gina 0.6.18 → 0.6.19

package/CHANGELOG.md

@@ -6,6 +6,17 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.19 - 2026-08-28
+### Fixed
+* #B431 — a failed couchbase query no longer settles its caller twice. Each dispatch chained `.catch(onError).then(onResult)` sequentially; a `.catch()` handler that returns normally RESOLVES the promise it produces, so the trailing `.then()` ran on every error with no result payload and delivered a second, bogus empty success. Measured: one failed query invoked an explicit trailing callback twice — first with the real error, then with `(false, null, {})` — so the canonical `if (err) { return next(err); } render(data);` shape ran BOTH branches, erroring the request and then rendering an empty result. On the `await` / `.onComplete()` path the second settlement was swallowed because a promise settles once, which is why this went unnoticed; it was still the reason a failed query emitted its trigger three times instead of once. `bulkInsert` shared the root cause with a different symptom: its result handler dereferenced the absent payload, so every failed bulk insert logged a spurious `TypeError: Cannot read properties of undefined (reading 'rows')`. All three dispatch sites now use the two-argument `.then(onResult, onError)` form, making the handlers mutually exclusive branches, and `bulkInsert` guards its payload the way the query path already did. Server-side only — pickup is a bundle restart, no re-bake.
+* #B430 — a couchbase entity callback that throws is no longer invoked a second time with the same payload. The delivery path wrapped the callback in a `try`, and its `catch` branch called the very same callback again with the identical arguments — so a callback whose own body threw ran twice, and a deterministic throw was logged only after the second pass, while a one-off throw silently got a second run over the same data. The throw is now reported with the query trigger for context and the callback is never re-entered. Affects the explicit trailing-callback form. Server-side only — pickup is a bundle restart, no re-bake.
+* #B432 — an entity query callback is no longer invoked twice when the callback itself throws. The sqlite, mongodb and scylladb connectors delivered a result by calling your callback inside a `try` (sqlite, whose driver is synchronous) or inside a `.then()` followed by a trailing `.catch()` (mongodb, scylladb). Application callbacks throw for ordinary reasons that have nothing to do with the query — a template error, a null dereference in a handler — and that exception landed in the very error path the connector had set up for driver failures, which called the same callback a SECOND time. The consequences are worse than a duplicate: the second call arrives with an Error, so the canonical `if (err) { return next(err); } render(data);` shape runs BOTH branches for one query, and the error it reports is the caller's own exception dressed up as a database failure — so the misleading message points at the connector rather than at the handler that actually threw. On mongodb a second, narrower path had the same shape: a pipeline file whose `op` is not one of the recognised operations reaches an unknown-op branch that settles inside a `try` whose `catch` settled again, and nothing validates `op` against the recognised list at load time, so any typo installs the method and reaches it at query time. Every settle now runs through one per-call guard that delivers at most once and reports a callback exception (tagged with the query trigger) instead of replaying it; a native Promise resolver was never affected, because a promise settles once. Not affected, measured: mysql, postgresql, duckdb and the AI connector. The same shape was present in the session stores, where the callback belongs to express-session: every store method (couchbase v3 and v4, mongodb, redis, scylladb, sqlite) now wraps its callback in the same guard at entry, so a throwing session callback can no longer be re-invoked by the method's own error path. The async-job stores (mongodb and sqlite) are guarded the same way, and there the misdelivery read as a data problem: a callback that threw while the SQLite store was handing a record back came home to the caller as `could not parse job record`, blaming the stored data for the handler's own exception. The mongodb and scylladb connectors carried the shape on their connection-ready path, and there it was worse than a duplicate: the ready handler is the model layer's boot continuation, so an exception thrown downstream at boot — while your models load, for instance — rejected the connect chain, whose error path re-invoked the handler with a fabricated `Connection failed: <that exception's own message>`; the fault was reported as a database connection failure, and the connector registry then cached that fabricated failure, with no connection, for the life of the process. The handler is now invoked once and its exception is reported under the connector's name; a real connection failure still arrives as `Connection failed`. The sqlite connector's Inspector index listener carried the same shape and is guarded for consistency (its caller has no throwing path today). The couchbase storage store already guarded its nine verbs with a local helper, so it never double-delivered — but that helper let a throwing callback's exception vanish: on six verbs it was lost outright, and on the three that run a query (`stats`, `listZeroRefs`, `listKeys`) the store logged it as its own failure (`stats failed: <your message>`). It now uses the shared guard, so the exception is reported once under the verb's name and is never attributed to the store. Server-side only — pickup is a bundle restart, no re-bake.
+* An `Error` passed to a log method now renders with its message, stack, own properties and `cause` chain (#B434). Both stdout writers routed any object argument through an enumerable-properties walk, and an Error's `message` and `stack` are non-enumerable — so `console.error(err)` printed `{}` (or only the enumerable extras, such as `{"code": "ETIMEDOUT"}`), silently dropping the one thing the line was written to report. Errors — including ones minted in another realm — now render the way Node's own console does, at the top level, nested inside a logged object or array, and on the raw `console.log` path alike; the rendered message still passes through log redaction. Every non-Error argument renders exactly as before, and passing `err.stack` as a string keeps working unchanged.
