What changed in July 2026

Two things ate most of July. The treemap gave up on big bundles, and DendroBundle could only read a couple of stats formats. Both are better now.

New

• Treemap handles big bundles. Tiles under a few pixels collapse into one "+N more" box per parent, and zooming into that box expands it in place instead of relaying out the chart. A 2000 module bundle used to draw thousands of unlabeled slivers.
• Richer tiles. Name, size, share of the bundle, and how far it moved since your last build.
• rspack, webpack-bundle-analyzer and parcel-metrics parse. Plus a generic JSON shape for sites with no module graph: walk your output directory, write file names and sizes, push that.
• Several formats per project. Each keeps its own history. Pills on the overview switch between them and the choice lives in the URL, so you can send someone the exact view you are looking at.
• Mixed-basis compare warning. Emitted bytes and source bytes are not the same number, so comparing snapshots measured differently now says so.
• GitHub App check run on every push, plus a comment on the pull request. With per-chunk budgets the verdict is per chunk, and the comment names each chunk that went over with its size and limit.
• Account overview. Cross-project activity feed with over-budget builds flagged and every row linking to its build, and a graph of each project's size against its budget over time.
• History range selector. Week, month, three months, six months, or a year, with a build count and net size change for the window. How far back depends on your plan: 30 days on community, 180 on developer, a year on team and above.
• File count and change-since-last-build in the KPI bar, on public report links as well as your own project page.
• Source sizes on the compare table, under the tracked size, when the format reports one. webpack-bundle-analyzer does. Hidden for formats that do not, rather than a column of dashes.

Better

• Pushes up to 150 MiB. A 108 MB webpack stats file used to come back 413. The limit was ours, on the decompressed size, not nginx.
• Account deletion asks for your password. A live session on its own used to be enough. Social-only accounts still type the account name to confirm.
• Token revocation and data export are session-only, so a push token cannot do either.

Fixed

• Google and GitHub sign-in. The account app pointed at a subdomain that was configured and never built, so the callback went to a host that does not resolve and cookie-carrying requests were rejected as wrong-origin. Both are back on dendrobundle.com. If sign-in failed for you between July 21 and July 29, that was this.
• Pushing the same commit twice is a no-op instead of a 409. The same commit under a different stats format is still a real second snapshot.