gina 0.7.2-alpha.1 → 0.7.2

package/CHANGELOG.md

@@ -6,6 +6,28 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.7.2 - 2026-10-03
+### Added
+* Versioned asset URLs, so browsers can keep a bundle's scripts and stylesheets for a year: in production, the `<link>` and `<script>` tags gina writes from `templates.json` (and their HTTP/2 preload hints) end in `?v=` plus the first 10 hex characters of the file's SHA-384, and the statics gina serves answer `Cache-Control: public, max-age=31536000, immutable` when the token names the file's current bytes, `no-cache` for any other token, and exactly as before without one. The client routing table is fetched the same way, its token carried on gina's own script tag. A deploy that changes a file changes its URL, so a returning visitor fetches it once and no stale copy survives. On by default; `assetVersioningEnabled: false` in `templates.json > _common` keeps the plain URLs. Not versioned: dev mode, renders without a layout, `isExternalPlugin` scripts, hand-written tags. A front server that serves the statics, such as nginx, should send requests that carry a token to the bundle, which checks it (see the statics reference). Restart the bundle to pick it up; if your build copies `gina.min.js` into your own static files, rebuild that copy before the restart: an older copy compares script URLs exactly, so it can run a script twice when a popin or a swapped region includes a file the page loaded under its versioned URL. (#P48)
+* The fast lane: a JSON route can skip the controller. Declare `"param": { "lane": "users", "control": "list" }` in `routing.json` and export `list` from the bundle's `lanes/users.js`: the function receives one context object and answers with `ctx.json()` or `ctx.error()`, with `ctx.params`, `ctx.body`, `ctx.session`, `ctx.getConfig()` and `ctx.hasRole()` at hand. Everything gina does before the router still runs (the request id, CORS, the security headers, maintenance mode, statics, body parsing, the route match and its requirements), and so does the bundle's own middleware, such as the session and CSRF layers; the access line, the metrics and the JSON error envelope are those of any route. Measured with one process serving the same JSON answer both ways: a median 0.39 times the CPU of the controller route, about 150 microseconds less per request. Lane routes are checked at boot, which refuses one that declares route middleware, `cache`, `negotiate`, `namespace` or `method: "ws"`, and, in this release, any gate (authorization, rate limit, idempotency, message validation, request DTO), including the implicit ones of `auth.requireAuthByDefault` and `server.rateLimit`. A lane module edit is picked up in dev mode; a routing change needs a restart. Opt-in: existing routes are unchanged, unless one already used a `param` key named `lane` for its own data. Restart the bundle to pick it up; nothing to re-bake. (#P49)
+### Fixed
+* Staged uploads: a file input's browser placeholder value (C:\fakepath\name) is no longer collected into the form-submit payload — a staged file input's data travels through its hidden fields, so the input is skipped from the payload while staying available for rule evaluation (#B725). A transport-level request failure (XHR status 0) now reports "the request did not complete" instead of "the request did not reach the server" — honest for a proxy 413 that arrives mid-send over HTTP/2 and for a navigation that aborts the request, both of which reached the server — resolved through an overridable label (gina.config.a11y.transportError) and tagged with a reason of unload or transport (#B724). Reported as gh#83 parts 1 and 2. Browser-bundled: rebuild bundles to pick it up.
+* Staged uploads: a form submitted while one of its staged uploads is still uploading now waits for it, then sends once with the uploaded file's metadata, instead of posting the upload's still-empty hidden fields. While it waits the submit control keeps its busy state and the form's live region announces the wait once (overridable as gina.config.a11y.uploadPending, default "Waiting for the upload to finish…"); if an upload fails, the waiting submit is cancelled and nothing is sent. This covers every way a validator-bound form is submitted — the submit control, Enter, requestSubmit() and $forms[id].submit() — while a direct $forms[id].send(data) call, which carries its own payload, is not held (#B726, gh#83 part 3). Browser-bundled: rebuild bundles to pick it up.
