gina 0.3.12-alpha.1 → 0.3.12

package/CHANGELOG.md

@@ -6,6 +6,18 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.3.12 - 2026-05-12
+### Changed
+* Bumped @rhinostone/swig dependency floor from ^2.0.1 to ^2.1.0 in framework/v*/package.json. Version 2.1.0 introduces a multi-flavor architecture splitting the runtime into a shared @rhinostone/swig-core package plus per-flavor frontends (@rhinostone/swig native syntax, @rhinostone/swig-twig Twig-syntax frontend); the native @rhinostone/swig package remains drop-in compatible with the @rhinostone/swig@1.x and 2.0.x API surface gina depends on (swig.compile, swig.setFilter, swig.setTag, swig.renderFile). swigResolver DEFAULT_MIN stays at 2.0.0 since the framework does not depend on any new 2.1.0-only API. Resolves the version-currency drift surfaced by 'npm view @rhinostone/swig version' returning 2.1.0 against the current ^2.0.1 floor.
+* Bumped @rhinostone/swig dependency floor from ^2.1.0 to ^2.2.0 in framework/v*/package.json. 'npm view @rhinostone/swig version' returns 2.2.0; ^2.1.0 semver-satisfies 2.2.0 but the documented floor was stale and the swig-version-sync rule mandates keeping the pin current. swigResolver DEFAULT_MIN stays at 2.0.0 since the framework does not depend on any new 2.2.0-only API.
+### Fixed
+* Fixed urlencoded body parser: '+' now correctly decodes to space in 'req.post', 'req.put', and 'req.patch' for 'application/x-www-form-urlencoded' content per RFC 1866 / WHATWG URL spec. The inner content-type check was inverted — '+' stayed literal in urlencoded bodies (e.g. 'name=Hello+World' surfaced as 'Hello+World' instead of 'Hello World'), while JSON bodies with a literal '+' could have it silently replaced with space.
+* Fixed URL query-string parser on the Isaac engine: '+' now correctly decodes to space in 'request.query' values per RFC 1866 / WHATWG URL 'application/x-www-form-urlencoded parser' spec (e.g. 'GET /search?name=Hello+World' yields 'request.query.name === "Hello World"' instead of 'Hello+World'). Closes the parallel to commit 014ff60a's body-parser fix. Express engine is already spec-correct via qs/querystring defaults — no change there.
+* Fixed FormValidator's isRequired validator for HTML5 form-reassociated radios sharing a name across sibling forms. Submitting a form whose checked radio differs from a sibling form's .checked radio no longer leaks the sibling's value at submit time. Sister fix to commit 80dd89f9 (updateRadio peer-set scoping) and 6e544411 (defaultChecked cache); same root shape — same-name radios across multiple form-owners — different code path. The unfiltered document.getElementsByName walk in the radio-group case now scopes to the validator-bound radio's form-owner per HTML5 spec, mirroring the equivalent filter applied to updateRadio's mutual-exclusion peer set.
+* Fixed an ENOENT race in the per-template layout cache under concurrent renders in dev mode. Two parallel requests for the same URL whose template uses {% extends %} could see the cached layout file deleted between its priming-block write and the post-priming read, surfacing as a 500 with ENOENT: no such file or directory. The cache write now uses an atomic temp+rename pattern (writeFile to a per-process unique temp, then rename onto the target) so concurrent readers always observe either the prior or new content, never an absent file. The same atomic pattern is applied to the post-asset-injection rewrite (closing a secondary empty-content race from O_TRUNC). Production was unaffected — cached mode (_cacheIsEnabled = true) skipped the delete-then-rewrite path entirely. CVE-2023-25345 path-traversal boundary check preserved verbatim.
+* Fixing async race in core/controller/controller.render-swig.js where local.req / local.res / local.next reads dereferenced null when a second self.throwError() fired during an in-flight renderCustomError, capturing them into function-scoped locals at the top of render() so post-await reads remain race-safe against controller closure null-outs
+* Extending the #M1 async-race local-copy retrofit to controller.render-nunjucks.js (full call chain: renderNunjucks captures req/res/_next at top, helpers sendHtmlResponse/registerGinaFilters/writeCache take captures as parameters) and to controller.render-json.js writeCache helper (post-await throwError on invalidateOnEvents misconfiguration now goes through a captured res parameter instead of local.res)
+
 ## 0.3.11 - 2026-05-10
 ### Added
 * Added pre-publish gate `checkDefFrameworkConsistency` (`script/check_def_framework_consistency.js` + wired into `script/prepare_version.js`). Asserts `~/.gina/main.json`'s `def_framework` field points to a framework directory that exists on disk; aborts with an actionable diagnostic listing the drifted scalar, the missing framework dir, the actual present framework dirs, and a step-by-step recovery recipe. Catches the silent state-store drift that surfaced as a deep `MODULE_NOT_FOUND` from inside `getSelectedVersion` during the v0.3.10 stable publish (2026-05-06), where main.json's def_framework had drifted to `0.3.9` while the framework dir on disk was at `v0.3.10-alpha.2`. Skips silently when main.json itself is absent (first install / fresh state). The drift root cause (a writer other than `bumpVersion` updating the scalar inconsistently — distinct from the `34115799` gina.db drift fix) is queued as a separate follow-up; this gate is the safety net so future drift surfaces with an actionable error before npm publish proceeds. 18 unit tests with an injected fs driver cover the happy path, drift detection, fresh state, malformed JSON, missing/non-string field, and the `presentDirs` diagnostic helper.

