From e30788c6045704f6b7e9a75911b83363cc4dc8ea Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 8 Nov 2026 22:01:13 +0000 Subject: [PATCH] chore(release): version packages --- .changeset/linear-trims-168.md | 11 ---------- .changeset/mcp-step-up-168.md | 6 ------ .changeset/rate-limits-168.md | 6 ------ .changeset/redos-sweep-174.md | 15 -------------- .changeset/status-page-fixes-167.md | 5 ----- packages/agent-runtime/CHANGELOG.md | 16 +++++++++++++++ packages/agent-runtime/package.json | 2 +- packages/analytics/CHANGELOG.md | 11 ++++++++++ packages/analytics/package.json | 2 +- packages/api/CHANGELOG.md | 28 ++++++++++++++++++++++++++ packages/api/package.json | 2 +- packages/astro-renderer/CHANGELOG.md | 17 ++++++++++++++++ packages/astro-renderer/package.json | 2 +- packages/cli/CHANGELOG.md | 29 +++++++++++++++++++++++++++ packages/cli/package.json | 2 +- packages/cloudflare/CHANGELOG.md | 17 ++++++++++++++++ packages/cloudflare/package.json | 2 +- packages/comments/CHANGELOG.md | 14 +++++++++++++ packages/comments/package.json | 2 +- packages/core-contracts/CHANGELOG.md | 4 ++++ packages/core-contracts/package.json | 2 +- packages/core-ts/CHANGELOG.md | 20 ++++++++++++++++++ packages/core-ts/package.json | 2 +- packages/create-cloudhal/CHANGELOG.md | 8 ++++++++ packages/create-cloudhal/package.json | 2 +- packages/mcp-server/CHANGELOG.md | 18 +++++++++++++++++ packages/mcp-server/package.json | 2 +- packages/schedules/CHANGELOG.md | 15 ++++++++++++++ packages/schedules/package.json | 2 +- packages/storage/CHANGELOG.md | 7 +++++++ packages/storage/package.json | 2 +- 31 files changed, 217 insertions(+), 56 deletions(-) delete mode 100644 .changeset/linear-trims-168.md delete mode 100644 .changeset/mcp-step-up-168.md delete mode 100644 .changeset/rate-limits-168.md delete mode 100644 .changeset/redos-sweep-174.md delete mode 100644 .changeset/status-page-fixes-167.md diff --git a/.changeset/linear-trims-168.md b/.changeset/linear-trims-168.md deleted file mode 100644 index bcaa22a6..00000000 --- a/.changeset/linear-trims-168.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@cloudhal/core-ts": patch -"@cloudhal/analytics": patch -"@cloudhal/astro-renderer": patch -"@cloudhal/cli": patch -"@cloudhal/comments": patch ---- - -Slug and name trims run in one linear pass instead of `/^-+|-+$/g` (CodeQL js/polynomial-redos, #168). This covers `slugify`, `foldName` and `slugifyFilename` in core-ts (the new `trimChar` is exported from `@cloudhal/core-ts/names`), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one `-` first. These inputs were quadratic and are linear now: analytics' `datasetName` on a long run of `_` inside a deployment name; json-render component keys in `fromJsonRender` (`./interop`); trailing whitespace in directive blocks and on comment lines; trailing `/` in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new `trimEndChar` is exported from `@cloudhal/core-ts/names` too. - -Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot. diff --git a/.changeset/mcp-step-up-168.md b/.changeset/mcp-step-up-168.md deleted file mode 100644 index b0ffe187..00000000 --- a/.changeset/mcp-step-up-168.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@cloudhal/agent-runtime": patch -"@cloudhal/api": patch ---- - -MCP OAuth step-up follow-ups (RFC-0044 phase 1, #168). These stay latent until phase 2 gives connections a `grantId`. A policy denial for missing scopes now carries `missing`, the required scopes that neither the caller's scopes nor an own variant satisfy. The new `stepUpScopes(policy, principal, tool, args)` turns that into the scopes a token should ask for, using the same rules as the handler: a propose call's `proposeScopes`, the own variant the member's role holds (`content:write:own` for an Author, `content:draft:own` for a Contributor, `site:publish:own` for an Author's publish) and the member's role on the call's site (RFC-0034 A2), capped by their installation role as consent caps a token (an installation Contributor who is an Editor on one site is asked for `content:draft:own` there). A call that would still be denied with those scopes, such as a write in plan mode or a tool outside the declared skill, is not challenged. The `/mcp` step-up 403 asks for exactly that set and now leaves an audit row, like other denials. `createApi` throws when `mcp.oauth.resource` is not the public URL of `/mcp`. A playground refuses both OAuth protected-resource documents (`403 {error: "playground", block: "mcp"}`), as its route table already said. diff --git a/.changeset/rate-limits-168.md b/.changeset/rate-limits-168.md deleted file mode 100644 index 9c2e7eb5..00000000 --- a/.changeset/rate-limits-168.