+* A page whose query string ends in the client routing table's path, such as `/web/?next=/_gina/assets/routing.json`, is answered by the page instead of the table: both engines now test the table on the URL's path only, as the other built-in endpoints have since 0.7.1. Restart the bundle. (#P48)
+* A precompressed `.gz` file went out as `Content-Encoding: gz`, its file extension, which is not a content coding, so a client could not decode it: Chromium does not run such a script. In production gina now sends `Content-Encoding: gzip`, for a static's `.gz` copy (over HTTP/1.1) and for the routing table's `.gz` copy (isaac, both protocols); `.br` copies were already sent as `br`. With gina's order (brotli, then deflate, then gzip) the `.gz` copy goes only to a request that accepts gzip but neither brotli nor deflate, such as Go's HTTP client by default or a proxy or CDN set to ask the origin for gzip; browsers also send deflate and were not served it directly. Restart the bundle. (#B742)
+* In production, the statics gina serves over HTTP/1.1 and the routing table on the isaac engine now carry `Vary: Accept-Encoding`, on the 200 and on the 304, so a shared cache no longer hands a brotli or gzip copy to a client that does not accept that coding. Every such static carries it, with a precompressed copy or not; a `vary` declared under `server.response.header` in the project's `env.json` is kept and now reaches the 304 too. HTTP/2 statics and dev mode are unchanged. Restart the bundle. (#B743)
+* On a bundle serving HTTP/2, an error answered by gina's server-level error path (a 404 for a missing route, a 405, a 500) was counted by the Prometheus metrics as a `200` under `route="__no_route__"`: the answer goes out on the raw HTTP/2 stream, and the response object it bypasses kept its default status, which is what the metrics read when the response finishes. The response now carries the code it sends, so a 404 counts as `404` under `__not_found__`, as it already did over HTTP/1.1. Clients always received the right status. Restart the bundle. (#B749)
+* Five places assigned `headersSent` on a response after sending it. `headersSent` is read-only on Node's response objects, so in these strict-mode files each assignment threw a `TypeError` after the client had its answer: with the nunjucks engine over HTTP/2, every rendered page logged an unhandled promise rejection; with a redis render cache over HTTP/2, the first request for each cached URL after a restart (or on a fresh replica) logged one and wrote no access-log line; `self.renderXML()` skipped its cleanup over HTTP/2 and, over HTTP/1.1, could call the action's `next()` after the response had ended. The assignments are gone. Restart the bundle. (#B750)
+* The SQLite session store now reads its file path from `file`, as the SQLite job and kv stores already do. The sessions guide and the connectors reference showed a persistent store with its path in `database`, and that configuration stopped the boot: the model layer opens a connector for every connectors.json entry and reads `database` as a database name under the gina home, so it tried to open `<home>/<path>.sqlite`. The examples now use `file`, for a path and for `":memory:"`. A configuration that boots today behaves as before (`database` on its own is still read when `file` is unset), and with neither key the store keeps its default file, `~/.gina/sessions-<bundle>.db` (#D47).
+* Staged uploads: choosing another file while the previous one is still uploading now stages the new file. The new selection was silently dropped while the input showed it, and the first upload then filled the form with the replaced file's metadata. The earlier request is now cancelled and settles through the `abort` event only, with no error and no on-error callback; it may already have reached your staging action, which can leave an unclaimed temporary file. A submit already waiting for the upload waits for the new one and sends its metadata (#B729). Browser-bundled: rebuild bundles to pick it up.
+* Staged uploads: a file input inside a popin that was closed and reopened stages files again. After the reopen every selection threw `setAttribute is not a function` and sent no staging request, so the upload never ran and its on-success callback never fired. The input now builds a fresh upload form when the previous one left the page with the popin's content (#B733). Browser-bundled: rebuild bundles to pick it up.
+* Popins: closing a popin through `gina.popin.close(name)` now tears down the forms it bound, as its close button and its own `close()` already did. The forms stayed registered against their removed markup, so after a reopen they were not bound again: their rules, their submit handling and their declared events were lost, and a staged upload in them sent nothing. This concerns a popin constructed with a validator (#B756). Browser-bundled: rebuild bundles to pick it up.
