From c22127f398a59e51ac28c7a04bc757d1a1d329f8 Mon Sep 17 00:00:00 2001 From: Vivek Date: Sun, 9 Aug 2026 01:10:56 +0530 Subject: [PATCH] chore: release core 0.7.49, server 0.8.61, cli 0.10.53 and two more Clears every package carrying unreleased user-facing work since the last release. intellisense and the two editor packages picked up nothing in the range, so they stay where they are. core takes three fixes and a type annotation. A cyclic value, a BigInt, or a throwing toJSON on a JSON-typed reflect:true property threw out of reflection with nothing catching it, which at SSR was swallowed by per-component error isolation into a 200 with an EMPTY component. loadFrame was declared in the client-router .d.ts but never exported at runtime, so a type-checking import came back undefined in the browser. And a submitter's present-but-empty formmethod / formenctype / formtarget now wins over the form's, as every browser does it, which removes a case where one template produced two different requests with JS on and with JS off. server takes the other half of the loadFrame fix: the elision analyser did not count that import as client work, so a component whose only signal was using it had its module dropped. cli fixes two things a scaffolded app hit. webjs doctor reported every @webjsdev dep as not installed under npm workspaces, contradicting the FRAMEWORK_RESOLVE check in its own output, and the postgres DATABASE_URL an uppercase app name produced named a database that CREATE DATABASE would never create. A generated app also type-checks its own tests now. mcp stamps the bundled docs corpus at prepack, so a globally installed server can say which snapshot it is serving instead of teaching pre-fix guidance with no provenance. ui splits three cn() conflict groups that were keyed by class prefix rather than by CSS property, where an unrelated utility silently evicted a real one. Raises packages/server's declared @webjsdev/core range from ^0.7.48 to ^0.7.49. No new core export is imported statically, but the loadFrame fix spans the two packages over one contract (the barrel export core publishes and the import list server's analyser matches against), and the release PR is the only place that bump is legal. The generated notes were curated before committing: each entry is rewritten to the package's own slice rather than the shared commit subject, and the prose-punctuation commit is dropped from server and ui, where its slice was a comment and a package description rather than anything a user runs. --- changelog/cli/0.10.53.md | 49 ++++++++++++++++++++++++++++++++ changelog/core/0.7.49.md | 55 ++++++++++++++++++++++++++++++++++++ changelog/mcp/0.1.13.md | 24 ++++++++++++++++ changelog/server/0.8.61.md | 15 ++++++++++ changelog/ui/0.3.12.md | 33 ++++++++++++++++++++++ package-lock.json | 12 ++++---- packages/cli/package.json | 2 +- packages/core/package.json | 2 +- packages/mcp/package.json | 2 +- packages/server/package.json | 4 +-- packages/ui/package.json | 2 +- 11 files changed, 188 insertions(+), 12 deletions(-) create mode 100644 changelog/cli/0.10.53.md create mode 100644 changelog/core/0.7.49.md create mode 100644 changelog/mcp/0.1.13.md create mode 100644 changelog/server/0.8.61.md create mode 100644 changelog/ui/0.3.12.md diff --git a/changelog/cli/0.10.53.md b/changelog/cli/0.10.53.md new file mode 100644 index 000000000..e5e8fa189 --- /dev/null +++ b/changelog/cli/0.10.53.md @@ -0,0 +1,49 @@ +--- +package: "@webjsdev/cli" +version: 0.10.53 +date: 2026-08-08T19:38:45.616Z +commit_count: 4 +--- +## Fixes + +- **`webjs doctor` no longer reports every `@webjsdev` dep as not installed** ([#1351](https://github.com/webjsdev/webjs/pull/1351)) [`d4226eb1`](https://github.com/webjsdev/webjs/commit/d4226eb1) + The `WEBJS_VERSIONS` check read `/node_modules//package.json` + directly. Under npm workspaces the `@webjsdev/*` deps hoist to the root + `node_modules`, so an app subdirectory has no local copy and a perfectly + healthy install warned on every declared dep, while `FRAMEWORK_RESOLVE` in the + same output said the framework resolves fine. The check asks Node's resolver + instead, anchored at the app dir, which is the question it was always asking + and picks up symlinked workspace links and nested trees for free. Both halves + of the resolve are load-bearing, since `@webjsdev/cli` is bin-only and has no + main entry while `@webjsdev/server` locks `./package.json` out of its exports + map. The check becomes gatable now that it no longer warns on a healthy + install. + +- **lowercase the postgres database name derived from the app name** ([#1330](https://github.com/webjsdev/webjs/pull/1330)) [`a9f88caa`](https://github.com/webjsdev/webjs/commit/a9f88caa) + `webjs create MyApp --db postgres` wrote the app name into the emitted + `DATABASE_URL` case-preserving, so the URL named `MyApp`. PostgreSQL folds an + unquoted identifier, so `CREATE DATABASE