From 3a298bba73784555e6241a4b7f4e4c144b626710 Mon Sep 17 00:00:00 2001 From: urlcode-release Date: Wed, 23 Sep 2026 17:36:55 +0000 Subject: [PATCH] Pin starter runtime to 0.5.9 --- README.md | 18 +++++++++--------- package-lock.json | 8 ++++---- package.json | 2 +- routes/functions.yaml | 2 +- routes/marketing/links.yaml | 2 +- 5 files changed, 16 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index 33c8646..4a1ba4d 100644 --- a/README.md +++ b/README.md @@ -168,12 +168,12 @@ export default async function headers(request, context, next) { ``` Reuse middleware on other routes, return a response early, or share request-local -values through `context.state`. Under the pinned `0.5.8` runtime +values through `context.state`. Under the pinned `0.5.9` runtime middleware runs trusted and in-process by default, exactly as functions do: a chain shares one deadline, but not a sandbox unless the route opts in with `sandbox: true`. The regular redirect keeps its native fast path without middleware. -See [middleware semantics for this pin](https://github.com/jimhoyd-com/urlcode/blob/v0.5.8/docs/MIDDLEWARE.md) +See [middleware semantics for this pin](https://github.com/jimhoyd-com/urlcode/blob/v0.5.9/docs/MIDDLEWARE.md) for ordering, native body limits, binding policy and explicit test requirements. ## Method defaults @@ -248,7 +248,7 @@ checks, outgoing headers and native text/JSON responses in YAML. See the The runtime also supports [pages, files and downloads](https://github.com/jimhoyd-com/urlcode/blob/main/docs/ASSETS.md). These features need no extra example clutter in your starting project. -In the `0.5.8` runtime this template pins, `function` and `middleware` +In the `0.5.9` runtime this template pins, `function` and `middleware` routes run **trusted and unsandboxed** in the host process, with full Node, filesystem and network access, exactly like any other project code ([decision record](https://github.com/jimhoyd-com/urlcode/blob/main/docs/SPIKE-DEFAULT-TRUST-MODEL.md)). @@ -270,11 +270,11 @@ neither input validation nor authentication. The example routes in this template are trusted deliberately and need no secrets. Keep any future secret values in ignored `.env.local` locally or injected by your host; external bindings require a separate operator policy. Read the -[security model for this pin](https://github.com/jimhoyd-com/urlcode/blob/v0.5.8/docs/FUNCTION-SECURITY.md). +[security model for this pin](https://github.com/jimhoyd-com/urlcode/blob/v0.5.9/docs/FUNCTION-SECURITY.md). Never commit credentials, tokens or session cookies in YAML headers. -This template pins the `0.5.8` published local/self-hosted runtime. Review the -[release-readiness gates](https://github.com/jimhoyd-com/urlcode/blob/v0.5.8/docs/RELEASE-READINESS.md) before deployment. Read the +This template pins the `0.5.9` published local/self-hosted runtime. Review the +[release-readiness gates](https://github.com/jimhoyd-com/urlcode/blob/v0.5.9/docs/RELEASE-READINESS.md) before deployment. Read the [operations guide](https://github.com/jimhoyd-com/urlcode/blob/main/docs/OPERATIONS.md) before deploying. Provider adapters and URLCode Cloud remain future work. @@ -287,15 +287,15 @@ After adding references in YAML, run `npm run scaffold -- --dry-run` to preview missing files, then `npm run scaffold` to create them. Existing files stay intact. Function/middleware placeholders return 501 until implemented; binary assets and external bindings are reported for you to supply. -[Full guide](https://github.com/jimhoyd-com/urlcode/blob/v0.5.8/docs/SCAFFOLDING.md). +[Full guide](https://github.com/jimhoyd-com/urlcode/blob/v0.5.9/docs/SCAFFOLDING.md). ## Security notes for the pinned runtime The pinned runtime includes security fixes for failed log collectors, management HTTP admission/timeouts, and metadata-only development watching. Review the -[security audit and remaining gates](https://github.com/jimhoyd-com/urlcode/blob/v0.5.8/docs/SECURITY-AUDIT.md) before production use. +[security audit and remaining gates](https://github.com/jimhoyd-com/urlcode/blob/v0.5.9/docs/SECURITY-AUDIT.md) before production use. The pinned runtime includes bounded configuration loading, loopback-only management, scoped/expiring/revocable operator credentials and atomic mutation audits. Read the -[management security guide](https://github.com/jimhoyd-com/urlcode/blob/v0.5.8/docs/MANAGEMENT-SECURITY.md) +[management security guide](https://github.com/jimhoyd-com/urlcode/blob/v0.5.9/docs/MANAGEMENT-SECURITY.md) before operating the management endpoint. Independent assessment and deployment acceptance remain open. diff --git a/package-lock.json b/package-lock.json index 79e5229..ab8cc0e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,16 +8,16 @@ "name": "my-urlcode-project", "version": "0.1.0", "dependencies": { - "@jimhoyd/urlcode": "0.5.8" + "@jimhoyd/urlcode": "0.5.9" }, "engines": { "node": ">=22.13.0" } }, "node_modules/@jimhoyd/urlcode": { - "version": "0.5.8", - "resolved": "https://registry.npmjs.org/@jimhoyd/urlcode/-/urlcode-0.5.8.tgz", - "integrity": "sha512-xAPSW6UUF1oYifYDJQaHqbFyRPZhHa1jtAMr5110QrkAAMjJubb84ud8/Dp0wuryXQNj2MYIeftXChVUXUafiw==", + "version": "0.5.9", + "resolved": "https://registry.npmjs.org/@jimhoyd/urlcode/-/urlcode-0.5.9.tgz", + "integrity": "sha512-Qe3h9e3EAqmY4jvTgSW1VhRTFrXS7PplCgiVswnMvtV8/O8dK9cSqSK93BZab2dOgBtA8RDeXUgInovxYf5wJA==", "license": "Apache-2.0", "workspaces": [ "packages/*" diff --git a/package.json b/package.json index 9533dab..0a64742 100644 --- a/package.json +++ b/package.json @@ -18,6 +18,6 @@ "scaffold": "urlcode scaffold" }, "dependencies": { - "@jimhoyd/urlcode": "0.5.8" + "@jimhoyd/urlcode": "0.5.9" } } diff --git a/routes/functions.yaml b/routes/functions.yaml index 10f96aa..c94cfb4 100644 --- a/routes/functions.yaml +++ b/routes/functions.yaml @@ -1,4 +1,4 @@ -# yaml-language-server: $schema=https://raw.githubusercontent.com/jimhoyd-com/urlcode/v0.5.8/schemas/urlcode.schema.json +# yaml-language-server: $schema=https://raw.githubusercontent.com/jimhoyd-com/urlcode/v0.5.9/schemas/urlcode.schema.json # File locations do not change route paths. GET/HEAD are the default methods. version: "1" routes: diff --git a/routes/marketing/links.yaml b/routes/marketing/links.yaml index 0147fc6..9de2972 100644 --- a/routes/marketing/links.yaml +++ b/routes/marketing/links.yaml @@ -1,4 +1,4 @@ -# yaml-language-server: $schema=https://raw.githubusercontent.com/jimhoyd-com/urlcode/v0.5.8/schemas/urlcode.schema.json +# yaml-language-server: $schema=https://raw.githubusercontent.com/jimhoyd-com/urlcode/v0.5.9/schemas/urlcode.schema.json version: "1" routes: # A regular redirect needs no custom code.