[terencecho]

What

Release v0.9.35: version bump for 15 packages and 5 plugin manifests, plus the release notes for the seven changes since v0.9.34.

Private files like .env and git data stay out of preview bundles, and local sharing only answers your own machine. Sharing also keeps tracking changes when .hyperframesignore uses gitignore patterns.

Fixes

• Security: Preview bundles never include .env files or git data, even through a link. A render that names one of these files now stops with an error. Local sharing only answers this machine, so sharing from Studio in a container now gets a 403 (a243169f8, #7563).
• Security: Helper programs are found by walking your trusted PATH folders directly. On Windows, the working folder is never searched (9a048ac01, #7562).
• Share: Change detection keeps working when .hyperframesignore uses gitignore patterns such as /exports/ or **/*.mov. Before, those patterns stopped it with an error (c07468d6a, #7568).
• CLI: Durations and sizes roll over to the next unit when rounded, so you see 1m 0.0s and 1.0 MB, not 60.0s and 1024.0 KB (182608311, #7565).

Docs & Examples

• Studio App: The brand kits page says kits are shared with your workspace only (c218b37a3, #7570).

Internal

• Core: The preview runtime offers its parent a typed message port. This prepares Studio for a sealed preview frame and changes nothing yet (ef5cdeb0a, #7556).
• CLI: Local Studio's share window counts button clicks and choices. Only fixed categories are recorded, never links, paths or email addresses (2a70733c1, #7566).

Why

Ships the .hyperframesignore change-detection fix (#7568), so hosts can pin a share package whose scan works with gitignore-style ignore files. Also ships the private-file and local-sharing hardening (#7563), the helper-program lookup fix (#7562), the CLI unit-rounding fix (#7565), the brand kits doc fix (#7570), the preview editing port (#7556) and the local Studio share-window counts (#7566).

Related work

Follows chore: release v0.9.34 (#7555).

How

bun run release:prepare 0.9.35 drafted both notes files. The summary was written, the style-bar line removed and each line put in plain words in both files. Rerunning bun run release:prepare 0.9.35 set 15 packages and 5 plugin manifests to 0.9.35. The changed file list matches the v0.9.34 release commit (22 files). No tag is pushed; the release workflow tags the merge SHA.

Release gate

Core, CLI, parsers and share code changed, so the full release gate runs on this head with these packed packages. Link below when it finishes.

• Full gate: PASS in 12 min, the full walk with the packed 0.9.35 packages from this PR's CI. The only later commit edits the release notes.

No visible change

Version bump and changelog only. Each change was captured in its own PR.

Test plan

• Unit tests added/updated (release commit only, no code)
• Manual testing performed: diff checked to be only version strings plus the two notes files
• Documentation updated: docs/changelog.mdx and releases/v0.9.35.md, summary written by hand
• Comments follow CONTRIBUTING.md "Comments"

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟢 Ready	View Preview	Nov 11, 2026, 9:54 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[heygengenesis]

Verdict: COMMENT (needs human) · 0 blocker · 1 important · 1 nit · head 3f39f31
The notes and version bump are right. COMMENT, not approve, because a release publishes to npm and the release owner makes that call.

• important: the body still says Full gate on this head: pending. CI on this head only ran the release checks, so link the full gate run before merging.

Checked

• Version bump: 15 PACKAGES + 5 PLUGINS from scripts/set-version.ts. All 20 manifests change only 0.9.34 → 0.9.35.
• Notes vs. draft: draft-changelog.ts 0.9.35 --from v0.9.34 --to 2a70733c1 lists 7 PRs. All 7 are in the notes, and releases/v0.9.35.md matches the mdx block bullet for bullet.
• Range: git log head..origin/main is empty, so nothing merged after the cut.
• Prerequisites: none of the 7 PR bodies has a merge hold or release prerequisite.
• CI: CI, CodeQL, Windows render, regression, preview-regression, captures and Docs are all green. Comments was skipped.

[heygengenesis]

Verdict: COMMENT (needs human): 1 resolved, 1 open, 0 new · 3f39f31 → 5a98ce2. CI is green. Still open: the body says Full gate on this head: pending.

[heygengenesis]

Verdict: APPROVE: 2 resolved, 0 open, 0 new · 5a98ce2. CI is green. The full gate PASS is taken from the PR body, which has no run link. The packages are from 3f39f31, and the only commit since then changes notes.