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@cloudhal/storage": patch -"@cloudhal/api": patch ---- - -Cloudhal's own rate-limit counters move out of Better Auth's `rateLimit` table into `rate_limits` (migration `0030_rate_limits`, #168). This covers the hourly cap of 3 reset mails per address, the per-minute buckets of the public token endpoints and each agent key's window. Better Auth prunes `rateLimit` by its own 60 s window, so the hourly reset-mail cap used to restart about a minute after any sign-in from the same address. Each hit counts in one statement (an upsert with `RETURNING`). Because the keys come from client addresses and submitted email addresses, about one hit in 32 also deletes up to 500 expired counters through an `expires_at` index. The migration deletes the old `cloudhal:` rows from `rateLimit`, so each counter starts over once at upgrade. diff --git a/.changeset/redos-sweep-174.md b/.changeset/redos-sweep-174.md deleted file mode 100644 index c493751d..00000000 --- a/.changeset/redos-sweep-174.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@cloudhal/api": patch -"@cloudhal/core-ts": patch -"@cloudhal/schedules": patch -"@cloudhal/agent-runtime": patch -"@cloudhal/cli": patch ---- - -Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged. - -- **Unauthenticated password-reset request.** `POST /api/password-reset/request` (and invite creation) checks the address length before anything else, and the address check no longer backtracks: `a@` followed by many dots used to cost seconds of CPU per request. Public token endpoints (`/api/password-reset/*`, invite acceptance) refuse a JSON body over 64 KiB with `413 payload_too_large`, whether or not it declares a `content-length`. -- **core-ts.** Redirect path normalising and matching (on every site request): `normalisePath`, `joinTarget`, and `ancestorPaths`, which no longer lists ancestors that no redirect can match: those longer than a `from` may be (1024 code points) or holding `//`. Directive lines in search text keep their braces on one line, so a directive whose `{…}` spans a lone `\r` is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, `url(…)` references (about cubic on `url(` followed by spaces) and width/height lengths (new `css-scan.ts`). -- **schedules.** The feed check's CDATA, element and ``/`` url scans, and `urlPath`. -- **agent-runtime.** SKILL.md frontmatter lines (a line of spaces was quadratic). -- **Studio** (in `@cloudhal/cli`): the markdown body editor's trailing-newline trims. diff --git a/.changeset/status-page-fixes-167.md b/.changeset/status-page-fixes-167.md deleted file mode 100644 index 26006e3b..00000000 --- a/.changeset/status-page-fixes-167.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@cloudhal/astro-renderer": patch ---- - -Status page fixes after RFC-0043 PR 1 (#167). The Site Worker no longer turns a 5xx the renderer or the theme answers on purpose into the `error` page: the starter's own `not-published` 503 for a request that reaches Astro (a `POST`, say) passes unchanged and logs nothing; only Astro's own 500 page (HTML, or its empty fallback when no 500 page renders) and thrown errors become the `error` page. A theme page that throws now gets that page with a reference and a `cloudhal: request failed` log line: the blog starter's catch-all route rethrows when Astro renders it as the error route, instead of answering its own 404 for the page's path (theme copies made from an earlier starter can add the same two lines at the top of `[...path].astro`). A store that cannot be read before rendering answers 503 `unavailable` with `Retry-After: 300`, as `/__cloudhal/health` reports it, instead of a 500; so does a multi-site Worker whose hostname map cannot be read (health `503 { ok: false }`, pages the English `unavailable` page). The `error` page uses the site's language and name when the request has already read the site, taken from the published snapshot (an unpublished rename never shows). An invalid preview token on a feed, sitemap, `llms.txt` or JSON path answers 410 instead of the published content, and no response says why a token failed any more (`x-cloudhal-preview-error` is now always `invalid`). diff --git a/packages/agent-runtime/CHANGELOG.md b/packages/agent-runtime/CHANGELOG.md index 193527dd..f8208b3f 100644 --- a/packages/agent-runtime/CHANGELOG.md +++ b/packages/agent-runtime/CHANGELOG.md @@ -1,5 +1,21 @@ # @cloudhal/agent-runtime +## 0.6.5 + +### Patch Changes + +- b0ebd95: MCP OAuth step-up follow-ups (RFC-0044 phase 1, #168). These stay latent until phase 2 gives connections a `grantId`. A policy denial for missing scopes now carries `missing`, the required scopes that neither the caller's scopes nor an own variant satisfy. The new `stepUpScopes(policy, principal, tool, args)` turns that into the scopes a token should ask for, using the same rules as the handler: a propose call's `proposeScopes`, the own variant the member's role holds (`content:write:own` for an Author, `content:draft:own` for a Contributor, `site:publish:own` for an Author's publish) and the member's role on the call's site (RFC-0034 A2), capped by their installation role as consent caps a token (an installation Contributor who is an Editor on one site is asked for `content:draft:own` there). A call that would still be denied with those scopes, such as a write in plan mode or a tool outside the declared skill, is not challenged. The `/mcp` step-up 403 asks for exactly that set and now leaves an audit row, like other denials. `createApi` throws when `mcp.oauth.resource` is not the public URL of `/mcp`. A playground refuses both OAuth protected-resource documents (`403 {error: "playground", block: "mcp"}`), as its route table already said. +- c15218e: Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged. + + - **Unauthenticated password-reset request.** `POST /api/password-reset/request` (and invite creation) checks the address length before anything else, and the address check no longer backtracks: `a@` followed by many dots used to cost seconds of CPU per request. Public token endpoints (`/api/password-reset/*`, invite acceptance) refuse a JSON body over 64 KiB with `413 payload_too_large`, whether or not it declares a `content-length`. + - **core-ts.** Redirect path normalising and matching (on every site request): `normalisePath`, `joinTarget`, and `ancestorPaths`, which no longer lists ancestors that no redirect can match: those longer than a `from` may be (1024 code points) or holding `//`. Directive lines in search text keep their braces on one line, so a directive whose `{…}` spans a lone `\r` is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, `url(…)` references (about cubic on `url(` followed by spaces) and width/height lengths (new `css-scan.ts`). + - **schedules.** The feed check's CDATA, element and ``/`` url scans, and `urlPath`. + - **agent-runtime.** SKILL.md frontmatter lines (a line of spaces was quadratic). + - **Studio** (in `@cloudhal/cli`): the markdown body editor's trailing-newline trims. +- Updated dependencies [b0ebd95] + - @cloudhal/storage@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/agent-runtime/package.json b/packages/agent-runtime/package.json index c71e7e45..5f26878a 100644 --- a/packages/agent-runtime/package.json +++ b/packages/agent-runtime/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/agent-runtime", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal agent runtime: policy engine (actors, scopes, approvals), skill loader, audit log", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/analytics/CHANGELOG.md b/packages/analytics/CHANGELOG.md index 34a5c92e..417d9c9f 100644 --- a/packages/analytics/CHANGELOG.md +++ b/packages/analytics/CHANGELOG.md @@ -1,5 +1,16 @@ # @cloudhal/analytics +## 0.6.5 + +### Patch Changes + +- b0ebd95: Slug and name trims run in one linear pass instead of `/^-+|-+$/g` (CodeQL js/polynomial-redos, #168). This covers `slugify`, `foldName` and `slugifyFilename` in core-ts (the new `trimChar` is exported from `@cloudhal/core-ts/names`), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one `-` first. These inputs were quadratic and are linear now: analytics' `datasetName` on a long run of `_` inside a deployment name; json-render component keys in `fromJsonRender` (`./interop`); trailing whitespace in directive blocks and on comment lines; trailing `/` in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new `trimEndChar` is exported from `@cloudhal/core-ts/names` too. + + Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot. +- Updated dependencies [b0ebd95] + - @cloudhal/storage@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/analytics/package.json b/packages/analytics/package.json index 2f37902c..cadb0102 100644 --- a/packages/analytics/package.json +++ b/packages/analytics/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/analytics", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal site analytics (RFC-0006): query model, classifiers, beacon handler, SQLite/D1 store, daily rollups and Workers Analytics Engine adapters. Worker-safe.", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md index 738b9a6a..1e80cda3 100644 --- a/packages/api/CHANGELOG.md +++ b/packages/api/CHANGELOG.md @@ -1,5 +1,33 @@ # @cloudhal/api +## 0.6.5 + +### Patch Changes + +- b0ebd95: MCP OAuth step-up follow-ups (RFC-0044 phase 1, #168). These stay latent until phase 2 gives connections a `grantId`. A policy denial for missing scopes now carries `missing`, the required scopes that neither the caller's scopes nor an own variant satisfy. The new `stepUpScopes(policy, principal, tool, args)` turns that into the scopes a token should ask for, using the same rules as the handler: a propose call's `proposeScopes`, the own variant the member's role holds (`content:write:own` for an Author, `content:draft:own` for a Contributor, `site:publish:own` for an Author's publish) and the member's role on the call's site (RFC-0034 A2), capped by their installation role as consent caps a token (an installation Contributor who is an Editor on one site is asked for `content:draft:own` there). A call that would still be denied with those scopes, such as a write in plan mode or a tool outside the declared skill, is not challenged. The `/mcp` step-up 403 asks for exactly that set and now leaves an audit row, like other denials. `createApi` throws when `mcp.oauth.resource` is not the public URL of `/mcp`. A playground refuses both OAuth protected-resource documents (`403 {error: "playground", block: "mcp"}`), as its route table already said. +- b0ebd95: Cloudhal's own rate-limit counters move out of Better Auth's `rateLimit` table into `rate_limits` (migration `0030_rate_limits`, #168). This covers the hourly cap of 3 reset mails per address, the per-minute buckets of the public token endpoints and each agent key's window. Better Auth prunes `rateLimit` by its own 60 s window, so the hourly reset-mail cap used to restart about a minute after any sign-in from the same address. Each hit counts in one statement (an upsert with `RETURNING`). Because the keys come from client addresses and submitted email addresses, about one hit in 32 also deletes up to 500 expired counters through an `expires_at` index. The migration deletes the old `cloudhal:` rows from `rateLimit`, so each counter starts over once at upgrade. +- c15218e: Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged. + + - **Unauthenticated password-reset request.** `POST /api/password-reset/request` (and invite creation) checks the address length before anything else, and the address check no longer backtracks: `a@` followed by many dots used to cost seconds of CPU per request. Public token endpoints (`/api/password-reset/*`, invite acceptance) refuse a JSON body over 64 KiB with `413 payload_too_large`, whether or not it declares a `content-length`. + - **core-ts.** Redirect path normalising and matching (on every site request): `normalisePath`, `joinTarget`, and `ancestorPaths`, which no longer lists ancestors that no redirect can match: those longer than a `from` may be (1024 code points) or holding `//`. Directive lines in search text keep their braces on one line, so a directive whose `{…}` spans a lone `\r` is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, `url(…)` references (about cubic on `url(` followed by spaces) and width/height lengths (new `css-scan.ts`). + - **schedules.** The feed check's CDATA, element and ``/`` url scans, and `urlPath`. + - **agent-runtime.** SKILL.md frontmatter lines (a line of spaces was quadratic). + - **Studio** (in `@cloudhal/cli`): the markdown body editor's trailing-newline trims. +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [c15218e] +- Updated dependencies [f4a1ee3] + - @cloudhal/core-ts@0.6.5 + - @cloudhal/analytics@0.6.5 + - @cloudhal/astro-renderer@0.6.5 + - @cloudhal/comments@0.6.5 + - @cloudhal/agent-runtime@0.6.5 + - @cloudhal/storage@0.6.5 + - @cloudhal/schedules@0.6.5 + - @cloudhal/mcp-server@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/api/package.json b/packages/api/package.json index 3e78fb2c..89dd2b0f 100644 --- a/packages/api/package.json +++ b/packages/api/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/api", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal HTTP API (Hono): sites, pages, entries, snapshots, auth — runs on Node and Cloudflare Workers", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/astro-renderer/CHANGELOG.md b/packages/astro-renderer/CHANGELOG.md index 41c15d9a..2ca54d3f 100644 --- a/packages/astro-renderer/CHANGELOG.md +++ b/packages/astro-renderer/CHANGELOG.md @@ -1,5 +1,22 @@ # @cloudhal/astro-renderer +## 0.6.5 + +### Patch Changes + +- b0ebd95: Slug and name trims run in one linear pass instead of `/^-+|-+$/g` (CodeQL js/polynomial-redos, #168). This covers `slugify`, `foldName` and `slugifyFilename` in core-ts (the new `trimChar` is exported from `@cloudhal/core-ts/names`), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one `-` first. These inputs were quadratic and are linear now: analytics' `datasetName` on a long run of `_` inside a deployment name; json-render component keys in `fromJsonRender` (`./interop`); trailing whitespace in directive blocks and on comment lines; trailing `/` in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new `trimEndChar` is exported from `@cloudhal/core-ts/names` too. + + Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot. +- f4a1ee3: Status page fixes after RFC-0043 PR 1 (#167). The Site Worker no longer turns a 5xx the renderer or the theme answers on purpose into the `error` page: the starter's own `not-published` 503 for a request that reaches Astro (a `POST`, say) passes unchanged and logs nothing; only Astro's own 500 page (HTML, or its empty fallback when no 500 page renders) and thrown errors become the `error` page. A theme page that throws now gets that page with a reference and a `cloudhal: request failed` log line: the blog starter's catch-all route rethrows when Astro renders it as the error route, instead of answering its own 404 for the page's path (theme copies made from an earlier starter can add the same two lines at the top of `[...path].astro`). A store that cannot be read before rendering answers 503 `unavailable` with `Retry-After: 300`, as `/__cloudhal/health` reports it, instead of a 500; so does a multi-site Worker whose hostname map cannot be read (health `503 { ok: false }`, pages the English `unavailable` page). The `error` page uses the site's language and name when the request has already read the site, taken from the published snapshot (an unpublished rename never shows). An invalid preview token on a feed, sitemap, `llms.txt` or JSON path answers 410 instead of the published content, and no response says why a token failed any more (`x-cloudhal-preview-error` is now always `invalid`). +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [c15218e] + - @cloudhal/core-ts@0.6.5 + - @cloudhal/analytics@0.6.5 + - @cloudhal/comments@0.6.5 + - @cloudhal/storage@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/astro-renderer/package.json b/packages/astro-renderer/package.json index b648a8c7..444a7e6a 100644 --- a/packages/astro-renderer/package.json +++ b/packages/astro-renderer/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/astro-renderer", - "version": "0.6.4", + "version": "0.6.5", "description": "Render a Cloudhal Site Graph with Astro: data sources (live/snapshot), section components and the cloudhal() integration", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 3e585959..ed29b5a4 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,34 @@ # @cloudhal/cli +## 0.6.5 + +### Patch Changes + +- b0ebd95: Slug and name trims run in one linear pass instead of `/^-+|-+$/g` (CodeQL js/polynomial-redos, #168). This covers `slugify`, `foldName` and `slugifyFilename` in core-ts (the new `trimChar` is exported from `@cloudhal/core-ts/names`), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one `-` first. These inputs were quadratic and are linear now: analytics' `datasetName` on a long run of `_` inside a deployment name; json-render component keys in `fromJsonRender` (`./interop`); trailing whitespace in directive blocks and on comment lines; trailing `/` in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new `trimEndChar` is exported from `@cloudhal/core-ts/names` too. + + Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot. +- c15218e: Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged. + + - **Unauthenticated password-reset request.** `POST /api/password-reset/request` (and invite creation) checks the address length before anything else, and the address check no longer backtracks: `a@` followed by many dots used to cost seconds of CPU per request. Public token endpoints (`/api/password-reset/*`, invite acceptance) refuse a JSON body over 64 KiB with `413 payload_too_large`, whether or not it declares a `content-length`. + - **core-ts.