+* Staged uploads: two forms on one page whose staged file inputs share a name without brackets (`name="doc"`) no longer share one upload form. The second form's upload filled the first form's hidden fields and left its own empty. Each form now gets its own upload form, whose id ends with the form id (`gina-upload-doc-<form id>`); a bracketed name keeps its id. Code that matched the old id literally should read the input's `data-gina-form-virtual` attribute instead (#B732). Browser-bundled: rebuild bundles to pick it up.
+* Staged uploads: a failed staging request now reaches the `data-gina-form-upload-on-error` callback even when the input has no error element. Without one, the client threw before the error event and the callback, so neither ran, for an HTTP error and a transport failure alike; the message is now announced through the form's live region, and in dev mode a console warning names the missing element. The error element is also read from the file input's own `data-gina-form-upload-error` attribute (default `<id>-error`): it was taken from the form's last input, so a custom element was honoured only when the file input came last (#B731). Browser-bundled: rebuild bundles to pick it up.
+### Security
+* The staged-upload client layer rendered a staging request's error message with innerHTML, so a reverse-proxy or WAF HTML error page — or a server error that reflects request text such as a rejected upload filename — was parsed as live markup in the page. The upload error slot now builds the message with createElement and textContent, so a server error message is always rendered as text (#B727, gh#83 part 4). Browser-bundled: rebuild bundles to pick it up.
+* Raised the `engine.io` dependency floor from `^6.6.7` to `^6.6.10`, the first release patched for GHSA-2gc4-cqfq-p2gv (CVE-2026-102599): on an existing session, a transport-upgrade request carrying a different or missing protocol revision could crash the process. Gina loads engine.io only for a bundle whose `settings.json` sets `ioServer.integrationMode` to `"attach"`; such a bundle was exposed when its install resolved engine.io 6.6.0 to 6.6.9 with transport upgrades allowed, which is the default. `^6.6.7` already let a fresh install resolve a patched release; with the new floor, an install of this version cannot resolve an affected one. Restart attach-mode bundles to load it (#S12).
+
 ## 0.7.1 - 2026-10-01
 ### Changed
 * A new project or bundle name must now be made of letters, digits, `_`, `.` and `-`, and start with a lowercase letter, a digit, `_` or `.`; `.`, `..` and the names every object inherits, such as `constructor`, are refused. `project:add`, `bundle:add`, the new name given to `project:rename`, `bundle:rename` or `bundle:copy`, and the name `project:restore` registers are checked before anything is written, and `bundle:add` checks every name of its list before it adds the first bundle. Until now only the first character was checked, so names holding spaces, quotes, `$` or `/` were registered, and `project:add @constructor` took the name for a registered project with no path and failed. A project or bundle already registered under a name outside the rule keeps working, including with `project:import`, `bundle:add --import` and `bundle:add --replace`. (#B665)

package/README.md

@@ -19,6 +19,7 @@ MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architectur
 | Multi-bundle | One project, N independent bundles with shared config and project layer |
 | Scope isolation | `local` / `beta` / `production` — per-request and per-record |
 | MVC routing | `routing.json` — declare routes in config, not code; an index built once per routing table narrows each cold match to the rules the URL could reach, and a hot path is served from the route cache |
+| Fast lane | Opt-in JSON routes without a controller — `param.lane` names a handler module under `lanes/` that answers with `ctx.json()` / `ctx.error()`; the request id, CORS, the bundle's session and CSRF middleware, the metrics and the error envelope stay as on any route |
 | Async/await | Controller actions can be `async`; rejections routed to `throwError` automatically |
 | WebSockets | WS routes in `routing.json` (`"method": "ws"` + channel handlers, `:param` paths); WebSocket-over-HTTP/2 (RFC 8441) |
 | ORM / entities | EventEmitter-based entity system; SQL files auto-wired to entity methods |
@@ -67,52 +68,46 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.7.1
+## What's in 0.7.2
 
-> **Restart your bundles *and* rebuild them — then restart the framework daemon.**
-> One change is browser-bundled (an instance of an `inherits()` class no longer
-> carries its own `prototype`), so `gina.min.js` changed and `gina bundle:restart`
+> **Restart your bundles *and* rebuild them.** The staged-upload, popin and asset-URL
+> changes are browser-bundled, so `gina.min.js` changed and `gina bundle:restart`
 > alone leaves the old client running: rebuild each consuming bundle, then restart
-> it. The CLI's log-listener port file moved to `~/.gina/run/`, so restart the
-> framework daemon and any running `gina tail` once as well.
