domma-cms 1.10.36 → 1.10.37

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.10.37] - 2026-10-27
+
+- The updater's backup no longer copies the runtime data of plugins it does not update. A marketplace or site plugin's `data/`, `backups/` and `node_modules/` stay out of `.domma-backups` (its code is still copied); the engine's own plugins are still backed up whole. A File Store's members' uploads were otherwise copied into every one of up to sixteen kept backups.
+
 ## [1.10.36] - 2026-10-27
 
 - Trash folder menus offer Empty Trash with an explicit permanent-deletion confirmation. Clear every message in the server-designated Trash folder, including more than one list page, while retaining the folder and its subfolders. Requires Email Pro 0.10.1.

package/bin/lib/plugin-backup.js

@@ -0,0 +1,40 @@
+/**
+ * What the update backup takes of plugins/, for the engine updater.
+ *
+ * The backup is there to undo the update, and the update only ever rewrites
+ * the plugins the engine ships (Blog, Mail Reader, ...). Every other plugin -
+ * installed from the marketplace or written by the site - is left exactly as
+ * it is, so copying its runtime state would back up something the update never
+ * touches. And that state can be large: a File Store keeps members' uploads in
+ * its data/, and the update backups are kept up to sixteen deep. So:
+ *
+ *   - a plugin the engine ships: copied whole, data/ included (the update
+ *     replaces its folder, carrying data/ across through memory - the backup
+ *     is the safety net if that goes wrong);
+ *   - any other plugin: its code only - no data/, backups/ or node_modules/.
+ *
+ * @module bin/lib/plugin-backup
+ */
+import path from 'node:path';
+
+/** Runtime folders inside a plugin that a plugin the update does not touch never needs backed up. */
+export const STATE_DIRS = ['data', 'backups', 'node_modules'];
+
+/**
+ * A `cpSync` filter for copying `pluginsDir` into the backup.
+ *
+ * @param {string} pluginsDir the site's plugins/ folder
+ * @param {Iterable<string>} shipped names of the plugins the engine package ships
+ * @returns {(src: string) => boolean}
+ */
+export function pluginBackupFilter(pluginsDir, shipped) {
+    const engine = new Set(shipped);
+    const root = path.resolve(pluginsDir);
+    return (src) => {
+        const rel = path.relative(root, path.resolve(src));
+        if (!rel || rel.startsWith('..')) return true;
+        const [plugin, second] = rel.split(path.sep);
+        if (second === undefined || engine.has(plugin)) return true;
+        return !STATE_DIRS.includes(second);
+    };
+}

package/bin/update.js

@@ -16,6 +16,7 @@ import {fileURLToPath} from 'node:url';
 import {deepMergeNewKeys} from './lib/config-merge.js';
 import {shouldReplacePlugin} from './lib/plugin-version.js';
 import {KEEP_UPDATE_BACKUPS, pruneUpdateBackups} from './lib/backup-retention.js';
+import {pluginBackupFilter} from './lib/plugin-backup.js';
 import {removeLeftFreeTier} from './lib/left-free-tier.js';
 
 // ---------------------------------------------------------------------------
@@ -306,10 +307,13 @@ export default async function update(_positional, flags) {
             }
         }
 
-        // Back up plugins dir (code only, not data)
+        // Back up plugins/: the engine's own plugins whole (the update replaces them), every other
+        // plugin's code only - the update never touches it, and its data/ can be large (bin/lib/plugin-backup.js).
         const pluginsDir = path.join(cwd, 'plugins');
         if (existsSync(pluginsDir)) {
-            cpSync(pluginsDir, path.join(backupPath, 'plugins'), {recursive: true});
+            const shippedDir = path.join(PACKAGE_ROOT, 'plugins');
+            const shipped = existsSync(shippedDir) ? readdirSync(shippedDir, {withFileTypes: true}).filter(e => e.isDirectory()).map(e => e.name) : [];
+            cpSync(pluginsDir, path.join(backupPath, 'plugins'), {recursive: true, filter: pluginBackupFilter(pluginsDir, shipped)});
         }
 
         done();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.10.36",
+  "version": "1.10.37",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",