tina4ruby 3.13.143 → 3.13.144

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 641d95c3ab74eeac0ce2b273ee7c6c44ca8aaab5e7e2a06d8e668eacffc5fb28
-  data.tar.gz: f8ad58627e7263bf560b499dc40fbd249d3267516d61b2c31696051f80b11852
+  metadata.gz: 2e29afb3cbaf02d7c7023e2bac155eb3fd4ceb3493972c3eac8b0f68b117cab9
+  data.tar.gz: 6be275fdaab754c2be7ff562efc12d34ea5cc99c4837260b4e3f5303dbde9fdf
 SHA512:
-  metadata.gz: 2354cb021a1136116236d2a94f6c5be38331823eda3e4ea4b37483ac395e3324af69b8a88d55e856039fe1951bb74be6e4918505bcbd6f6b70075f9b2ef0f232
-  data.tar.gz: f3c5de4a797f61db477db42c3a46e0f47dd132e7e2522b05d6127ee6c6d84b631215808fcb88953467308291a9754b39811f1ab8604f02fca93921b39b2ea67b
+  metadata.gz: b491c66de3d3f24e620c7bf75937597befc770644a0f5acfa427c63de5a111c63cb0c346536f995ecb9176dbaf59804856fd24aa3e51eb7c9d66cce712275dfb
+  data.tar.gz: 5dd6c2217a02461313ace92290ddb93d97aaa4e43c2bf972852f0e5eb7ef1e0d02757e43ee95c1e1f3a23eebfc3970316ed45fdc7d73218fdd85f8972aeb7987

data/CHANGELOG.md

@@ -6,6 +6,10 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.144 — 2026-10-02
+
+HEAD responses are locked to exactly one `Content-Length` on the wire, equal to the length the GET would have sent. A HEAD emitting two differing `Content-Length` headers is malformed (RFC 7230 s3.3.2); a strict proxy (nginx) 502s it while lenient clients show 200. Ruby already writes a single, correct `Content-Length` with an empty body; this release LOCKS it with a conformance test that boots the real built-in server and reads the raw socket, because the in-process test reads a response object and cannot see the wire - the layer where tina4-php shipped `Content-Length: 0` on every routed HEAD (fixed in the same release). Also internal: the serve-debug readiness harness is unified on the `Server:`-banner identity guard across all four frameworks, and a carbon-benchmark drift (a `to_paginate` call with arguments, which ADR-0043 forbids) is fixed so `carbon_benchmarks.rb --carbon` runs clean. No runtime behaviour change in ruby. The framework still has no required runtime dependencies.
+
 ## 3.13.143 — 2026-10-01
 
 A fresh project's own styling now loads under the strict default Content-Security-Policy. The framework serves `default-src 'self'`, which a browser enforces by refusing every inline `<style>` and `<script>` -- so a new project rendered unstyled with its scripts blocked. The framework now mints one nonce per response, injects it into the `style-src` and `script-src` directives, and stamps it on every inline block it emits, de-inlining the `style=` and `on*=` attributes it used to rely on; a template that needs an inline block stamps `csp_nonce()` on it (ADR-0088, #96). A session's expiry now slides on activity: a read-only request that touched a stored session re-writes the merged record to move the deadline forward, so a request in flight next to a logout no longer loses the wrong state (ADR-0087, #94). Internally, the serve-debug readiness probe is identity-guarded so a foreign server on a reused ephemeral port can no longer be mistaken for the child under test -- a continuous-integration flake fix with no runtime change (#95). The framework still has no required runtime dependencies.

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.143"
+  VERSION = "3.13.144"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.143
+  version: 3.13.144
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3