-
-> **Read before upgrading — some changes can change an answer.** On an npm install,
-> `settings.swig.autoescape: true` now escapes Swig output as configured — check
-> your templates first. A loopback entry in `admin.allowFrom` or
-> `metrics.allowFrom` no longer admits a request a reverse proxy relays, and the
-> admin endpoints answer their exact path only. A new project or bundle name must
-> follow a naming rule, and the CLI matches names literally. The
-> [migration notes](https://gina.io/docs/migration) list every behaviour change.
-
-**The security release.** Five advisories lead it: behind a reverse proxy on the
-bundle's own host, the admin `/_gina/*` endpoints and `/_gina/metrics` admitted
-every client the proxy relayed; the cross-origin write guard in front of the
-control endpoints missed three URL shapes; one `GET` of the routing table in
-another letter case stopped an isaac bundle; command output logs and the
-log-listener port file left the shared temp directory; and `autoescape: true` is
-applied on npm installs. More CLI commands stop building shell command lines, a
-routed request costs about a third less CPU, and the built-in `/_gina/*` endpoints
-answer a query string, `HEAD` and HTTP/2. Full detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — the admin `/_gina/*` endpoints refuse a request relayed by a proxy on the bundle's host (#B709).** They admitted a caller by its network address alone, loopback by default, so a proxy on the same host relayed every client past `admin.allowFrom` and `metrics.allowFrom`. A loopback caller whose request carries a forwarding header or a `Host` without a port is now refused with `403`, and each endpoint answers its exact path only.
-- **Security — the cross-origin write guard covers every URL the control endpoints answer (#B708).** A leading path segment, the endpoint path at the end of a query string or another letter case slipped past it, so a page on another origin could turn maintenance mode on from an operator's allowed address.
-- **Security — a `GET` of the routing table in another letter case no longer stops an isaac bundle (#B707).** `/_gina/assets/Routing.json` found no file and the empty result's read ended the process — one unauthenticated request, before routing and every route guard. The lookup now uses the lower-cased name.
-- **Security — command output logs and the log-listener port file leave the shared temp directory (#B702, #B704).** `run()` and `Shell::run()` write each command's output to a private directory removed at close, and the port file lives in `~/.gina/run/` (mode 0600).
-- **Security — `settings.swig.autoescape: true` is applied on npm installs (#B695).** The per-request settings read failed on an npm install, so the option was silently dropped there.
-- **Security — CLI commands no longer build shell command lines, and match names literally (#B665).** Commands that start other gina commands, the framework commands and an isaac bundle's boot pass their values as arguments, and registry lookups no longer read a name as a regular expression.
-- **Changed — new project and bundle names follow a naming rule (#B665).** Letters, digits, `_`, `.` and `-`, starting with a lowercase letter, a digit, `_` or `.`; existing names keep working.
-- **Changed — less work per routed request.** Values that do not change between requests are computed once and configuration lookups reuse the loaded configuration: a routed JSON request went from about 300 µs to about 205 µs of CPU in the profiling harness. An instance of an `inherits()` class no longer carries its own `prototype`.
-- **Fixed — the built-in `/_gina/*` endpoints answer a query string and `HEAD`, and a page whose query string ends in an endpoint path gets the page (#B712, #B717, #B718).**
-- **Fixed — isaac's own event streams answer HTTP/2 clients (#B722).** `/_gina/logs`, `/_gina/agent` and `/_gina/release/events` never answered one.