+* `merge()` no longer rewrites the object it was given (#B428). When a source subtree was merged into an existing target level that lacked its key, the subtree was referenced and then walked again as if it were being merged into itself: every array inside the caller's object was replaced by a copy at every depth, and an array of primitives silently lost its duplicates — a per-call cost proportional to the value, and a contract violation for any code that expected `merge` to leave its source alone. A subtree that is the same object on both sides is now skipped (merging a value into itself is identity), so a grafted source keeps its arrays and its duplicates and the result references it. Merging two different values is unchanged, as is the shallow copy built when the key is absent at the root. `lib/merge` is part of the browser bundle, so rebuild your bundles as well as restarting them; no other action is required.
+### Security
+* #B429 — concurrent calls to the same couchbase entity method no longer cross-deliver results. The completion trigger (`N1QL:<entity>#<method>`) carried no call identity, and the entity it was emitted on is a process-wide singleton, so the Promise / `await` / `.onComplete()` path settled from a shared listener. Node fires every listener registered for one emit, so the FIRST query to finish woke every in-flight caller of that method with its own payload and removed their listeners — a broadcast, not a queue. Two concurrent reads with different arguments could each receive the other's rows; a third caller could receive an error belonging to a different call; and a single response could blend rows originating from two callers. This is a confidentiality and authorization concern, not only a correctness one: where the method reads a user-scoped or ownership-bearing record, one request could be answered with another request's row, so a check performed on the returned row could pass for the wrong principal. Measured on the real connector, both directions: a call keyed on one id resolving with a different id's row before the fix, and its own row after. Note the exposure was NOT limited to out-of-order completion — cross-delivery occurred even when the queries finished in the order they were started, so the guidance that the emit pattern is safe for in-order completion did not hold for this connector (that documentation is corrected in the same release). The explicit trailing-callback form (`entity.method(args, function (err, data) {})`, including `util.promisify`) was never affected: it already settled from its own per-call closure. Every path now settles that way, exactly once per call, and the trigger is emitted purely as an observability signal for the Inspector — which, as a side effect, now also sees direct-callback completions it previously missed. `bulkInsert` carried the same defect on its own dispatch and is fixed with it. Couchbase only: the cross-delivery described here needs a shared emitter, which no other connector uses. (A DIFFERENT defect in the same family — a callback being invoked a second time when it throws — does affect other connectors and is fixed separately in this release; see #B432.) Server-side only — pickup is a bundle restart, no re-bake.
+* Credentials carried in a request URL no longer reach the logs in plaintext (#B433). The HTTP access line — and 45 sibling sites across both engines, every render delegate and the CSRF filter — log the URL as received, so a password-reset token, a signed download link or a one-time invite was written to stdout verbatim, with no seam to redact it. Every log message is now redacted BEFORE it is rendered and dispatched, at the logger's single pre-render point, so stdout, `gina tail`, the file transport and the Inspector all receive the same masked line and a JSON-mode line cannot be corrupted. Configured per bundle in `settings.json > log.redact` and ON by default: a built-in set masks JSON Web Tokens, URL userinfo passwords, `Bearer`/`Basic` credentials, named credential query keys (`token`, `access_token`, `api_key`, `secret`, `password`, `signature`, `otp`, …, keeping the key and masking the value) and api-key style headers — measured at zero false positives over 433k real log lines and about a microsecond per line; every value the secrets resolver substituted for a `${secret:KEY}` placeholder is masked verbatim wherever it appears; and `patterns` takes your own rules (a regex source string, or `{pattern, flags, replacement}`), always applied with the `g` flag. A bare long-hex path segment is deliberately not a default — a content-address key and an opaque credential look the same — so add `(?<![0-9a-f])[0-9a-f]{64}(?![0-9a-f])` yourself when your credentials take that shape (anchored on the character class — a leading `\b` never fires against a prefixed segment such as `key_<hex>`). An unknown key, a non-boolean flag or an invalid / empty-matching pattern refuses the boot, because a rule dropped silently would be a leak. Behaviour change: masked values now appear in logs where the raw value used to; set `log.redact.enabled` to `false` to opt out. Restart your bundles to pick it up — and rebuild them too, since this release also changes the browser bundle (see the `merge()` fix). Also new: `lib.secrets.getResolvedValues(conf)` and `console.setRedaction(block, options)`.
+
 ## 0.6.18 - 2026-08-27
 ### Fixed
 * A field validated by a `query` (live-check) rule no longer gets the wrong verdict when its value contains a `+` — the common case being an email plus-address such as `alias+tag@example.com`. The live-check body is JSON, but the request was labelled `application/x-www-form-urlencoded`, so the server correctly url-decoded it before parsing and turned every `+` into a space; the mangled body was still valid JSON, so nothing errored and the endpoint answered 200 with an answer computed from a corrupted value. Because a `query` rule also gates the submit trigger, an affected visitor could not submit the form at all — a hard lockout on sign-in and password-recovery forms rather than a warning. The request now sends `application/json` when the body is JSON, matching what the form-submit and file-removal paths already did. An explicit per-rule `headers` override still wins, so a rule that already declares its own `Content-Type` is unchanged. Note that live-check bodies are no longer URL-decoded at all, so `%XX` sequences reach your action verbatim; field values are sent raw, so this only affects a bundle that relied on the decode.

