor/
-RUN --mount=type=cache,target=/root/.npm \
-    if [ -f package-lock.json ]; then npm ci --ignore-scripts; else npm install --ignore-scripts; fi
+# No BuildKit cache mounts: Railway rejects them, and the layer is cached anyway.
+RUN if [ -f package-lock.json ]; then npm ci --ignore-scripts; else npm install --ignore-scripts; fi
 
 FROM deps AS dev
 EXPOSE 3000

package/templates/frontend-nuxt/package.json

@@ -15,8 +15,8 @@
   },
   "dependencies": {
     "@django-headless/client": "^1.1.1",
-    "@django-stack/utils": "^0.8.1",
-    "@django-stack/vue": "^0.8.1",
+    "@django-stack/utils": "^0.9.0",
+    "@django-stack/vue": "^0.9.0",
     "nuxt": "^4.6.3",
     "nuxt-security": "^2.7.0",
     "vue": "^3.5.44",

package/templates/frontend-sveltekit/Dockerfile

@@ -8,8 +8,8 @@ WORKDIR /app
 FROM base AS deps
 COPY package.json package-lock.json* ./
 COPY vendor/ vendor/
-RUN --mount=type=cache,target=/root/.npm \
-    if [ -f package-lock.json ]; then npm ci; else npm install; fi
+# No BuildKit cache mounts: Railway rejects them, and the layer is cached anyway.
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
 
 FROM deps AS dev
 EXPOSE 3000

package/templates/frontend-sveltekit/package.json

@@ -19,8 +19,8 @@
   },
   "dependencies": {
     "@django-headless/client": "^1.1.1",
-    "@django-stack/svelte": "^0.8.1",
-    "@django-stack/utils": "^0.8.1"
+    "@django-stack/svelte": "^0.9.0",
+    "@django-stack/utils": "^0.9.0"
   },
   "devDependencies": {
     "@sveltejs/adapter-node": "^6.0.1",