-- **Fixed — maintenance mode on isaac: a listed direct client gets through on HTTP/1.1, and the storage endpoints answer during a window (#B711, #B715).**
-- **Fixed — `storage:gc --dry-run` and `--driver=` work against a running isaac bundle (#B710).** A dry run ran a real collection.
-- **Fixed — a JSON body sent to the maintenance or instrumentation toggle no longer stops an express bundle (#B714).**
-- **Fixed — a daemon-started bundle's boot warnings appear in the `bundle:start` output (#B691).**
-- **Fixed — project commands from a path with a space, `bundle:stop`'s pid file, lookups of names extending one another, and a `--restart-pid` flag (#B665, #B693, #B689).**
-- **Fixed — the Inspector and `gina inspector:open` accept a target URL with a query string (#B719).**
-- **Fixed — a bundle with templates no longer walks the call stack on every request (#B695).**
-- **Fixed — with the output cache off, isaac no longer serves a page an earlier run cached.**
-- **Fixed — the path helper no longer keeps every path it has seen (#B703).**
+> it. If your build copies `gina.min.js` into your own static files, rebuild that
+> copy before the restart.
+
+> **Read before upgrading — some changes can change an answer.** In production, the
+> asset URLs gina writes now carry a `?v=` content token, and the statics it serves
+> answer `Cache-Control: public, max-age=31536000, immutable` when the token matches.
+> This is on by default: `assetVersioningEnabled: false` in `templates.json > _common`
+> keeps the plain URLs, and a front server that serves your statics should send
+> tokened requests to the bundle. A staged-upload transport failure now says the
+> request "did not complete", the upload form of a staged input whose name has no
+> brackets gets a new id (`gina-upload-<name>-<form id>`), and a route whose `param`
+> already used a key named `lane` for its own data now declares a fast-lane route.
+> The [migration notes](https://gina.io/docs/migration) list every behaviour change.
+
+**The staged-uploads release.** The four reports of issue #83 lead it: the
+staged-upload error slot rendered a server's error text as markup (an advisory), a
+form posted a file input's `C:\fakepath\` placeholder, a submit could leave while
+its upload was still running, and a request that failed in transit said it never
+reached the server. Five more staged-upload and popin fixes found on the way, two
+new features — versioned asset URLs that browsers keep for a year, and an opt-in
+fast lane that answers a JSON route without building a controller — and fixes to
+precompressed statics, HTTP/2 error metrics and the SQLite session store. Full
+detail in [CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — a staged upload's error message is shown as text (#B727).** The upload error slot used `innerHTML`, so a proxy's or WAF's HTML error page, or a server error that echoes request text such as a rejected filename, became live markup in the page.
+- **Security — the `engine.io` floor rises to `^6.6.10` (#S12).** On an existing session, a transport-upgrade request could crash a bundle whose `settings.json` sets `ioServer.integrationMode` to `"attach"` (GHSA-2gc4-cqfq-p2gv); an install of this version can no longer resolve an affected release.
+- **Added — versioned asset URLs (#P48).** In production the `<link>` and `<script>` tags gina writes from `templates.json`, their preload hints and the client routing table carry a content token, and the statics gina serves answer `immutable` for a year when the token names the file's current bytes, so a deploy that changes a file changes its URL. On by default.
+- **Added — the fast lane (#P49).** A JSON route can name a function in the bundle's `lanes/` directory (`"param": { "lane": "users", "control": "list" }`) and skip the controller: a median 0.39 times the CPU of the controller route, about 150 µs less per request, in the measurement. Opt-in; this release refuses a lane route that declares a gate.
+- **Fixed — staged uploads, issue #83 parts 1–3 (#B724, #B725, #B726).** A transport failure says the request did not complete (overridable as `gina.config.a11y.transportError`), a staged file input's placeholder value is no longer posted, and a submit made during an upload waits for it, then sends once with its metadata.