MyApp;` creates `myapp` and the + emitted URL then fails to connect, while `createdb MyApp` quotes and creates + `MyApp` literally. The emitted name is now derived once and is + quoting-invariant: folded with `toLowerCase`, every remaining + non-`[a-z0-9_]` character mapped to `_`, a leading digit prefixed with `_`, + then capped at 63 bytes. The app name itself is untouched everywhere else, + and the post-scaffold guidance names the database so you know what to create. + +- **a generated app type-checks its own tests** ([#1349](https://github.com/webjsdev/webjs/pull/1349)) [`6ccacf43`](https://github.com/webjsdev/webjs/commit/6ccacf43) + Every app `webjs create` emits left `test/` outside the tsconfig include, so + an author following the scaffold's own testing guidance got no type checking + on the tests they wrote, including the three starter tests the scaffold + itself writes. The generated `tsconfig.json` now covers them, and the starter + e2e test is annotated to pass under it. + +- **the scaffold's punctuation hook scans JSON and front-matter prose** ([#1334](https://github.com/webjsdev/webjs/pull/1334)) [`c0917df3`](https://github.com/webjsdev/webjs/commit/c0917df3) + The hook a scaffolded app ships gated its pause-hyphen and pause-semicolon + rules on four line shapes, so a JSON string value matched none of them and + passed straight through. A `description` / `title` / `displayName` value is + scanned now, in JSON and in column-0 YAML front matter, scoped by the KEY + rather than the file so semver ranges, script commands, urls, paths and globs + stay out of it. The same commit fixes a silent stop on a large payload: `grep + -q` exits on its first match, closing the pipe under `printf`, and under + `pipefail` the resulting SIGPIPE became the pipeline status, so the rule + skipped. Measured 0 of 8 blocks caught at 200 KB before, 8 of 8 after. diff --git a/changelog/core/0.7.49.md b/changelog/core/0.7.49.md new file mode 100644 index 000000000..2befbd782 --- /dev/null +++ b/changelog/core/0.7.49.md @@ -0,0 +1,55 @@ +--- +package: "@webjsdev/core" +version: 0.7.49 +date: 2026-08-08T19:38:45.486Z +commit_count: 4 +--- +## Fixes + +- **a cyclic value on a JSON-typed reflect:true prop no longer throws** ([#1335](https://github.com/webjsdev/webjs/pull/1335)) [`549462da`](https://github.com/webjsdev/webjs/commit/549462da) + Reflection serialized an `Object` / `Array` property with a bare + `JSON.stringify`, so a value that cannot pass through it threw out of + reflection with nothing catching it. Three shapes hit this in practice: a + cycle, a `BigInt`, and an author `toJSON()` that throws. At SSR the + per-component error isolation swallowed the throw, so production returned 200 + with the component rendered EMPTY and the cause only in the server log; on the + client the same throw came out of the author's property assignment, so a + component whose constructor set such a value never rendered at all. + + The attribute is now REMOVED and a warning fires, matching what the + neighbouring function branch already did: an HTML attribute is a string, and a + value with no string form has no attribute representation. A JSON-typed value + merely CARRYING a function still reflects whole. The read side closes the round + trip on both renderers: an unparseable attribute reads back as `null` rather + than the raw string, matching an absent attribute and lit's + `defaultConverter.fromAttribute`, so SSR and the client cannot disagree. + +- **`loadFrame` is undefined from `@webjsdev/core/client-router` in prod** ([#1346](https://github.com/webjsdev/webjs/pull/1346)) [`d0ea7d50`](https://github.com/webjsdev/webjs/commit/d0ea7d50) + The `client-router` subpath declared `loadFrame` in its `.d.ts` but never + exported it at runtime, so a type-checking import resolved in the editor and + came back undefined in the browser. It is exported from the barrel now and + classified internal, the same way `WebjsFrame` already is, since an app uses + the `` tag and `loadFrame` is the seam that element calls. + + Two redundant bare exports (`collectBoundaries`, `planBoundarySwap`) that were + never public are dropped, and the forward `.d.ts` coverage check now runs over + every published exports overlay instead of a hardcoded three, so a runtime + export with no matching declaration reds CI rather than silently dropping out + of editor intelligence. + +- **a submitter's empty `formmethod` / `formenctype` / `formtarget` wins, as native** ([#1352](https://github.com/webjsdev/webjs/pull/1352)) [`0206464f`](https://github.com/webjsdev/webjs/commit/0206464f) + The form-submission algorithm resolves a submitter's override on whether the + attribute is PRESENT, never on its value being truthy. Those three siblings + used a `||` chain, so a present-but-empty value was falsy and fell through to + the form's. Measured against Chromium, Firefox and WebKit at the request + level, a `