From 0eeed5ea6db93dc8cbabdeabf153b962c1eee877 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 2 Nov 2026 01:36:39 +0000 Subject: [PATCH] chore: version packages (rc) --- .changeset/pre.json | 10 ++++++++++ packages/every-plugin/CHANGELOG.md | 7 +++++++ packages/every-plugin/package.json | 2 +- packages/everything-dev/CHANGELOG.md | 22 ++++++++++++++++++++++ packages/everything-dev/package.json | 2 +- pnpm-workspace.yaml | 6 +++--- 6 files changed, 44 insertions(+), 5 deletions(-) diff --git a/.changeset/pre.json b/.changeset/pre.json index f86eae5b3..a9e71dd24 100644 --- a/.changeset/pre.json +++ b/.changeset/pre.json @@ -34,6 +34,7 @@ "auth-login-regressions", "auth-mirror-ui-port", "auth-plugin-route-loader-graceful", + "auth-rate-limit-ipaddress-config", "auth-remote-name-resolution", "auth-server-sweep-429b", "auth-ui-artifact-targets", @@ -61,6 +62,7 @@ "buildscoped-helper", "bundle-dir-quoting-hardening", "canonical-changeset-release-flow", + "catalog-bump-toolchain-lockstep", "child-bundle-storage", "child-compose", "child-image-pin", @@ -75,10 +77,12 @@ "compose-drop-degraded-toast", "compose-failure-isolation", "compose-shadow-subtree-parentage", + "concurrent-boot-artifact-race", "concurrent-migration-ddl-race", "config-declared-permissions", "config-discovery-dependencies", "config-pipeline-effect-native", + "configured-slot-stamping", "consolidated-deploy-train", "consumer-coupling-fixes", "csr-shell-compose-payload", @@ -108,6 +112,7 @@ "deploy-speed-430", "deploy-train-service", "deploy-train-smoke-gate", + "deps-catalog-bump-nov", "dev-bootstrap-effect-program", "dev-dashboard-build-diagnostics", "dev-logs-newest-session", @@ -135,6 +140,7 @@ "every-plugin-dev-generated-rspack-config", "every-plugin-error-formatting", "every-plugin-node-bins", + "every-plugin-orpc-beta-45", "every-plugin-serve-fail-loud", "every-plugin-skill-sources", "everything-dev-bna-quiet-build", @@ -183,6 +189,7 @@ "no-local-targets-across-extends", "no-watch-regression-stacks", "node-24-22-1-security-release", + "onboard-rescan-and-success-links", "one-row-per-plugin", "org-creation-approval", "org-onboarding-station", @@ -193,6 +200,7 @@ "passkey-client-hardening", "passkey-server-hardening", "passkey-single-ceremony-sign-up", + "pglite-only-local-db", "phase-b-sunset", "pipelined-upload-raw-config", "plan-008-db-runner-driver-consolidation", @@ -243,6 +251,7 @@ "root-template-catalog-parity", "route-tree-ui-workspace", "router-error-details-opt-out", + "rpc-client-custom-headers", "runtime-image-better-near-auth", "runtime-lifecycle-cache", "runtime-map-backends", @@ -284,6 +293,7 @@ "ssr-plugin-call-deadline", "ssr-plugin-ui-preload", "ssr-session-null-cache-poisoning", + "ssr-session-tri-state", "staging-input-schema", "stamp-plugin-ui-container-name", "start-container-env-and-baseurl", diff --git a/packages/every-plugin/CHANGELOG.md b/packages/every-plugin/CHANGELOG.md index ffa17fd8c..0f52d4564 100644 --- a/packages/every-plugin/CHANGELOG.md +++ b/packages/every-plugin/CHANGELOG.md @@ -1,5 +1,12 @@ # every-plugin +## 3.0.0-rc.15 + +### Patch Changes + +- 8c916ff: Bump the @orpc suite to 2.0.0-beta.45 — `MemoryPublisher`'s `resume` option takes `ttl` (milliseconds) instead of `seconds`. +- 150b092: `createRpcClient` keeps the request's own headers, including `content-type: application/json`, when you pass custom headers such as an API key. Before, they were dropped and the server rejected the input. + ## 3.0.0-rc.14 ### Patch Changes diff --git a/packages/every-plugin/package.json b/packages/every-plugin/package.json index 91e1eacba..f426e1d0e 100644 --- a/packages/every-plugin/package.json +++ b/packages/every-plugin/package.json @@ -1,6 +1,6 @@ { "name": "every-plugin", - "version": "3.0.0-rc.14", + "version": "3.0.0-rc.15", "type": "module", "publishConfig": { "access": "public" diff --git a/packages/everything-dev/CHANGELOG.md b/packages/everything-dev/CHANGELOG.md index c21eb02a4..dbc516738 