gina 0.5.1-alpha.3 → 0.5.2-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,15 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.1 - 2026-06-12
+### Added
+* Stable publishes now run a ROADMAP.md consistency gate (script/check_roadmap_consistency.js, wired into the release prepare step alongside the README freshness gate). The publish aborts when an open roadmap row still references the exact version being released (the row would become stale the moment the tag lands) or when a done row is labelled with a version newer than the one shipping; a missing "released" timeline mark is surfaced as a warning only. Alpha publishes skip the gate.
+### Fixed
+* Fixed a bundle-killing crash when an error fired after the response was already sent. A late throwError() — e.g. an entity or query callback resuming after a redirect() had already issued its 301 and released the per-request response — dereferenced the released response and threw TypeError (reading getHeaders), escalating to uncaughtException and a SIGTERM bundle shutdown that also dropped every in-flight request. Late throwError() calls now log the swallowed error and no-op, and headersSent() treats a released response as already-sent so second render calls no-op too (#B31).
+* Fixed a dev-mode per-request memory leak that could kill heavily-loaded bundles with a heap-limit OOM (SIGABRT): the hot-reload eviction cycles (refreshCore in the isaac engine, refreshCoreDependencies in the router) delete and re-require framework modules on every request, and each cache-miss require pushes the fresh Module onto its long-lived parent's children array — Node only dedupes on cache hits — pinning the dead module graphs forever (~1.8 MB of live heap retained per request measured on a minimal bundle, process death at ~2400 requests). Both cycles now prune stale Module references from every cached module's children after eviction; production mode was never affected. (#B32)
+* Fixed the inter-bundle proxy (SuperController::query() over HTTP/2) re-labeling its raw-JSON request body with the incoming request's Content-Type. When the incoming browser request was a plain urlencoded form POST, the receiving bundle parsed the raw JSON through its urlencoded branch — corrupting `+`/`%XX` sequences inside JSON string values (e.g. a `+`-alias email losing its `+`). The `application/json` label query() sets for the body it serializes itself is now preserved; the incoming-Content-Type forward is kept for non-JSON outbound bodies. (#FORMCT2)
+* Fixed a family of bundle-killing crashes when an HTTP/2 inter-bundle query outlives its own request: retry re-entries and late upstream responses ran against a response that a terminal exit (e.g. a redirect that lets the middleware chain continue) had already released, dereferencing null — the header-forward prep block on every retry re-entry, the session lookup behind isHaltedRequest, and both 3xx redirect intercepts. All sites are now null-guarded: forwards and intercepts no-op on a released request (options.headers already carries the first attempt's values, so nothing is lost), and the session lookup reports no session. Live-request behaviour is byte-identical. (#B33)
+
 ## 0.5.0 - 2026-06-11
 ### Added
 * ESM compatibility layer (#M10): package.json now declares an "exports" map with dual CJS/ESM entry points — `import gina from 'gina'` and `import gna from 'gina/gna'` work natively in ESM projects and modern bundlers (default exports only; the gina/gna getter semantics are preserved). CJS `require()` resolution is byte-identical to before, and TypeScript declarations keep resolving via per-entry "types" conditions. The documented public surface is the bare specifier, ./gna and ./package.json; undeclared deep subpaths are no longer resolvable.

package/README.md

@@ -39,11 +39,12 @@ gina bundle:start api @myproject
 open https://localhost:3100
 ```
 
-## What's in 0.5.0
+## What's in 0.5.1
 
-- **Native ESM entry points.** `package.json` now declares an `"exports"` map with dual CJS/ESM entries — `import gina from 'gina'` and `import gna from 'gina/gna'` work natively in ESM projects and modern bundlers (default exports only; the `gina/gna` getters resolve at access time, after framework boot). CJS `require()` resolution is byte-identical to before, and TypeScript declarations keep resolving through per-entry `types` conditions. Note: with the `exports` map in place, the package's Node-resolvable surface is exactly `gina`, `gina/gna`, and `gina/package.json` — undeclared deep subpaths are no longer resolvable.
-- **Mixed template engines per bundle.** A `templates.json` section declaring `"ext": ".njk"` (or a `self.setTemplate(file, '.njk')` call) renders through nunjucks and `".swig"` through swig — regardless of the bundle-level `render.engine` setting. `.html` and any other extension keep following `render.engine`, so existing bundles are unchanged. Bundles with `.njk` sections get the same fail-fast `NUNJUCKS_NOT_INSTALLED` startup check as nunjucks-engine bundles.
-- **Nunjucks Inspector parity (dev mode).** Dev-mode nunjucks pages now render the Inspector statusbar and expose the query log as `data.page.queries` alongside the flow timeline — the Inspector Queries tab no longer renders empty for nunjucks bundles.