+- **Fixed — staged uploads: choosing another file during an upload, an input without an error element, same-named inputs in two forms, and an input in a reopened popin (#B729, #B731, #B732, #B733).**
+- **Fixed — `gina.popin.close(name)` tears down the popin's forms (#B756).** After a reopen they were left unbound.
+- **Fixed — precompressed statics: a `.gz` copy goes out as `Content-Encoding: gzip`, and statics vary on `Accept-Encoding` (#B742, #B743).**
+- **Fixed — on HTTP/2, an error answer is counted with its own status in the metrics, and no `headersSent` error follows a sent response (#B749, #B750).**
+- **Fixed — the SQLite session store reads its path from `file` (#D47).** A path in `database`, as the docs showed, stopped the boot.
+- **Fixed — a page whose query string ends in the routing table's path is answered by the page (#P48).**
 
 ## Documentation
 

package/ROADMAP.md

@@ -88,6 +88,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities ✅ shipped early in `0.6.31` (the `Priority` header half — read, propagated, emitted, job urgency; response ordering stays blocked on Node scheduler hooks) · the `0.6` line closed at `0.6.33`: the Beemaster admin + visual translation editor moved to `0.7.x` |
 | **Q4 2026** | `0.7.0` ✅ | **Performance**: the inter-bundle throughput arc closes — a candidate index narrows the cold route match to the rules whose URL could match, the warm route cache becomes one constant-time map, an HTTP/2 `self.query()` answer without a `status` field no longer gets `status: 200` added nor a warning logged per call, and the arc's exit benchmark is published (its first five slices shipped in `0.6.33`). **Security**: seven fixes — a `GET` could run a route's `DELETE` action for any client, including from another site; on Express 5 one body-less request could stop the bundle; a stack passed as an error message reached the client; `gina tail --follow` re-ran a start command from the shared tmp directory; a long `X-Forwarded-Prefix` header could tie up an isaac bundle; a malformed frame on the loopback log listener stopped the framework daemon; and the browser bundle no longer carries any dynamic-code call, so custom validators compile without `eval`. **Added**: a boot warning for a Swig bundle that leaves `settings.swig.autoescape` unset (the default becomes `true` in `0.8.0`), and one for routing `requirements` regexes that are not anchored. **Fixed**: the first gina commands after a minor-version upgrade; a `405` lists the allowed methods, and a `HEAD` works on every `GET` route and gives the action `req.get`; on Express, a URL carrying a query string resolves; with `autoescape: true`, Swig pages keep their CSS and JavaScript; `env:add <env> @<project>`, `project:rename`, the values of `project:add`'s flags, six CLI commands that did not exit, and a path with a space in the install, `port:reset` and `bundle:restart`; the path helper's failed copies; the scaffolded Couchbase `pingInterval`. **ISO 27001 supplier evidence**: a published OpenSSF Scorecard and the controller-side error-message sanitizer. **New minor version**: settings move to `~/.gina/0.7/` — an npm install resets the networking and directory settings and the log level to their defaults, while Bun, a `gina-container` image or a git checkout carries them over and resets only the log level; culture, timezone, default environment and scope carry over on every path — and a `^0.6.x` dependency range does not resolve `0.7.0`. 25 fragments; restart **and rebuild** — the browser bundle changed. |
 | **Q4 2026** | `0.7.1` ✅ | **Security**: five advisories — behind a reverse proxy on the bundle's own host, the admin `/_gina/*` endpoints and `/_gina/metrics` admitted every client the proxy relayed; the cross-origin write guard in front of the `/_gina/*` control endpoints missed a leading path segment, the endpoint path at the end of a query string and another letter case; one `GET` of the client routing table spelled in another letter case stopped an isaac bundle; command output logs and the log-listener port file left the shared temp directory; and `settings.swig.autoescape: true` is applied on npm installs — plus CLI hardening: commands that start other gina commands, and an isaac bundle's boot, no longer build shell command lines, and the CLI matches names literally in its registry lookups. **Changed**: new project and bundle names follow a naming rule; less