** Redirect path normalising and matching (on every site request): `normalisePath`, `joinTarget`, and `ancestorPaths`, which no longer lists ancestors that no redirect can match: those longer than a `from` may be (1024 code points) or holding `//`. Directive lines in search text keep their braces on one line, so a directive whose `{…}` spans a lone `\r` is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, `url(…)` references (about cubic on `url(` followed by spaces) and width/height lengths (new `css-scan.ts`). + - **schedules.** The feed check's CDATA, element and ``/`` url scans, and `urlPath`. + - **agent-runtime.** SKILL.md frontmatter lines (a line of spaces was quadratic). + - **Studio** (in `@cloudhal/cli`): the markdown body editor's trailing-newline trims. +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [c15218e] + - @cloudhal/core-ts@0.6.5 + - @cloudhal/analytics@0.6.5 + - @cloudhal/comments@0.6.5 + - @cloudhal/agent-runtime@0.6.5 + - @cloudhal/api@0.6.5 + - @cloudhal/storage@0.6.5 + - @cloudhal/schedules@0.6.5 + - @cloudhal/cloudflare@0.6.5 + - @cloudhal/mcp-server@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index ded4401e..5e73a4ce 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/cli", - "version": "0.6.4", + "version": "0.6.5", "description": "cloudhal — create, run and build Cloudhal sites locally", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/cloudflare/CHANGELOG.md b/packages/cloudflare/CHANGELOG.md index 0ab274a8..4b717cd9 100644 --- a/packages/cloudflare/CHANGELOG.md +++ b/packages/cloudflare/CHANGELOG.md @@ -1,5 +1,22 @@ # @cloudhal/cloudflare +## 0.6.5 + +### Patch Changes + +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [c15218e] + - @cloudhal/core-ts@0.6.5 + - @cloudhal/analytics@0.6.5 + - @cloudhal/comments@0.6.5 + - @cloudhal/agent-runtime@0.6.5 + - @cloudhal/api@0.6.5 + - @cloudhal/storage@0.6.5 + - @cloudhal/schedules@0.6.5 + - @cloudhal/mcp-server@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/cloudflare/package.json b/packages/cloudflare/package.json index f0d3dbbc..d139aa38 100644 --- a/packages/cloudflare/package.json +++ b/packages/cloudflare/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/cloudflare", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal on Cloudflare: the admin Worker (API, auth, MCP, Studio) over D1 + R2", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/comments/CHANGELOG.md b/packages/comments/CHANGELOG.md index 0282a933..a977db30 100644 --- a/packages/comments/CHANGELOG.md +++ b/packages/comments/CHANGELOG.md @@ -1,5 +1,19 @@ # @cloudhal/comments +## 0.6.5 + +### Patch Changes + +- b0ebd95: Slug and name trims run in one linear pass instead of `/^-+|-+$/g` (CodeQL js/polynomial-redos, #168). This covers `slugify`, `foldName` and `slugifyFilename` in core-ts (the new `trimChar` is exported from `@cloudhal/core-ts/names`), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one `-` first. These inputs were quadratic and are linear now: analytics' `datasetName` on a long run of `_` inside a deployment name; json-render component keys in `fromJsonRender` (`./interop`); trailing whitespace in directive blocks and on comment lines; trailing `/` in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new `trimEndChar` is exported from `@cloudhal/core-ts/names` too. + + Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot. +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [c15218e] + - @cloudhal/core-ts@0.6.5 + - @cloudhal/storage@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/comments/package.json b/packages/comments/package.json index 4c91d3db..7131f7d3 100644 --- a/packages/comments/package.json +++ b/packages/comments/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/comments", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal reader comments (RFC-0007): settings and thread state, text normalising and content rules, linkify, first-party proof of work, the submission pipeline, purge planner, retention plan and the SQLite/D1 store. Worker-safe.", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/core-contracts/CHANGELOG.md b/packages/core-contracts/CHANGELOG.md index 2ffe91e2..453b4de2 100644 --- a/packages/core-contracts/CHANGELOG.md +++ b/packages/core-contracts/CHANGELOG.md @@ -1,5 +1,9 @@ # @cloudhal/core-contracts +## 0.6.5 + +No changes in this release. + ## 0.6.4 No changes in this