package/README.md

@@ -62,30 +62,35 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.18
+## What's in 0.6.19
 
 > **Restart your bundles AND rebuild them.** This release changes the browser
-> bundle: `gina.min.js` differs from `0.6.17` (`gina.min.css` and
+> bundle: `gina.min.js` differs from `0.6.18` (`gina.min.css` and
 > `gina.onload.min.js` are unchanged). A restart alone updates the server half
-> only — each bundle bakes its own copy of the client assets, so the validator
+> only — each bundle bakes its own copy of the client assets, so the `merge()`
 > fix below would not reach a browser at all.
 
-> **No settings reset.** `0.6.18` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.19` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**A form-validation lockout, and a per-request cost paid by every render.** The
-headline is a correctness fix with an availability consequence: a field validated
-by a `query` (live-check) rule got the wrong verdict whenever its value contained
-a `+` — an email plus-address being the common case — and because a `query` rule
-also gates the submit trigger, an affected visitor could not submit the form at
-all. Alongside it, the dotted-path data setter behind every render no longer
-deep-merges its way through the render tree, which also ends a silent mutation of
-the per-process forms catalog. **One behaviour change needs your attention** if a
-bundle relied on live-check bodies being URL-decoded — details in the
-[migration guide](https://gina.io/docs/migration).
-
-- **Fixed — a `query` rule no longer mis-validates a value containing `+` (#B425).** The live-check body is JSON, but the request was labelled `application/x-www-form-urlencoded`, so the server correctly url-decoded it before parsing and turned every `+` into a space. The mangled body was still valid JSON, so nothing errored — the endpoint answered `200` with a verdict computed from a corrupted value. Because a `query` rule also gates the submit trigger, the common case of an email plus-address such as `alias+tag@example.com` was a hard lockout on sign-in and password-recovery forms rather than a warning. The request now sends `application/json` when the body is JSON, matching what the form-submit and file-removal paths already did. An explicit per-rule `headers` override still wins, so a rule that already declares its own `Content-Type` is unchanged. **Action required only if you relied on the decode:** live-check bodies are no longer URL-decoded at all, so `%XX` sequences reach your action verbatim, and field values are sent raw.
-- **Fixed — the render data setter no longer walks and rewrites the shared forms catalog on every request (#P39).** The dotted-path setter behind every render (`page.view.*`, `page.environment.*`, `page.forms`, …) used to build the path as a JSON string, parse it, and deep-merge the result into the render data — and that merge recursed into every object value it grafted, re-merging each array inside it with itself and writing the copies back into the caller's object. For a bundle with a real forms catalog that was roughly 0.4 to 1.5 ms of CPU per request *and* a silent mutation of the per-process catalog, whose arrays were swapped for equal copies on every render. A first write is now stored by reference without being walked, missing intermediates are created directly, and only a genuine collision goes through the merge — so the value semantics are unchanged (first write wins; an object written onto an object leaf still deep-fills), the catalog is never touched, and the 59 primitive writes of a render cost about a fifth of what they did (66.6 → 14.8 µs). One deliberate difference: writing an array onto an existing array leaf now merges the two once instead of twice, where the old path produced duplicate elements; no framework route writes an array-bearing path twice.
+**Two security fixes, and a family of connector callback defects closed.** Log
+redaction is now built in and on by default, so a credential carried in a request
+URL no longer reaches stdout in plaintext; and concurrent calls to the same
+Couchbase entity method no longer cross-deliver each other's results. Around
+them, every connector's callback delivery was audited: a callback that throws is
+no longer invoked a second time, a failed Couchbase query no longer settles its
+caller twice, a logged `Error` keeps its message and stack, and `merge()` no
+longer rewrites the object it was given. **Two changes may require action** —