+- **Released-response crash family fixed (bundle-killing).** A late `throwError()` after the response was already sent — e.g. an entity or query callback resuming after a `redirect()` had already issued its 301 — dereferenced the released response, escalating to an `uncaughtException` and a SIGTERM bundle shutdown that dropped every in-flight request. Late calls now log the swallowed error and no-op. The same guard family covers the HTTP/2 inter-bundle query paths: retry re-entries, late upstream responses, and both 3xx redirect intercepts no longer crash when the originating request has already terminated.
+- **Dev-mode hot-reload memory leak fixed.** The per-request hot-reload eviction cycles retained ~1.8 MB of live heap per request through dead `module.children` references, killing heavily-loaded dev bundles with a heap-limit OOM. Both cycles now prune stale module references after eviction; production mode was never affected.
+- **Inter-bundle proxy Content-Type fix.** `query()` over HTTP/2 no longer re-labels the raw-JSON body it serializes itself with the incoming request's Content-Type — a urlencoded browser POST proxied between bundles no longer corrupts `+`/`%XX` sequences inside JSON string values.
+- **ROADMAP consistency release gate.** Stable publishes now abort when a roadmap row is stale relative to the version being released, alongside the existing README freshness gate.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -25,6 +25,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q2 2026** | `0.3.10` ✅ | FormValidator HTML5 form-reassociation hardening trilogy (`HTMLFormControlsCollection`-based `bindForm` + `unbindForm` symmetry · radio mutual-exclusion + IDL/attribute reconciliation · `defaultChecked` cache for reset) · `X-Forwarded-Prefix` reverse-proxy path-prefix awareness |
 | **Q2 2026** | `0.4.0` ✅ | Couchbase v2 removal (BREAKING — SDK v2 connector + session store dropped) · HTTP/2 response trailers · async-job primitive · CSP per-response nonce · `secrets:scan` / `secrets:check` CLI · SQL column-level index coverage — of the items originally targeted here: AI agents (MCP) shipped `0.3.7`, ScyllaDB `0.3.11`, CLI Tier 2 `0.4.1`, the docs offline ZIP is live on the docs site, and the Advanced tutorial · website redesign · Bun investigation moved to `0.5.x` |
 | **Q2 2026** | `0.5.0` ✅ | ESM entry points (dual CJS/ESM `exports` map) · Mixed template engines per bundle (extension-keyed `.njk` / `.swig` dispatch) · Nunjucks Inspector parity — the other items originally targeted here shipped earlier: structured logging (`0.4.5`), Alt-Svc (`0.4.2`), WebSocket over HTTP/2 (`0.4.7`), Inspector production auth (`0.4.0`) |
+| **Q2 2026** | `0.5.1` ✅ | Patch: released-response crash family — late `throwError()` and the HTTP/2 inter-bundle query retry / late-response / redirect-intercept paths no longer kill the bundle · dev-mode hot-reload `module.children` heap leak fixed (OOM under sustained load) · inter-bundle proxy JSON bodies keep their `application/json` label · ROADMAP consistency release gate |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · CLI Tier 3 (project:move, framework:update, backup/restore, man pages) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 

package/framework/v0.5.2-alpha.1/VERSION

@@ -0,0 +1 @@
+0.5.2-alpha.1

package/framework/{v0.5.1-alpha.3 → v0.5.2-alpha.1}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.5.1-alpha.3",
+  "version": "0.5.2-alpha.1",
   "dependencies": {
     "@rhinostone/swig": "^2.7.2",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.5.1-alpha.3/core/gna');
+var _gna = require('./framework/v0.5.2-alpha.1/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.5.1-alpha.3/core/controller');
-var EntitySuper     = require('./framework/v0.5.1-alpha.3/core/model/entity');
+var SuperController = require('./framework/v0.5.2-alpha.1/core/controller');
+var EntitySuper     = require('./framework/v0.5.2-alpha.1/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.5.1-alpha.3/lib/uuid');
+var uuid = require('./framework/v0.5.2-alpha.1/lib/uuid');
 
 module.exports = {
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.5.1-alpha.3",
+  "version": "0.5.2-alpha.1",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -72,12 +72,12 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.5.1-alpha.3/core/gna",
+  "main": "./framework/v0.5.2-alpha.1/core/gna",
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
       "import": "./index.mjs",
-      "require": "./framework/v0.5.1-alpha.3/core/gna.js"
+      "require": "./framework/v0.5.2-alpha.1/core/gna.js"
     },
     "./gna": {
       "types": "./types/gna.d.ts",

package/framework/v0.5.1-alpha.3/VERSION

@@ -1 +0,0 @@
-0.5.1-alpha.3