work per routed request — about a third less CPU on a JSON route — and an instance of an `inherits()` class no longer carries its own `prototype`. **Fixed**: the built-in `/_gina/*` endpoints answer a URL with a query string and the health check answers `HEAD`; a page whose query string ends in an endpoint path gets the page; isaac's own event streams answer HTTP/2; the maintenance IP allowlist on an isaac bundle serving HTTP/1.1; the storage endpoints during a maintenance window, and `storage:gc --dry-run` and `--driver=` against a running bundle; a JSON body sent to a control toggle on express; a daemon-started bundle's boot warnings in the `bundle:start` output; project commands from a path with a space, `bundle:stop`'s pid file, lookups that took one name for another extending it, and a `--restart-pid` flag; the Inspector's target URL with a query string; a bundle with templates walking the call stack on every request; the output cache read while disabled; and the path helper's per-path registry. 34 fragments; restart **and rebuild** — the browser bundle changed — and restart the framework daemon and any running `gina tail`. |
+| **Q4 2026** | `0.7.2` ✅ | **Security**: a staged upload's error message is rendered as text — the upload error slot used `innerHTML`, so a proxy's HTML error page, or a server error echoing request text such as a rejected filename, became live markup in the page — and the `engine.io` floor rises to `^6.6.10`, so an install can no longer resolve a release whose transport-upgrade handling could crash an attach-mode bundle. **Added**: versioned asset URLs — in production the asset tags gina writes and the client routing table carry a content token, and the statics gina serves answer `immutable` for a year when it matches (on by default); the fast lane — a JSON route can name a function in the bundle's `lanes/` directory and skip the controller (opt-in; about 150 µs less CPU per request in the measurement). **Fixed**: staged uploads — a request that fails in transit says it did not complete, and the text can be translated; a staged file input's placeholder value is no longer posted; a submit made during an upload waits for it; choosing another file during an upload stages it; a staging error reaches the on-error callback without an error element; same-named staged inputs in two forms keep their uploads apart; a staged input works again after its popin is reopened, and `gina.popin.close(name)` tears down the popin's forms; a precompressed `.gz` static is sent as `Content-Encoding: gzip` and statics vary on `Accept-Encoding`; HTTP/2 error answers are counted with their status in the metrics; no `headersSent` error after a sent response; the SQLite session store reads its path from `file`; and a page whose query string ends in the routing table's path gets the page. 17 fragments; restart **and rebuild** — the browser bundle changed. |
 | **2027** | `0.7.x` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — shipped in `0.6.30`) · ISO 27001 supplier evidence — an SBOM attached to every release, once releases are cut by the CI release workflow · Beemaster admin + visual translation editor (moved from `0.6.x`) |
 | **2027** | `0.8.0` | **Swig output auto-escaping on by default** — `settings.swig.autoescape` becomes `true` when a bundle leaves it unset (prepared in `0.7.0`: a boot warning, the scaffold, the asset-tag fix). ⚠️ The financial-messaging content first planned here was **delivered early in `0.6.25` (2026-09-03)**: XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys. |
 | **2027** | `0.9.0` | Financial-integration heavyweights — entity-layer datastore transaction seam · message-queue connector family (AMQP / Kafka / IBM MQ) |
@@ -503,6 +504,8 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **Server-side `GOAWAY(INTERNAL_ERROR)` on long-lived HTTP/2 sessions — diagnose and fix** | `0.6.33` | 2026-09-25 | **Arc slice 5 — cause found in slice 2, fix re-checked.** After every completed response the calling bundle also sent a stream reset; the target's HTTP/2 library counts those against its reset rate limit and closed the session with `GOAWAY(INTERNAL_ERROR)` after about a thousand calls, without logging anything. The caller stopped sending them in `0.6.33`. Re-checked on the current tree: three runs of 20,000 calls (8 and 50 concurrent callers), each on one long-lived session — no GOAWAY, no failed call, no retry; the same scene with the reset put back closed the session four times in 5,000 calls. |
