create-nifra 3.3.0 → 3.5.0

package/dist/auth.js

@@ -33,7 +33,7 @@ export const AUTH_PRESETS = {
         label: "better-auth",
         note: "email/password + sessions, mounted at /api/auth/* - add OAuth providers in auth.ts.",
         // @nifrajs/better-auth mounts it; better-auth is the implementation (peer-installed alongside).
-        deps: { "@nifrajs/better-auth": "^3.3.0", "better-auth": "^1.2.0" },
+        deps: { "@nifrajs/better-auth": "^3.5.0", "better-auth": "^1.2.0" },
     },
 };
 /** The better-auth `database` adapter expression + its import line, for the scaffolded DB's ORM. */

package/dist/scaffold/frameworks.d.ts

@@ -62,7 +62,7 @@ export interface FrameworkSpec {
  * ships templates installing the PREVIOUS release. `scaffold-version.test.ts` now fails when this
  * drifts from what core is publishing, so the footgun is a red test rather than a silent regression.
  */
-export declare const NIFRA_DEP_RANGE = "^3.3.0";
+export declare const NIFRA_DEP_RANGE = "^3.5.0";
 /**
  * React is first because it is the default (`--framework` omitted scaffolds it), and because the
  * other four are most easily read as deltas from it.

package/dist/scaffold/frameworks.js

@@ -20,7 +20,7 @@
  * ships templates installing the PREVIOUS release. `scaffold-version.test.ts` now fails when this
  * drifts from what core is publishing, so the footgun is a red test rather than a silent regression.
  */
-export const NIFRA_DEP_RANGE = "^3.3.0";
+export const NIFRA_DEP_RANGE = "^3.5.0";
 /**
  * React is first because it is the default (`--framework` omitted scaffolds it), and because the
  * other four are most easily read as deltas from it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nifra",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "description": "Scaffold a new nifra app - `bun create nifra <dir>`.",
   "keywords": [
     "bun",

package/template/package.json

@@ -11,13 +11,13 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nifrajs/client": "^3.3.0",
-    "@nifrajs/core": "^3.3.0",
-    "@nifrajs/middleware": "^3.3.0",
-    "@nifrajs/schema": "^3.3.0"
+    "@nifrajs/client": "^3.5.0",
+    "@nifrajs/core": "^3.5.0",
+    "@nifrajs/middleware": "^3.5.0",
+    "@nifrajs/schema": "^3.5.0"
   },
   "devDependencies": {
-    "@nifrajs/cli": "^3.3.0",
+    "@nifrajs/cli": "^3.5.0",
     "@types/bun": "latest",
     "typescript": "^6.0.3"
   }

package/template-batteries/package.json

@@ -11,15 +11,15 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nifrajs/cache": "^3.3.0",
-    "@nifrajs/client": "^3.3.0",
-    "@nifrajs/core": "^3.3.0",
-    "@nifrajs/jobs": "^3.3.0",
-    "@nifrajs/schema": "^3.3.0",
-    "@nifrajs/storage": "^3.3.0"
+    "@nifrajs/cache": "^3.5.0",
+    "@nifrajs/client": "^3.5.0",
+    "@nifrajs/core": "^3.5.0",
+    "@nifrajs/jobs": "^3.5.0",
+    "@nifrajs/schema": "^3.5.0",
+    "@nifrajs/storage": "^3.5.0"
   },
   "devDependencies": {
-    "@nifrajs/cli": "^3.3.0",
+    "@nifrajs/cli": "^3.5.0",
     "@types/bun": "latest",
     "typescript": "^6.0.3"
   }

package/template-isr/package.json

@@ -10,17 +10,17 @@
     "check": "nifra check && nifra assure"
   },
   "dependencies": {
-    "@nifrajs/client": "^3.3.0",
-    "@nifrajs/core": "^3.3.0",
-    "@nifrajs/middleware": "^3.3.0",
-    "@nifrajs/schema": "^3.3.0",
-    "@nifrajs/web": "^3.3.0",
-    "@nifrajs/web-react": "^3.3.0",
+    "@nifrajs/client": "^3.5.0",
+    "@nifrajs/core": "^3.5.0",
+    "@nifrajs/middleware": "^3.5.0",
+    "@nifrajs/schema": "^3.5.0",
+    "@nifrajs/web": "^3.5.0",
+    "@nifrajs/web-react": "^3.5.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@nifrajs/cli": "^3.3.0",
+    "@nifrajs/cli": "^3.5.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "typescript": "^6.0.3"

package/template-site/Dockerfile

@@ -16,5 +16,10 @@ ENV NODE_ENV=production
 ENV PORT=3000
 # build:node emits a self-contained server-bundle + the client assets it serves from disk.
 COPY --from=build /app/dist-node ./dist-node
+# The production bundle does not need elevated privileges. Keep a compromised request handler from
+# inheriting root inside the container; applications that need writable paths should mount them
+# explicitly with ownership for this user.
+RUN groupadd --system nifra && useradd --system --gid nifra --create-home nifra
+USER nifra
 EXPOSE 3000
 CMD ["node", "dist-node/server-node.js"]