release. diff --git a/packages/core-contracts/package.json b/packages/core-contracts/package.json index ac7aa1cc..db517216 100644 --- a/packages/core-contracts/package.json +++ b/packages/core-contracts/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/core-contracts", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal domain contracts: JSON Schema source of truth plus generated TypeScript types", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/core-ts/CHANGELOG.md b/packages/core-ts/CHANGELOG.md index eff23189..64f4d3aa 100644 --- a/packages/core-ts/CHANGELOG.md +++ b/packages/core-ts/CHANGELOG.md @@ -1,5 +1,25 @@ # @cloudhal/core-ts +## 0.6.5 + +### Patch Changes + +- b0ebd95: Slug and name trims run in one linear pass instead of `/^-+|-+$/g` (CodeQL js/polynomial-redos, #168). This covers `slugify`, `foldName` and `slugifyFilename` in core-ts (the new `trimChar` is exported from `@cloudhal/core-ts/names`), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one `-` first. These inputs were quadratic and are linear now: analytics' `datasetName` on a long run of `_` inside a deployment name; json-render component keys in `fromJsonRender` (`./interop`); trailing whitespace in directive blocks and on comment lines; trailing `/` in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new `trimEndChar` is exported from `@cloudhal/core-ts/names` too. + + Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot. +- c15218e: Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged. + + - **Unauthenticated password-reset request.** `POST /api/password-reset/request` (and invite creation) checks the address length before anything else, and the address check no longer backtracks: `a@` followed by many dots used to cost seconds of CPU per request. Public token endpoints (`/api/password-reset/*`, invite acceptance) refuse a JSON body over 64 KiB with `413 payload_too_large`, whether or not it declares a `content-length`. + - **core-ts.** Redirect path normalising and matching (on every site request): `normalisePath`, `joinTarget`, and `ancestorPaths`, which no longer lists ancestors that no redirect can match: those longer than a `from` may be (1024 code points) or holding `//`. Directive lines in search text keep their braces on one line, so a directive whose `{…}` spans a lone `\r` is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, `url(…)` references (about cubic on `url(` followed by spaces) and width/height lengths (new `css-scan.ts`). + - **schedules.** The feed check's CDATA, element and ``/`` url scans, and `urlPath`. + - **agent-runtime.** SKILL.md frontmatter lines (a line of spaces was quadratic). + - **Studio** (in `@cloudhal/cli`): the markdown body editor's trailing-newline trims. +- Updated dependencies [b0ebd95] +- Updated dependencies [c15218e] + - @cloudhal/storage@0.6.5 + - @cloudhal/schedules@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/core-ts/package.json b/packages/core-ts/package.json index c22a62dd..c4e61e67 100644 --- a/packages/core-ts/package.json +++ b/packages/core-ts/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/core-ts", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal Site Graph core (TypeScript): load/save nodes with optimistic locking, snapshots, diff, publish and rollback; taxonomies, terms, redirects and menus", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/create-cloudhal/CHANGELOG.md b/packages/create-cloudhal/CHANGELOG.md index 0b4252e0..88a884a3 100644 --- a/packages/create-cloudhal/CHANGELOG.md +++ b/packages/create-cloudhal/CHANGELOG.md @@ -1,5 +1,13 @@ # create-cloudhal +## 0.6.5 + +### Patch Changes + +- Updated dependencies [b0ebd95] +- Updated dependencies [c15218e] + - @cloudhal/cli@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/create-cloudhal/package.json b/packages/create-cloudhal/package.json index 22d550ee..92faf62a 100644 --- a/packages/create-cloudhal/package.json +++ b/packages/create-cloudhal/package.json @@ -1,6 +1,6 @@ { "name": "create-cloudhal", - "version": "0.6.4", + "version": "0.6.5", "description": "Create a Cloudhal site: npm create cloudhal@latest", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/mcp-server/CHANGELOG.md b/packages/mcp-server/CHANGELOG.md index 873199aa..f0187fb0 100644 --- a/packages/mcp-server/CHANGELOG.md +++ b/packages/mcp-server/CHANGELOG.md @@ -1,5 +1,23 @@ # @cloudhal/mcp-server +## 0.6.5 + +### Patch Changes + +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [b0ebd95] +- Updated dependencies [c15218e] +- Updated dependencies [f4a1ee3] + - @cloudhal/core-ts@0.6.5 + - @cloudhal/analytics@0.6.5 + - @cloudhal/astro-renderer@0.6.5 + - @cloudhal/comments@0.6.5 + - @cloudhal/agent-runtime@0.6.5 + - @cloudhal/storage@0.6.5 + - @cloudhal/schedules@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json index 81f867cf..7ec75fef 100644 --- a/packages/mcp-server/package.json +++ b/packages/mcp-server/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/mcp-server", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal MCP server: semantic site tools (pages, articles, snapshots, preview, publish) governed by the policy engine", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/schedules/CHANGELOG.md b/packages/schedules/CHANGELOG.md index b4ac4e90..c315625a 100644 --- a/packages/schedules/CHANGELOG.md +++ b/packages/schedules/CHANGELOG.md @@ -1,5 +1,20 @@ # @cloudhal/schedules +## 0.6.5 + +### Patch Changes + +- c15218e: Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged. + + - **Unauthenticated password-reset request.** `POST /api/password-reset/request` (and invite creation) checks the address length before anything else, and the address check no longer backtracks: `a@` followed by many dots used to cost seconds of CPU per request. Public token endpoints (`/api/password-reset/*`, invite acceptance) refuse a JSON body over 64 KiB with `413 payload_too_large`, whether or not it declares a `content-length`. + - **core-ts.** Redirect path normalising and matching (on every site request): `normalisePath`, `joinTarget`, and `ancestorPaths`, which no longer lists ancestors that no redirect can match: those longer than a `from` may be (1024 code points) or holding `//`. Directive lines in search text keep their braces on one line, so a directive whose `{…}` spans a lone `\r` is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, `url(…)` references (about cubic on `url(` followed by spaces) and width/height lengths (new `css-scan.ts`). + - **schedules.** The feed check's CDATA, element and ``/`` url scans, and `urlPath`. + - **agent-runtime.** SKILL.md frontmatter lines (a line of spaces was quadratic). + - **Studio** (in `@cloudhal/cli`): the markdown body editor's trailing-newline trims. +- Updated dependencies [b0ebd95] + - @cloudhal/storage@0.6.5 + - @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/schedules/package.json b/packages/schedules/package.json index e0e7f509..22c712c6 100644 --- a/packages/schedules/package.json +++ b/packages/schedules/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/schedules", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal schedules (RFC-0008): the time model, the RRULE subset and its sentences, releases (pin, closure, rl1: hash, compose, conflicts, state machine), automation and run state, taint and budget accounting, the Scheduler and runDue, and the SQLite/D1 store. Worker-safe.", "license": "Apache-2.0", "homepage": "https://cloudhal.dev", diff --git a/packages/storage/CHANGELOG.md b/packages/storage/CHANGELOG.md index bc615dc3..e5f6bdd5 100644 --- a/packages/storage/CHANGELOG.md +++ b/packages/storage/CHANGELOG.md @@ -1,5 +1,12 @@ # @cloudhal/storage +## 0.6.5 + +### Patch Changes + +- b0ebd95: Cloudhal's own rate-limit counters move out of Better Auth's `rateLimit` table into `rate_limits` (migration `0030_rate_limits`, #168). This covers the hourly cap of 3 reset mails per address, the per-minute buckets of the public token endpoints and each agent key's window. Better Auth prunes `rateLimit` by its own 60 s window, so the hourly reset-mail cap used to restart about a minute after any sign-in from the same address. Each hit counts in one statement (an upsert with `RETURNING`). Because the keys come from client addresses and submitted email addresses, about one hit in 32 also deletes up to 500 expired counters through an `expires_at` index. The migration deletes the old `cloudhal:` rows from `rateLimit`, so each counter starts over once at upgrade. +- @cloudhal/core-contracts@0.6.5 + ## 0.6.4 ### Patch Changes diff --git a/packages/storage/package.json b/packages/storage/package.json index f49a84f2..d936d9d6 100644 --- a/packages/storage/package.json +++ b/packages/storage/package.json @@ -1,6 +1,6 @@ { "name": "@cloudhal/storage", - "version": "0.6.4", + "version": "0.6.5", "description": "Cloudhal storage interfaces (SQL driver, blob store) with Cloudflare D1/R2/Durable Object SQLite and local SQLite/filesystem adapters", "license": "Apache-2.0", "homepage": "https://cloudhal.dev",