 | ✅ | **Routing — a candidate index for the cold match, a constant-time route cache; measured against rule count** | `0.7.0` | 2026-09-25 | **Arc slice 6 — landed (2026-09-25, for `0.7.0`).** Instead of wiring the 0.3.0 trie, a server-side index built once per routing table narrows a request the route cache has not seen to the routes whose URL could match; declaration order and every per-route check are unchanged, so the same route answers. Measured on the routing step, 380 routes: a late match 441 → 14 µs, a `404` 509 → 12 µs. The route cache is now one map: with it full, a lookup costs about 1.5 µs instead of 18–74 µs, and an entry keeps only the matched route — no longer the request's parameters and data. The unused trie is removed. |
 | ✅ | **Hop hygiene — per-call warning and `status` injection on the HTTP/2 hop, guide corrections, arc exit benchmark** | `0.7.0` | 2026-09-25 | **Arc slice 7 — landed (2026-09-25, for `0.7.0`).** An HTTP/2 `self.query()` answer without a `status` field no longer gets `status: 200` added or logs a warning, so both transports return the same result. The guides now say which protocol a bundle serves (HTTP/1.1 unless configured), what the HTTP/2 client retries, and when a route answers 405. The arc closed with the bundle-to-bundle benchmark re-run on the shipped tree, side by side with the arc's starting point: with default settings, no failed call at 50 concurrent callers (3,916 before, over three 10-second runs), one connection per HTTP/2 upstream and none left open after idle, and the hop's CPU cost per call down 52% over HTTP/1.1 and 58% over HTTP/2. These figures were measured from a repository checkout. Re-run on 2026-09-27 side by side from a checkout and from a copy laid out like an npm install, the benchmark showed no difference between the two beyond the run's noise: its bundles have no templates, so they never ran the per-request call-stack walk that cost bundles with templates on npm installs until 0.7.1. |
+| ✅ | **Versioned asset URLs — a content token on every asset URL gina emits, so browsers keep them for a year** | `0.7.2` | 2026-10-01 | **Landed (2026-10-01, for `0.7.2`).** Measured on a production site: a returning visitor's browser went back to the network for 30 of 35 assets on every page, because every script and stylesheet was served `no-cache` — the URLs gina emits carried no version, so a long cache lifetime would have served stale code after a deploy. In production, the `<link>` and `<script>` tags gina writes from `templates.json`, and their HTTP/2 preload hints, end in `?v=` plus 10 hex characters of the file's SHA-384; the statics gina serves answer `Cache-Control: public, max-age=31536000, immutable` to the current token and `no-cache` to any other; the client routing table is versioned the same way. On by default (`assetVersioningEnabled` in `templates.json`); a front server that serves the statics, such as nginx, should send requests that carry a token to the bundle, which checks it, rather than key its cache header on the token pattern (see the [statics reference](https://gina.io/docs/reference/statics#versioned-asset-urls)). |
+| ✅ | **Fast lane — JSON routes answered without building a controller** | `0.7.2` | 2026-10-02 | **Landed (2026-10-02, for `0.7.2`).** A route opts in with `param.lane`, naming a module in the bundle's `lanes/` directory; the function it exports under the route's `param.control` answers with a context object (`ctx.json()`, `ctx.error()`, `ctx.params`, `ctx.session`) instead of a controller action. Everything gina does before the router still runs — the request id, CORS, the security headers, maintenance mode, statics, body parsing, the route match — and so does the bundle's own middleware, such as the session and CSRF layers; the access line, the metrics and the error envelope are those of any route. Measured with one process serving the same JSON answer both ways: a median 0.39× the CPU of the controller route, about 150 µs less per request. In this first slice a lane route declares no gate (authorization, rate limit, idempotency, message validation, request DTO), no route middleware and no cache — the boot refuses one that does; running the gates on lane routes is a later decision. |
 
 ---
 

package/framework/v0.7.2/VERSION

@@ -0,0 +1 @@
+0.7.2