@daloyjs/core 0.38.1 → 0.38.2

package/README.md

@@ -30,6 +30,19 @@ DaloyJS is maintained in the GitHub organization at <https://github.com/daloyjs>
 
 ---
 
+## Built for the vibe-coding era
+
+Most backend code is now written with AI. Non-developers describe an app and ship whatever the model produces; engineers let agents install dependencies, run tests, and open PRs. The code works on the happy path and gets deployed within the hour — usually with no body limits, skippable input validation, admin routes left mounted on the public app, and an outbound `fetch` that will happily call cloud-metadata endpoints. At the same time, the dependency tree itself has become the attack surface: self-replicating npm worms, malicious `postinstall` scripts, CI cache-poisoning, and **slopsquatting** — where an attacker pre-registers a package name an AI assistant is likely to hallucinate.
+
+DaloyJS is built for exactly this moment, from two directions at once:
+
+- **A secure-by-default runtime.** Body limits, prototype-pollution-safe JSON, path-traversal rejection, request timeouts, header-injection guards, real `405`s, and RFC 9457 problem+json with prod-mode redaction are on in the constructor — the dangerous things are off when nobody remembered to turn them off. The app also *refuses to boot* on unsafe configuration (wildcard CORS with credentials, weak session secrets, a state-changing session route with no CSRF protection, unconfigured `X-Forwarded-*` in production).
+- **A hardened supply chain.** `@daloyjs/core` ships **zero runtime dependencies**, is published with npm provenance and CycloneDX + SPDX SBOMs, and the pnpm posture (`ignore-scripts`, a 24-hour release-age cooldown, source-verified lockfiles) plus the CI `verify:*` gates shrink the blast radius of the campaigns making headlines.
+
+The point is that none of this costs you developer experience or portability: you keep contract-first DX in the league of ts-rest, Elysia, and FastAPI, and Hono-grade portability across Node, Bun, Deno, Workers, Vercel, Fastly, and Lambda. The secure path is simply the path of least resistance. See [Vibe Coding Security: what DaloyJS already blocks](https://daloyjs.dev/blog/vibe-coding-security-what-daloyjs-already-blocks) and the [security docs](https://daloyjs.dev/docs/security).
+
+---
+
 DaloyJS exists to be the framework you'd build if you took the best ideas from each modern stack:
 
 | You want                                                | Today's best-of                                       | What DaloyJS gives you                                                                                                                               |

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:51e4c48d-6a2e-5180-8452-1c9b9a5987d9",
+  "serialNumber": "urn:uuid:5b67e701-c198-5112-9457-127897c8cfb6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-11T09:54:26.041Z",
+    "timestamp": "2026-06-16T14:45:02.537Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.38.1"
+        "version": "0.38.2"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.38.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.38.2",
       "name": "@daloyjs/core",
-      "version": "0.38.1",
+      "version": "0.38.2",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.38.1",
+      "purl": "pkg:npm/@daloyjs/core@0.38.2",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.38.1",
+        "tagId": "swidtag--daloyjs-core-0.38.2",
         "name": "@daloyjs/core",
-        "version": "0.38.1",
+        "version": "0.38.2",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.38.1",
+      "ref": "pkg:npm/@daloyjs/core@0.38.2",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.38.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.38.1-51e4c48d-6a2e-5180-8452-1c9b9a5987d9",
+  "name": "@daloyjs/core-0.38.2",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.38.2-5b67e701-c198-5112-9457-127897c8cfb6",
   "creationInfo": {
-    "created": "2026-06-11T09:54:26.041Z",
+    "created": "2026-06-16T14:45:02.537Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.38.1",
+      "versionInfo": "0.38.2",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.38.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.38.2"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "0.38.1",
+  "version": "0.38.2",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {