@_linked/server 2.13.3 → 2.13.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +42 -0
- package/package.json +6 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,47 @@
|
|
|
1
1
|
# @\_linked/server
|
|
2
2
|
|
|
3
|
+
## 2.13.5
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- [#92](https://github.com/linked-fw/server/pull/92) [`c17a450`](https://github.com/linked-fw/server/commit/c17a4501f55b824ad3f22ab24fc989f8145f11e7) Thanks [@flyon](https://github.com/flyon)! - Cover `GET /resized/*` with an SVG source.
|
|
8
|
+
|
|
9
|
+
The route had no test at all. These assert on the BYTES and the KEY rather than
|
|
10
|
+
the status code, because the half that matters is silent: writing PNG bytes under
|
|
11
|
+
a `.svg` key still returns 200, and only misbehaves on the next request, when the
|
|
12
|
+
cache-hit path types the response `image/svg+xml` from that extension.
|
|
13
|
+
|
|
14
|
+
Both branches are covered — the `src`-parameter branch and the uploads branch —
|
|
15
|
+
because the bug was in both, for two different reasons. A third case pins a JPEG
|
|
16
|
+
source as staying a JPEG, so the rasterization cannot quietly become
|
|
17
|
+
unconditional.
|
|
18
|
+
|
|
19
|
+
Verified against the reverted fix: both SVG cases fail, the JPEG case passes.
|
|
20
|
+
|
|
21
|
+
## 2.13.4
|
|
22
|
+
|
|
23
|
+
### Patch Changes
|
|
24
|
+
|
|
25
|
+
- [#93](https://github.com/linked-fw/server/pull/93) [`df86a49`](https://github.com/linked-fw/server/commit/df86a490d3335ab3d36645a8c6ae8f3f713d71c2) Thanks [@flyon](https://github.com/flyon)! - `linked.serverOnly` now names what is actually server-only.
|
|
26
|
+
|
|
27
|
+
It declared wildcards:
|
|
28
|
+
|
|
29
|
+
```jsonc
|
|
30
|
+
"serverOnly": [".", "./shapes/*", "./server/*", "./utils/*"]
|
|
31
|
+
```
|
|
32
|
+
|
|
33
|
+
Of the thirteen modules under `shapes/` and `utils/`, **two** reach a node
|
|
34
|
+
builtin. The rest are client-safe and were being reported as server-only to
|
|
35
|
+
every consumer — including `BackendAPIStore`, the client-side store that is
|
|
36
|
+
meant to be imported by a frontend. `./server/*` matched nothing at all.
|
|
37
|
+
|
|
38
|
+
Consumers that enforce a client/server boundary from these declarations were
|
|
39
|
+
therefore flagging correct code, and the usual repair — an allowlist entry, or
|
|
40
|
+
relocating the module — made things worse rather than better.
|
|
41
|
+
|
|
42
|
+
The declaration now lists the six subpaths that genuinely are server-only. No
|
|
43
|
+
code moved and no module changed.
|
|
44
|
+
|
|
3
45
|
## 2.13.3
|
|
4
46
|
|
|
5
47
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
"type": "git",
|
|
11
11
|
"url": "git+https://github.com/linked-fw/server.git"
|
|
12
12
|
},
|
|
13
|
-
"version": "2.13.
|
|
13
|
+
"version": "2.13.5",
|
|
14
14
|
"packageManager": "npm@11.19.1",
|
|
15
15
|
"linkedPackage": true,
|
|
16
16
|
"type": "module",
|
|
@@ -95,9 +95,11 @@
|
|
|
95
95
|
"linked": {
|
|
96
96
|
"serverOnly": [
|
|
97
97
|
".",
|
|
98
|
-
"./
|
|
99
|
-
"./
|
|
100
|
-
"./
|
|
98
|
+
"./backend",
|
|
99
|
+
"./shapes/LinkedServer",
|
|
100
|
+
"./shapes/filestores/*",
|
|
101
|
+
"./utils/releaseManifest",
|
|
102
|
+
"./utils/routeAssets"
|
|
101
103
|
]
|
|
102
104
|
},
|
|
103
105
|
"publishConfig": {
|