+log redaction for every project, the Couchbase change only if you use that
+connector — details in the [migration guide](https://gina.io/docs/migration).
+
+- **Security — credentials in a request URL no longer reach the logs (#B433).** The HTTP access line — and 45 sibling sites across both engines, every render delegate and the CSRF filter — logged the URL as received, so a password-reset token, a signed download link or a one-time invite was written to stdout verbatim with no seam to redact it. Every log message is now redacted before it is rendered and dispatched, at the logger's single pre-render point, so stdout, `gina tail`, the file transport and the Inspector all receive the same masked line. Configured per bundle in `settings.json > log.redact` and **on by default**: a built-in set masks JSON Web Tokens, URL userinfo passwords, `Bearer`/`Basic` credentials, named credential query keys (`token`, `access_token`, `api_key`, `secret`, `password`, `signature`, `otp`, …, keeping the key and masking the value) and api-key style headers; every value the secrets resolver substituted for a `${secret:KEY}` placeholder is masked verbatim; and `patterns` takes your own rules. A bare long-hex path segment is deliberately not a default — add `(?<![0-9a-f])[0-9a-f]{64}(?![0-9a-f])` yourself when your credentials take that shape. **Behaviour change:** masked values now appear in logs where the raw value used to; set `log.redact.enabled` to `false` to opt out. Also new: `console.setRedaction(block, options)` and `lib.secrets.getResolvedValues(conf)`.
+- **Security — concurrent Couchbase entity reads no longer cross-deliver results (#B429).** The completion trigger carried no call identity and was emitted on a process-wide singleton, so the first query to finish woke every in-flight caller of that method with its own payload: two concurrent reads with different arguments could each receive the other's rows, a third caller could receive an error belonging to a different call, and a single response could blend rows from two callers — a confidentiality and authorization concern where the method reads a user-scoped record, not only a correctness one. Every call now settles from its own identity. **Action required only if you use the Couchbase connector** — see the migration guide.
+- **Fixed — a Couchbase callback that throws is no longer invoked twice (#B430).** The delivery path wrapped the callback in a `try` whose `catch` called the same callback again with identical arguments. The throw is now reported with the query trigger for context and the callback is never re-entered.
+- **Fixed — a failed Couchbase query no longer settles its caller twice (#B431).** Each dispatch chained `.catch(onError).then(onResult)` sequentially, so every error was followed by a bogus empty success — the canonical `if (err) { return next(err); } render(data);` shape ran both branches. Failed `bulkInsert` calls also logged a spurious `TypeError`; that is gone.
+- **Fixed — an entity query callback is no longer invoked twice when the callback itself throws (#B432).** The sqlite, mongodb and scylladb connectors delivered results inside a `try` or a `.then()` whose error path called the same callback a second time with the caller's own exception dressed up as a database failure. A throwing callback is now logged once, as `[ <label> ] callback exception:`, and never re-entered.
+- **Fixed — a logged `Error` object keeps its message, stack, own properties and `cause` chain (#B434).** Both log writers walked enumerable properties only, so `console.error(err)` rendered `{}` (or just `{"code": …}`). Errors now render the way Node's own console does — directly, among other arguments, nested inside a logged object, and on `console.log` alike — and the rendered message still goes through redaction. Passing `err.stack` as a string keeps working unchanged.
+- **Fixed — `merge()` no longer rewrites the object it was given (#B428).** A source subtree merged into an existing target level that lacked its key was referenced and then walked again as if merged into itself: every array inside the caller's object was replaced by a copy at every depth, and an array of primitives silently lost its duplicates. A subtree that is the same object on both sides is now skipped, so a grafted source keeps its arrays and duplicates and the result references it. Merging two different values is unchanged. `lib/merge` is part of the browser bundle — hence the rebuild.
 
