Rolino fixed changes

Update application and development dependencies to address published security issues. Require patched Node.js releases for local use, CI, and containers, and limit MCP tool input complexity to prevent excessive memory use.

Limit deeply nested file patterns in development tools while the upstream library awaits a security release. Include the Astro workspace manifest in container dependency installation.

Keep analytics fallbacks and publishing controls compatible with current React checks, and reject expired recovery times before schedule review.

Expose separate agent tools for video attachment, video publication, analytics changes, and Blog connection changes. Keep exact confirmation and retry safeguards, and correct tool safety labels for draft replacement, website imports, and Blog rescheduling.

Keep analytics collection recoverable when a provider is temporarily unavailable during deployment. Continue to remove data when its access cannot be verified.

Bind Facebook setup to the browser and signed-in user who started it, including local HTTPS callbacks. Reject setup links copied from another browser.

Require the latest YouTube analytics migration before reporting that the database is ready.

Keep measured likes and comments in analytics totals when a post has no available view count.

Keep Facebook connection tests signed in when the local app uses an HTTPS callback address. Return to the original app after authorization without a second sign-in.

Keep network chart lines connected when All platforms adds dates from other networks. Preserve gaps for unavailable measurements on the same network.

Keep Analytics reports available after an Instagram account connection error and show the specific recovery message in a notice and toast.

Allow bounded extra database time when queueing and saving analytics so remote database latency does not discard collected results.

Match Instagram post owners to the connected account's verified Instagram Login ID. Explain when Instagram cannot access a saved post instead of showing a generic metrics error.

Correct local Instagram login configuration to use its Instagram app ID instead of the parent Meta app ID, and clarify which credentials are required.

Recover analytics collection after temporary source-check failures, including slow YouTube responses, while preserving data deletion deadlines and confirmed collection stops.

Keep the app unready until the agency contact details and portal link database migrations are complete.

Keep analytics publication dates in UTC, including when the database uses another time zone.

Keep Blog CTA settings correct after body edits, undo, and removal. Check CTA page availability before approval and publication, and preserve label punctuation on Next.js sites.

Keep clip preview play buttons centered when hovered or pressed.

Prevent client portal sign-in from creating an agency workspace. Require an invitation for new client accounts, and keep pending invitations from replacing other sign-in destinations.

Keep sign-in error messages readable in dark mode.

Use the agency logo, name, colors, and footer in client portal sign-in emails, while keeping the Rolino sending address and standard workspace sign-in template.

Remove the inner scroll bars from onboarding channel selection and wrap long channel names so all enabled channels fit within the page.

Update application dependencies to fix security issues in image processing, Next.js, and source-map processing.

Match Pinterest and Google Business Profile agent delivery options to the composer, including carousel limits, board pagination, and selected-location image requirements.

Allow publishing approval checks to finish on slower database connections before claiming a post for delivery.

Request the board write permission required for Pinterest Pin creation. Existing Pinterest connections must reconnect to grant this permission.

Keep uncertain Google Business Profile posts blocked after a lost delivery receipt, and retry confirmed rate-limit failures through the publishing queue.

Explain disabled Google Business Profile APIs and location access failures after sign-in, instead of showing only a reconnect prompt.

Show Google Business Profile in Integrations when its deployment and channel settings are enabled.