Yuva 0.0.19: 47 languages, step-by-step setup, and a pace for every broadcast

Version 0.0.12 was about analytics and a security pass. Seven releases later, 0.0.19 is out, and the headline is languages: the panel, the site, the chat widget and the Swift and Kotlin libraries now speak 47 of them. Setting things up got easier too, and so did sending a newsletter slowly and safely.

47 languages

The panel comes in the same 47 languages as the chat widget, the mobile libraries and this site. Besides English, Turkish and German they are:

• French, French (Canada), Spanish, Spanish (Mexico), Portuguese (Brazil), Portuguese (Portugal), Italian and Dutch.
• Swedish, Danish, Norwegian Bokmål, Finnish, Polish, Czech, Slovak, Slovenian, Croatian, Hungarian, Romanian and Catalan.
• Japanese, Korean, Simplified and Traditional Chinese, Russian, Ukrainian, Greek, Indonesian and Malay.
• Arabic, Hebrew and Urdu, which lay out right to left.
• Hindi, Bengali, Marathi, Punjabi, Gujarati, Odia, Kannada, Malayalam, Tamil, Telugu, Thai and Vietnamese.

In the panel, pickers list every language by its own name. Before you sign in, the language of your browser chooses one. The panel downloads only the catalogs of the language you use, and the main bundle got smaller because English and Turkish are no longer built into it.

A person’s language is no longer limited to English and Turkish: it can be any of the 47, and it also drives the e-mails Yuva sends them. Where mail has no translation in that language, Yuva falls back to its base language and then to English, so nobody gets an empty message.

The chat widget and the Swift and Kotlin libraries ship the same 47 languages. The site now has one page tree for all of them, with hreflang links, per-language social tags and right-to-left layout for Arabic, Hebrew and Urdu. Guides and blog posts that are not translated yet, including this one, show in English.

Setup, step by step

The dialogs for adding things were long forms. In 0.0.19 they are wizards that ask one thing at a time, and the first ones came in 0.0.15 with a Home page for owners and admins and one place, Set up Yuva, for everything Yuva does (see the install guide).

• Inbox. Adding an inbox creates nothing until its channel is set up. If the channel fails, you retry without getting a second inbox, and Cancel removes an inbox that never got a channel. Chat, app and documentation channels on an existing inbox start the same wizard with fewer steps.
• E-mail channel. Five steps: the address, the reply account (Amazon SES, another SMTP server, or receive only for now), receiving, a live test and a summary. Passwords never enter the saved draft, and an error such as a taken address returns you to the step that caused it.
• Webhook. Three steps: endpoint, events, done. The signing secret is shown once, at the end. See webhooks.
• API key. Name, access, review, done. Access offers the presets Read only, Support bot, Everything and Custom, and limiting a key to some inboxes leaves out the scopes that cover the whole workspace. The secret and a curl line are shown once at the end.
• Mailing list. List, sender, sign-up rules, done. If you have no sending channel yet, the wizard detours through e-mail setup and comes back with your draft kept. See lists.

Settings pages changed with them. A channel now opens on a page with one card per topic, and each card saves on its own, so saving the auto-reply cannot lose unsaved text in another card or touch the stored SMTP passwords. Webhook endpoints and mailing lists split into sections that save on their own too, and their switches save at once.

Sending a newsletter slowly

A broadcast can now have its own pace: at most so many mails an hour, a day and a month, each optional. Yuva spaces the mails evenly, so a long list goes out over days instead of in one burst. The channel’s rate and the workspace’s daily limit still apply; the pace can only make sending slower. You set it in the composer and can change it while the broadcast is scheduled, sending or paused. The review stops a pace that would take more than 365 days.

One inbox cannot pause the others

Amazon SES keeps reputation, and pauses sending, per tenant. On a server that manages them, each inbox now sends in its own SES tenant, so bounces and complaints of one inbox pause only that inbox, never another inbox or another workspace. Inbox settings and the e-mail channel show whether mail is isolated, why not, and when SES paused a tenant. A broadcast review blocks on a paused or missing tenant, and resuming is refused while the tenant is paused. Self-hosters who do not give the server SES keys can name their own tenant on the channel; the server settings are in configuration.

Add Yuva to a project from an assistant

Since 0.0.13 the MCP server has an init prompt and a get_setup_state tool. The assistant reads your project locally, sends none of it to Yuva, asks the workspace what it already has, proposes a plan and changes nothing until you pick steps. A report_yuva_issue tool prepares a bug report with names, addresses and keys removed. The site has a page on connecting an AI assistant.

For JavaScript backends

In 0.0.14, useyuva/server signs identity tokens, verifies webhook signatures and sends server-side analytics, the counterpart of the Go library. It runs on Node, Bun, Deno and workers. useyuva/h3 and useyuva/nitro serve the same from an h3 or Nitro app, and the Nuxt module uses them.

Smaller things

• The chat widget applies its styles in a way that works with a strict style-src policy, and the Kotlin library builds on JitPack.
• A new user who signs in from an assistant can create a workspace before the consent step.
• An analytics query with an empty list of metrics answers 400 instead of 500, and the chart no longer crashes when it switches between hourly and daily buckets.
• Owners and admins open Home at /: today’s inbox, each website and app with its visitors, the last broadcast and the setup list. GET /v1/home answers the same in one request.
• Discussion posts show images as links, so opening a post never loads a URL its author chose.
• The site has a Cloudflare e-mail page, a works-with strip on the home page, a new layout, and a grouped docs sidebar.

More security fixes

0.0.17 and 0.0.18 close another round of findings from our own review. In short:

• Mail ingress checks a header signature before reading the body, and a sender’s own Authentication-Results can no longer pass DMARC for it.
• A bounce or complaint suppresses only the address it was sent to.
• The analytics collector trusts X-Forwarded-For only from trusted proxies, and caps monthly events by default.
• A reader token works only from the origin it was minted on, and per-recipient link tokens stay out of logs.
• Only owners and admins can approve, hide or mark discussion posts as spam; contacts with no conversation and subscribers’ consent history are visible only to managers.
• Registering another person’s push endpoint answers 409 instead of taking it over.

This is still our own review, not an independent audit. Report anything you find privately, as SECURITY.md describes.

Try it

The release notes are on GitHub: 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.18 and 0.0.19.

• Hosted: create an account from the home page and start without running a server.
• Self-hosted: run ghcr.io/productdevbook/yuva:0.0.19 with Postgres using the Compose quick start, or install the Helm chart.

Yuva is still pre-alpha: the API and the database schema can change without migration paths. Try it with test data, and tell us what breaks in an issue.