 ## Documentation
 

package/ROADMAP.md

@@ -70,6 +70,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.16` ✅ | **Security**: concurrent uploads of the same filename no longer corrupt one another — the multipart parser wrote every incoming file to `<upload dir>/<the filename the client sent>` with nothing in the path distinguishing one part or one request from another, so two uploads sharing a filename opened two write streams on a single path and interleaved their bytes into one hybrid matching neither upload, while the framework reported success to both callers; measured on a live bundle before the fix, twelve concurrent uploads of one filename left ONE corrupted file where twelve intact ones were sent, and a single request carrying two same-named parts produced one file mixing both. The parse runs before routing and before any middleware, so reaching it needed neither authentication nor a valid route — a POST to an unknown url answers 404 to the client and still writes the file to disk — and no application configuration could avoid it; uploads now stage under a server-generated random name, 32 hex characters plus a `.part` suffix, as multer and formidable have always done, which also keeps client-controlled bytes off the filesystem and cannot overflow the operating system filename limit (ACTION REQUIRED only where your own code derives a display name or a public URL from the basename of `req.files[].path`: read `req.files[].originalFilename` instead, which is unchanged and is still the name `self.store()` publishes the file under). **Fixed**: the documented fluent `store(target).onComplete(cb)` form works again — `store()` was accidentally declared `async`, so the deliberate `{ onComplete }` facade came back wrapped in a Promise carrying no `onComplete`, leaving the upload guide's first worked example dead code on every stable from `0.6.0` through `0.6.15`; the body contains no `await` and nothing anywhere awaits the call, so dropping the keyword changed no behaviour, the facade returns synchronously as documented, the three-argument callback form is byte-unchanged, and the TypeScript declaration now describes the fluent return shape instead of `Promise<void>`. The page whisper no longer exports the forms mocks group — the RFC5987-encoded `page.environment.forms` export shipped the entire bundle forms catalog into every page in every environment, mocks included, while the routing exports one line above it were deliberately stubbed to `{}` for page weight; mocks are now excluded in every environment rather than outside development only, deliberately, since an env-divergent `gina.forms` shape is the works-in-dev-fails-in-prod class, and rules, custom validators and every server-side surface keep the complete catalog (ACTION REQUIRED only for client code that read `gina.forms.mocks`, which the framework's own client bundle never consumed). And the link API names its error when the anchor has left the DOM: there is no deregistration path, so a registration outlives its element and a page that re-renders its anchors after binding dereferenced the null lookup and threw a bare TypeError — it now throws a named error identifying the link id, the url and the cause, detected beside the unregistered-url guard before the supersede step so it no longer aborts a request already in flight nor invalidates that request's response handling. Pickup: restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.15`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.17` ✅ | **Fixed**: a route whose URL structurally matches but whose `requirements` reject the request no longer drops the connection once the route cache is warm — the cache is keyed on method and pathname with the query string stripped before dispatch, so every query variant of one pathname shares a single entry, and the warm path re-evaluated the requirements on each hit and then discarded the verdict, force-matching a request that had just been rejected and dispatching it with no routing description, which closed the connection with no HTTP response at all — no status and no body; the warm path now honours the verdict, treating a rejecting or throwing evaluation as a cache miss that falls through to the routing scan and answers correctly (404 when nothing matches, the sibling rule when one does, or a 500 naming the rule when a `validator::` requirement throws, which was previously also a dropped connection), while the cache entry is kept so the variants the requirements accept stay warm. **Fixed**: the `toFloat`, `set` and `format` validator rules are context-safe — all three are documented rules that threw on every server-side call, with `toFloat` opening by reading the live DOM element unguarded so server-side rule sets could not coerce a float at all (it now reads the live value only when one is reachable and otherwise uses the submitted value, which on the server is the raw value, and a missing comma in the same statement that leaked `isFloatingWithCommas` as an implicit global into every page is fixed with it), `set` now assigning the field value in both contexts while reflecting it onto the DOM element only in the browser where an element exists, and `format` — which already worked in both contexts when chained after `isDate`, as its documentation shows — now reporting a non-`Date` value as a named rule-authoring error pointing at the missing `isDate` instead of the opaque `val.format is not a function`. **Fixed**: a bundle declaring a redirect route no longer floods its log with `source[host] is undefined` warnings — redirect rules are deliberately excluded from the per-rule host and hostname defaulting so those keys are absent on them, but the per-request routing copy assigned them unconditionally, creating properties holding `undefined` on a clone kept for the lifetime of the process, so every later no-arg `getConfig()` emitted one `host` and one `hostname` warning per redirect rule indefinitely, measured by a consumer at roughly three quarters of that log line's total volume and drowning the genuine warnings it exists to surface; the copy is now existence-guarded, so an absent key stays absent and rules that do carry a host are copied exactly as before, which removes log noise rather than a functional defect, and only template and view routes reach it so API-only bundles were never affected. Pickup: restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.16`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.18` ✅ | **Fixed**: a field validated by a `query` (live-check) rule no longer gets the wrong verdict when its value contains a `+` — the live-check body is JSON but the request was labelled `application/x-www-form-urlencoded`, so the server url-decoded it before parsing and turned every `+` into a space; the mangled body was still valid JSON, so the endpoint answered 200 with a verdict computed from a corrupted value, and because a `query` rule also gates the submit trigger the common case of an email plus-address was a hard lockout on sign-in and password-recovery forms rather than a warning. Live-check bodies are no longer URL-decoded at all, so `%XX` sequences reach your action verbatim. **Fixed**: the dotted-path render data setter no longer walks and rewrites the shared forms catalog on every request — a first write is now stored by reference instead of being deep-merged through the render tree, ending both a per-request CPU cost and a silent mutation of the per-process catalog. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.17`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
+| **Q4 2026** | `0.6.19` ✅ | **Security**: credentials carried in a request URL no longer reach the logs — every log message is redacted at the logger's single pre-render point before any sink renders it; configured per bundle in `settings.json > log.redact`, on by default with a built-in credential set, your own `patterns`, and every `${secret:KEY}` value masked verbatim. **Security**: concurrent calls to the same Couchbase entity method no longer cross-deliver results — the completion trigger carried no call identity, so the first query to finish woke every in-flight caller with its own payload. **Fixed**: a connector callback that throws is no longer invoked a second time, and a failed Couchbase query no longer settles its caller twice. **Fixed**: a logged `Error` keeps its message, stack, own properties and `cause` chain. **Fixed**: `merge()` no longer rewrites the object it was given. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.18`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |

package/framework/v0.6.19/VERSION

@@ -0,0 +1 @@
+0.6.19

package/framework/{v0.6.18 → v0.6.19}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -2189,7 +2189,8 @@ function Merge() {
      * @param {object|Array} target    - Target (base) object or array
      * @param {object|Array} source    - Source object or array to merge into target
      * @param {boolean}      [override=false] - Pass `true` to let `source` overwrite existing target keys; by default they are preserved
-     * @returns {object|Array} Merged result (mutates and returns `target`)
+     * @returns {object|Array} Merged result (mutates and returns `target`; never
+     *   rewrites `source` — a subtree the target lacks is referenced, not walked, #B428)
      *
      * @example
      * merge({ a: 1 }, { b: 2 })          // { a: 1, b: 2 }
@@ -2287,6 +2288,17 @@ function Merge() {
                             if (target === copy) {
                                 continue
                             }
+                            // #B428 — a value merged into ITSELF is identity: skip it.
+                            // A key the target lacks is grafted by reference below
+                            // (`clone[ prop ] = copy[ prop ]`), then the recursion
+                            // `browse(clone, copy)` met that graft with src === copy and
+                            // merged every array inside it with itself, writing the
+                            // copies back INTO the caller's object (identity churn +
+                            // silent primitive dedupe). Object/array references only —
+                            // equal primitives keep the original path.
+                            if (copy !== null && typeof(copy) == 'object' && src === copy) {
+                                continue
+                            }
 
                             // Recurse if we're merging plain objects or arrays
                             if (