100644 --- a/packages/everything-dev/CHANGELOG.md +++ b/packages/everything-dev/CHANGELOG.md @@ -1,5 +1,27 @@ # everything-dev +## 2.0.0-rc.28 + +### Minor Changes + +- 8c916ff: Second catalog leg: react/react-dom 19.3.1 (strict singletons — floating children realign via `bos upgrade`), effect 4.0.0-rc.118 with the vendored clone retagged and the unstable/http subpaths promoted to effect/http/\*, alchemy 2.0.0-beta.83 (beta.84 removed the Docker/Util surface), module-federation 2.9.2, tanstack query 5.104.5 / table 9.3.1 / form 1.33.5 / intent 0.5.6, zod 4.6.7, yaml 2.9.1, drizzle patches. +- 680ea78: PGlite is the only local database — docker-compose is retired (ADR 0038). The zero-config dev default is now a persistent, file-backed PGlite data dir (`pglite:.bos/db`, per workspace process), so concurrent local projects can never collide on DB ports and data survives restarts without any `.env`. `bos dev` migrates leftovers once: compose-era `postgres://everythingdev:…@localhost:543x/…` URLs in `.env` are rewritten to the pglite defaults and a scaffold-shaped `docker-compose.yml` is relocated to `.bos/compose-retired/`. `db:*` commands work against pglite (drizzle-kit pglite dialect selected by URL scheme); the CLI/scaffold drop the compose template, `dev:postgres*` scripts, post-init docker prompt, and preflight auto-start; regression tests and the deploy smoke run on pglite (`TEST_DATABASE=postgres` + an external URL remains the parity escape hatch). Production `postgres://` URLs are unchanged. + +### Patch Changes + +- 282ede6: Auth plugin surfaces rate-limit and client-IP configuration (#688). New authored variables under `auth.variables`: `rateLimit: { enabled, window (seconds), max, storage: "memory" | "database" }` and `ipAddress: { ipAddressHeaders, trustedProxies }`. A new `rate_limit` table backs `storage: "database"` — the multi-replica option, since in-memory buckets are per instance (migration applied on boot). `trustedProxies` is strictly opt-in: Better Auth walks the forwarded chain right-to-left and takes the first untrusted address, so list your proxies' own addresses, never a range that also covers clients (#338). Deployments behind appending proxies (Cloudflare + Railway) should name a single trusted header (`cf-connecting-ip`, `x-real-ip`) — the default `x-forwarded-for` cannot resolve a client IP through an untrusted comma-chain, which is why the boot WARN fell back to a shared per-path bucket. Absent configuration leaves Better Auth's defaults unchanged; `BETTER_AUTH_RATE_LIMIT_DISABLED=1` still wins. The root runtime's canonical posture in `bos.app.ts` is `ipAddress: { ipAddressHeaders: ["cf-connecting-ip"] }` with no `rateLimit` — library defaults stand; the root is Cloudflare-proxied, children inherit it through `extends`, and each deployment can override. +- 8c916ff: Bump the platform catalog: better-auth 1.7.7 → 1.7.14 (with @better-auth/\*), @orpc suite 2.0.0-beta.35 → 2.0.0-beta.45 (`PublisherResumeOptions` takes `ttl` in milliseconds instead of `seconds`), @tanstack/react-router 1.170.32 → 1.170.46 (router-core 1.171.39, router-plugin 1.168.48, router-generator 1.167.46), and the Effect toolchain trio in lockstep (@effect/tsgo 0.63.0, oxlint 1.90.0, oxlint-tsgolint 7.0.2005). The pnpm pin moves to 12.16.1. + + Overrides now reference the catalog through pnpm's `catalog:` protocol so shared-dep pins cannot drift from the catalog (#659/#682); `bos upgrade` reconciles child overrides, propagates the pnpm pin forward-only to existing v2 children, and regenerates the framework `minimumReleaseAgeExclude` rows from the catalog with `minimumReleaseAgeExcludePrune` enabled — the list replaces instead of accumulating. The v1→v2 migration's `V2_CATALOG` baseline is drift-guarded against the parent catalog (row-for-row, both directions), closing #650's outdated-catalog vector. + +- 680ea78: Concurrent `bos dev` sessions in one config dir no longer crash artifact generation: `.bos/bos.resolved-config.json` is now written atomically (tmp + rename) so a sibling session never reads a torn file, and the contract-bridge stale sweep removes gen files with `rmSync(…, { force: true })` so a file vanishing between the existence check and the removal no longer fails the boot with `ENOENT … lstat`. +- 024e9c7: Release-scoped slot stamping no longer skips a slot the child only configures. A child that sets `auth: { variables, secrets }` (or a remote-only `api: { variables, secrets }`) had that slot counted as authored, so the deploy train left it unpinned and the auth server (or api) kept following the parent's live config pointer — under a host and auth UI pinned to the child's release. A slot now counts as authored only when it names a code source (`production`, `development`, `pin`, `extends`, `proxy`, a bare plugin ref, or `ui: false`); configuration-only entries get the release's `production` + `pin` stamped with their `variables`/`secrets` kept. Affected children pick this up on their next deploy after upgrading. +- 2f72431: Auth plugin onboard page: a rescan by someone who has left the community now says they're no longer a member instead of "You're in". The page checks a fresh organization list against the redeemed organization ID, clears a stale active organization, and shows a retryable error if the check fails. The redeem's refusal for a member who left now carries `data.action: "rejoin-organization"`. Child apps can configure the joined screen through the `onboard` auth variable: `links.next`/`links.home` (with an `{organizationId}` placeholder) and `links.explore` for the success and error panels (defaults stay `/build`, `/dashboard`, `/explore`; `next: false` hides the build link), plus `community.url`, an app endpoint that returns the joined community's page and channels for a "Visit {community}" button and channel links. +- 86eb1df: SSR session resolution is tri-state and never round-trips the public edge on the hot path (#689). The host's per-request in-process `getContext` resolution now distinguishes **unresolved** (no auth plugin, or resolution failed → `undefined`) from **authoritative sign-out** (getContext succeeded with no session → `null`). The SSR query-cache seeding follows: authoritative null seeds the cache (the same explicit signed-out entry sign-out writes), undefined leaves it empty so the guard's fetch still runs — closing the #527 failure mode where a wedged auth resolution redirected signed-in users to /login without ever fetching. A server-side session-fetch failure degrades to a signed-out render instead of failing the whole document: an edge rate-limit or block page can no longer 500 every SSR page for every visitor. +- Updated dependencies [8c916ff] +- Updated dependencies [150b092] + - every-plugin@3.0.0-rc.15 + ## 2.0.0-rc.27 ### Patch Changes diff --git a/packages/everything-dev/package.json b/packages/everything-dev/package.json index ba7cf6500..cd5e0f33f 100644 --- a/packages/everything-dev/package.json +++ b/packages/everything-dev/package.json @@ -1,6 +1,6 @@ { "name": "everything-dev", - "version": "2.0.0-rc.27", + "version": "2.0.0-rc.28", "type": "module", "engines": { "node": ">=20.11" diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 5d6e59146..e070b1fff 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -10,9 +10,9 @@ catalog: "@better-auth/core": 1.7.14 "@better-auth/passkey": 1.7.14 "@better-fetch/fetch": 1.3.3 - "@electric-sql/pglite": ^0.4.5 "@effect/platform-node": 4.0.0-rc.118 "@effect/platform-node-shared": 4.0.0-rc.118 + "@electric-sql/pglite": ^0.4.5 "@hot-labs/near-connect": elliotBraem/near-connect#v0.12.0-fork.3 "@libsql/client": 0.17.0 "@lingui/core": 5.9.0 @@ -67,8 +67,8 @@ catalog: drizzle-kit: ^0.31.11 drizzle-orm: ^0.45.4 effect: 4.0.0-rc.118 - every-plugin: ^3.0.0-rc.14 - everything-dev: ^2.0.0-rc.27 + every-plugin: ^3.0.0-rc.15 + everything-dev: ^2.0.0-rc.28 near-kit: ^0.20.2 pg: ^8.12.0 react: 19.3.1