@mohsinonxrm/pptb-fetchxml-studio 1.5.0-beta.12 → 1.5.0-beta.13

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.0-beta.13] - 2026-10-18
+
+### 🔧 Fixed
+
+- **pac CLI snippet: the shell no longer expands FetchXML values (#166, found by CodeQL).** The XML was wrapped in double quotes with only `"` escaped, so bash and zsh expanded values such as `$100`, `$(…)` or backticks when the snippet was pasted, and PowerShell rejected `\"`. The snippet now single-quotes the XML on a **bash / zsh** line (`'` written as `'''`) and a **PowerShell 7.3+** line (`'` written as `''`), and points to `--xmlFile` for Windows PowerShell 5.1. It uses `pac env fetch`: `pac org` was renamed `pac env` in pac 1.32, and `org` still works.
+
+### 🏗️ Technical
+
+- **Release branches (`RELEASING.md`).** A minor release now stabilizes on its own `release/X.Y` branch, cut from `dev` at the feature freeze, so `dev` is never frozen. Betas (`-beta.N`, `-rc.N`) are tagged there and publish to npm `beta`. A stable release merges `release/X.Y` → `main` and is tagged there (npm `latest`). Fixes go to the oldest supported branch that has the bug and merge forward (`main` → `release/*` → `dev`).
+- **Supported versions (`SECURITY.md`):** the current stable release gets fixes. The previous minor gets critical and security fixes for 30 days after the next minor ships, from a `support/X.Y` branch that publishes to npm `support-X.Y`, never `latest`.
+- **`release.yml` chooses the channel from the tag:** `-beta.N` / `-rc.N` → `beta` (pre-release); a stable tag on `main` → `latest`; a stable tag on `support/X.Y` → `support-X.Y` (not marked as the latest GitHub Release). Any other tag fails before publishing. CI also runs on pushes to `release/**` and `support/**`.
+- **Release process: stabilizing before a stable release (`RELEASING.md`).** Each stable release has a milestone and a "Release X.Y.Z" tracking issue. Before a beta is promoted to npm `latest`, the milestone is clear, the latest beta is smoke-tested in PPTB, it soaks for 7 days without a new P0/P1 bug, and CI and the runtime audit are clean. Stabilizing happens on the release branch, so `dev` isn't frozen. The same process applies to Command Bar Studio and Dataverse Request Studio.
+
 ## [1.5.0-beta.12] - 2026-10-18
 
 ### ✨ Added

package/README.md

@@ -2,7 +2,7 @@
 
 A powerful, modern FetchXML query builder and data explorer for [Power Platform ToolBox](https://github.com/PowerPlatformToolBox/desktop-app). Inspired by the XrmToolBox FetchXML Builder, reimagined with React 18, Fluent UI v9, and seamless Dataverse integration.
 
-![Version](https://img.shields.io/badge/version-1.5.0--beta.12-blue)
+![Version](https://img.shields.io/badge/version-1.5.0--beta.13-blue)
 [![npm](https://img.shields.io/npm/v/@mohsinonxrm/pptb-fetchxml-studio?label=npm)](https://www.npmjs.com/package/@mohsinonxrm/pptb-fetchxml-studio)
 ![React](https://img.shields.io/badge/React-18-61DAFB?logo=react)
 ![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178C6?logo=typescript)
@@ -104,7 +104,7 @@ A powerful, modern FetchXML query builder and data explorer for [Power Platform
 - **C# QueryExpression** — Full SDK object graph (`QueryExpression`, `ColumnSet`, `FilterExpression`, `ConditionExpression`, `LinkEntity`, `OrderExpression`) via the Dataverse `FetchXmlToQueryExpression` API; supports aggregate queries with `XrmAggregateType` and `XrmDateTimeGrouping`
 - **C# FetchExpression** — Simple `new FetchExpression(@"...")` wrapper using a verbatim string literal
 - **JavaScript** — `Xrm.WebApi.retrieveMultipleRecords` call for model-driven apps and PCF components
-- **pac CLI** — `pac org fetch --xml "..."` command for the Power Platform CLI
+- **pac CLI** — `pac env fetch --xml '...'` for the Power Platform CLI, as a bash / zsh line and a PowerShell line. The XML is single-quoted, so the shell never expands values such as `$100` or `$(...)`
 - **Power Automate** — Field-by-field form mirroring the Dataverse "List rows" connector UI; table name resolved from `EntityDefinitions` metadata (not a heuristic), each field individually copyable; Top Count is taken only from `top` (`count` is a page size)
 - **Web API** — Full OData URL with request headers (including `Prefer: odata.include-annotations="*"` for formatted values and paging cookies), the documented paging-cookie steps, a cURL snippet and a PowerShell `Invoke-RestMethod` example; entity set name resolved from metadata
 - **SQL** — Dataverse-generated T-SQL via `FetchXMLToSQL` (undocumented API, labelled Preview)
@@ -217,7 +217,7 @@ npm run preview
 npm run validate
 ```
 
-**Releases.** CI (`.github/workflows/ci.yml`) runs typecheck, lint, tests, PPTB validation, the build and a package-contents check on every pull request. `main` holds the current stable release and `dev` the next one. A `vX.Y.Z` tag on `main` publishes to npm `latest`, and a `vX.Y.Z-beta.N` tag on `dev` publishes to npm `beta` as a GitHub pre-release, both with provenance; see [RELEASING.md](RELEASING.md).
+**Releases.** CI (`.github/workflows/ci.yml`) runs typecheck, lint, tests, PPTB validation, the build and a package-contents check on every pull request. `main` holds the current stable release. A minor release stabilizes on a `release/X.Y` branch, so `dev` is never frozen. A `vX.Y.Z-beta.N` tag there publishes to npm `beta` as a GitHub pre-release, and after a smoke test and a 7-day soak, the `vX.Y.Z` tag on `main` publishes to npm `latest`, both with provenance. Fixes go to the oldest supported branch and merge forward. The previous minor gets critical fixes for 30 days ([SECURITY.md](SECURITY.md)); see [RELEASING.md](RELEASING.md).
 
 **Tool icon.** `package.json` points `icon` at `icons/icon.svg` under `dist/`, where Power Platform ToolBox looks for it. The build bundles `icons/icon-insider.svg` (gold stamp) for prerelease versions such as `1.4.2-beta.7`, and `icons/icon.svg` for releases.
 

package/SECURITY.md

@@ -1,5 +1,16 @@
 # Security Policy
 
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| The current stable release (npm `latest`) | ✅ Fixes and security fixes |
+| The previous minor release | ✅ Critical and security fixes for 30 days after the next minor ships (npm `support-X.Y`) |
+| Betas (npm `beta`) | Fixed in the next beta |
+| Anything older | ❌ |
+
+1.4.x keeps critical and security fixes for 30 days after 1.5.0 ships, because 1.5 requires Power Platform ToolBox 1.2.7. See [RELEASING.md](RELEASING.md) → *Supported versions*.
+
 ## Reporting a Vulnerability
 
 Please do **not** open a public issue.