Measura

Changelog

What has shipped.

Platform changes, SDK releases and security work, newest first.

Releases

Newest first.

Pre-release

Measura has not cut a tagged release yet. Every component sits at 1.0.0 and nothing has been published to a package registry, so the entries below record build milestones rather than version numbers. Once we tag a release, versioned entries will appear here.

Build milestone

Continuous integration went live and the Android SDK compiled for the first time, which surfaced and fixed the first real build errors.

  • Added
    CIGitHub Actions pipeline covering the marketing site, both dashboards, the backend edge functions and the Android SDK.
  • Added
    Android SDKSize budget enforced in CI. The release archive is measured on every run and the build fails if it exceeds the figure published in the docs. Corrected after publication: this entry originally quoted a 150 KB gate and a 74.5 KB measurement, neither of which matched what CI enforced at the time.
  • Fixed
    Android SDKTwo compilation errors caught by the first CI run against the Kotlin sources.
  • Fixed
    Marketing siteDuplicate import in the navigation component, and the Gradle version pinned to 8.7 for reproducible builds.
  • Added
    DeploymentStaging deploy workflow, dormant until a staging project reference is configured.
Build milestone

Attribution gained a full decision trace, SDK reliability was hardened across three platforms, and the dashboards were locked down.

  • Added
    AttributionOrdered matching hierarchy: install referrer, then click identifier, then advertising identifier, then fingerprint, then organic. The first match wins.
  • Added
    AttributionEvery attribution now stores the signals used, a written reason, and the candidate clicks that were rejected, so a decision can be audited after the fact.
  • Added
    AttributionAtomic resolution with a uniqueness constraint per install plus an hourly reconciliation pass for orphaned records.
  • Added
    Android SDKPlay Install Referrer integration, which gives deterministic attribution through the store install.
  • Changed
    SDKsReliability pass on the Android SDK covering offline queueing, retry backoff and scheduler resilience.
  • Security
    DashboardsContent Security Policy plus a full security header set on both the admin and developer dashboards.
  • Security
    APISigned request replay window narrowed to ten minutes, and tenant identity now read only from server controlled token claims.
  • Added
    AdminAppend only audit log recording every administrative change with its previous and new values.
  • Added
    MigrationImporter acceptance tests end to end, including historical attribution rows.
  • Changed
    Data retentionPartition drop path verified and unblocked, giving raw events a working ninety day window.
Build milestone

First hardening pass after an internal production readiness audit, covering ingestion, metering and rate limiting.

  • Added
    IngestionBatched event ingestion with per event signature verification and idempotency keys for deduplication.
  • Added
    BillingMonthly event metering with per plan caps enforced at ingest time.
  • Added
    APIDurable rate limiting on the deep link redirector and the key resolution endpoint.
  • Added
    SecurityAPI keys stored as hashes only, with the plaintext value shown once at creation.
  • Added
    AttributionRetrying postback delivery to configured advertising networks.
  • Added
    DatabaseComposite indexes on the hot attribution paths, and correct handling of the all zero advertising identifier that signals a user opted out.