package/README.md

@@ -22,7 +22,7 @@ Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope
 | ORM / entities | EventEmitter-based entity system; SQL files auto-wired to entity methods |
 | Connectors | Couchbase, MongoDB, ScyllaDB / Cassandra, MySQL, PostgreSQL, Redis, SQLite, AI (LLM) — loaded from project `node_modules` |
 | AI connector | Any LLM provider via named protocol (`anthropic://`, `openai://`, `ollama://`, …) |
-| Template engine | [`@rhinostone/swig`](https://github.com/gina-io/swig) 2.0.1 — maintained fork with CVE-2023-25345 patched; streaming SSE/chunked via `renderStream()`. Nunjucks supported as opt-in via `render.engine = "nunjucks"` |
+| Template engine | [`@rhinostone/swig`](https://github.com/gina-io/swig) 2.2.0 — maintained fork with CVE-2023-25345 patched; streaming SSE/chunked via `renderStream()`. Nunjucks supported as opt-in via `render.engine = "nunjucks"` |
 | Internationalisation | Per-bundle JSON catalogs, `t()` helper, swig + nunjucks `t` filter, CLDR plurals, ICU MessageFormat opt-in via `t.icu()` |
 | Observability | Built-in `/_gina/metrics` Prometheus endpoint (opt-in, IP-allowlisted) — Node.js process metrics + HTTP counter / duration histogram with cardinality-safe route labels |
 | Hot reload | WatcherService evicts `require.cache` only on file change — zero per-request overhead in dev |
@@ -39,6 +39,13 @@ gina bundle:start api @myproject
 open https://localhost:3100
 ```
 
+## What's in 0.3.12
+
+- **Spec-correct `+` decoding in URL query strings and urlencoded bodies** — fixes two complementary parsers that didn't decode `+` to space per RFC 1866 / WHATWG URL. The Isaac engine's URL query-string parser had no `+` substitution at all in either of its two branches (multi-value `&` loop + single-key `=` no-`&` path); the body parser's `application/x-www-form-urlencoded` content-type test was inverted, leaving `+` literal in `req.post` / `req.put` / `req.patch` values. Both now correctly produce space. Express engine was already spec-correct via `qs` defaults. Closes #B17.
+- **Render-pipeline async-race safety** (#M1 family) — `render-swig.js` now captures `local.req` / `local.res` / `local.next` into function-scoped locals at the top of `render()` so post-`await` reads remain race-safe when a second `self.throwError()` fires during an in-flight `renderCustomError`. Same shape extended to `render-nunjucks.js`'s full call chain (`sendHtmlResponse`, `registerGinaFilters`, `writeCache`) and to `render-json.js`'s `writeCache` helper. Separate dev-mode layout cache ENOENT fix: the per-template layout cache write now uses an atomic temp+rename pattern so concurrent renders for the same `{% extends %}` URL no longer collide on the priming-block delete-then-rewrite. Production was unaffected (cached mode skips the path entirely). CVE-2023-25345 path-traversal boundary check preserved verbatim.
+- **FormValidator form-reassociated radios — serialize-time scoping** — third sister fix for HTML5 form-reassociated radios sharing a name across sibling forms. The `isRequired` validator's radio-group case walked `document.getElementsByName($el.name)` without filtering by form-owner; submit-time serialization could leak a sibling form's `.checked` radio into the form-under-submission's payload. Now scopes the walk to the validator-bound radio's form-owner, mirroring the equivalent filter applied in 0.3.10's `updateRadio` (`80dd89f9`) and `bindForm` `defaultChecked` cache (`6e544411`). No-op for the normal single-form-owner shape.
+- **`@rhinostone/swig` floor bumped to `^2.2.0`** — version-currency drift fix. The 2.1.0 release introduced a multi-flavor architecture (shared `@rhinostone/swig-core` plus per-flavor frontends including `@rhinostone/swig-twig` for Twig syntax); the native `@rhinostone/swig` package remains drop-in compatible with the API surface gina depends on. `swigResolver DEFAULT_MIN` stays at `2.0.0` — the framework does not depend on any new 2.1.0 / 2.2.0-only API.
+
 ## What's in 0.3.11
 
 - **Internationalisation** (#I18N1 + #I18N2) — per-bundle JSON catalogs at `bundle/locales/<culture>.json`, `t(key, params, culture)` global helper auto-bound on controllers (`self.t()`) and as a swig + nunjucks `t` template filter, CLDR plurals via Node's built-in `Intl.PluralRules`, per-request locale negotiation (URL prefix > cookie > `Accept-Language` > settings default). New `gina i18n:scan / add / export / import` CLI for translator round-trip (PO / CSV / JSON). Optional ICU MessageFormat opt-in via `t.icu()` for gender / select / nested combinators powered by `intl-messageformat`. The legacy `__()` placeholder is rewired as a one-arg alias of `t()` — existing callers keep working.

package/framework/v0.3.12/VERSION

@@ -0,0 +1 @@
+0.3.12

package/framework/{v0.3.12-alpha.1 → v0.3.12}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -4389,7 +4389,18 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                 && typeof(this.target.type) != 'undefined'
                 && this.target.type == 'radio'
             ) {
-                var radios = document.getElementsByName(this.name);
+                // [HTML5 form-reassociation] Scope the radio group by form-owner per
+                // HTML5 spec. `getElementsByName` returns same-name radios across the
+                // whole document regardless of owner — without this filter, the
+                // first-checked pick cross-fires into sibling forms whose radios
+                // happen to share the name (the multi-entry layout where each entry
+                // has its own reassociated form). Mirrors the equivalent filter in
+                // main.js's updateRadio.
+                var $target = this.target;
+                var rawRadios = document.getElementsByName(this.name);
+                var radios = Array.prototype.filter.call(rawRadios, function (_r) {
+                    return _r.form === $target.form;
+                });
                 for (var i = 0, len = radios.length; i < len; ++i) {
                     if (radios[i].checked) {
                         if ( /true|false/.test(radios[i].value) ) {