chore: release server 0.8.63 and cli 0.10.55 - #1391
Merged
Merged
Conversation
Ships the `clientIpHeader` option and the scaffold demo that depends on it. Without this release a freshly scaffolded app installs server 0.8.62, whose `rateLimit` has no such option, while the rate-limit demo it also receives tells the reader to reach for it behind a CDN. server carries the option itself. cli carries the two scaffold-side halves: the emitted middleware passing `trustProxy: true`, and its comments explaining why a CDN deploy also has to name the header. The option stays unset in the generated app, because the right header depends on the topology. core, mcp, and ui picked up nothing in the range, so they stay where they are. The generated notes were curated before committing. The generator excerpts the squash body, which is one shared narrative across both packages, so each entry is rewritten to the slice its own package ships.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ships the
clientIpHeaderoption (#1390) and the scaffold demo that depends on it (#1388, #1390).@webjsdev/server@webjsdev/clicore,mcp, anduipicked up nothing since the 0.8.62 batch, so they stay where they are.Why this one is not just bookkeeping
A freshly scaffolded app installs
@webjsdev/*from npm, so today it getsserver@0.8.62, whoserateLimithas noclientIpHeader, while the rate-limit demo it also receives tells the reader to reach for that option behind a CDN. The scaffold currently documents an option the installed server does not support.server carries the option itself:
rateLimit({ clientIpHeader })andclientIp(req, { header })name the one forwarded header to trust, which is what makes a limiter work behind a CDN whose egress addresses are pinned per connection. Resolution with the option unset is unchanged.cli carries the two scaffold-side halves: the emitted middleware passing
trustProxy: true, and its comments explaining why a CDN deploy also has to name the header. The option is left unset in generated apps on purpose, since the right header depends on the topology and naming the wrong one is a spoofing hazard rather than a no-op.Ordering and ranges
changelog/server/0.8.63.mdcarries the earlierdate:, so server publishes first. No range bump is needed:packages/clideclares"@webjsdev/server": "^0.8.0", which 0.8.63 satisfies, and nothing else in the workspace pins either package more tightly.Curation
The generator excerpts the squash body, which for #1390 is one shared narrative spanning both packages, so each entry was rewritten to the slice its own package ships rather than repeating the same prose twice.
Verification
node --test test/packaging/*.mjs test/repo-health/*.mjs, 126 pass, 0 fail.