kreftjs 0.0.9-beta → 0.0.10-beta

package/bin/backend/index.js

@@ -90,6 +90,10 @@ const loadModuleAsync = async (file) => {
 function createBackend(baseDir, { db = null, production = false, log = console, prefix = '/api' } = {}) {
   const isProd = Boolean(production || process.env.APP_ENV === 'production' || process.env.NODE_ENV === 'production');
   const isDebug = process.env.APP_DEBUG !== undefined ? (process.env.APP_DEBUG === 'true' || process.env.APP_DEBUG === '1') : !isProd;
+  // .env from an older template says SESSION_SECURE_COOKIE=false: in production that sends the session cookie over plain HTTP too
+  if (isProd && process.env.SESSION_SECURE_COOKIE === 'false') {
+    log.warn('  SECURITY: SESSION_SECURE_COOKIE=false in production. The login cookie is also sent over plain http://. Remove that line from .env (cookies are Secure in production by default).');
+  }
   const { startAutoGarbageCollector } = require('./gc.js');
   startAutoGarbageCollector({ thresholdMB: Number(process.env.AUTO_GC_THRESHOLD_MB) || 200, log: !isProd && process.env.VERBOSE_GC === '1' });
   installAlias();

package/bin/build.js

@@ -253,7 +253,8 @@ ${indent(components.join('\n\n'))}
 };
 
 // Apache (Hostinger, cPanel …) answers /docs with a 404, because only index.html exists on disk. These rules send every page address
-// (no file extension, not under /api/) that is not a real file or folder to index.html, so reloading a page works. A missing file such as
+// (no file extension, not under /api/) that is not a real file, or a folder with its own index.html (a prerendered page), to index.html,
+// so reloading a page works even when a folder has the page's name (the docs/ folder next to the /docs page). A missing file such as
 // app.js, or an /api/ address the host cannot answer, stays a real 404: sending it index.html would hand the page's HTML to code
 // that expects data (a list, JSON). An .htaccess you keep in public/ is left alone;
 // a relative base (./, as the desktop build uses) has no server and gets no file.
@@ -267,7 +268,7 @@ function writeHtaccess(dist, html) {
   RewriteBase ${base}
   RewriteRule ^index\\.html$ - [L]
   RewriteCond %{REQUEST_FILENAME} !-f
-  RewriteCond %{REQUEST_FILENAME} !-d
+  RewriteCond %{REQUEST_FILENAME}/index.html !-f
   RewriteCond %{REQUEST_URI} !^${base}api/
   RewriteCond %{REQUEST_URI} !\\.[A-Za-z0-9]+$
   RewriteRule . ${base}index.html [L]

package/docs/README.md

@@ -82,7 +82,7 @@ npx kreftjs dev
 ### Check that it works
 
 ```bash
-kreft --version     # for example 0.0.9-beta
+kreft --version     # for example 0.0.10-beta
 kreft about         # Kreft and Node.js versions, this project's settings and drivers
 kreft list          # every command your version has
 ```
@@ -1045,6 +1045,16 @@ Without a form, `validate(values, rules)` gives `{}` or `{ field: ['…'] }`. Cu
 
 The same rule names work on the server in `req.validate()` (see [Controllers and requests](#controllers-and-requests)), so one set of rules can describe both sides.
 
+### Passwords
+
+`not_common_password` refuses a password that is among the most used ones (`password`, `12345678`, `qwertyuiop` …), one character repeated (`aaaaaaaa`), a plain run (`12345678`, `abcdefgh`), or the same as the email address. A new app uses it next to `min:8` when people register, reset or change a password, in the pages and in the controllers:
+
+```js
+password: 'required|min:8|confirmed|not_common_password'
+```
+
+It is a short list that runs offline, with no service called, so it catches the worst choices and nothing more. For longer ones, raise `min` (a passphrase of four words beats a short mix of symbols). Change the message in `lang/en/validation.json` (`not_common_password`).
+
 ## Internationalization and RTL
 
 Kreft translates text and flips direction for right-to-left languages such as Arabic, Hebrew, Persian and Urdu.
@@ -1735,13 +1745,13 @@ RewriteEngine On
 RewriteBase /
 RewriteRule ^index\.html$ - [L]
 RewriteCond %{REQUEST_FILENAME} !-f
-RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_FILENAME}/index.html !-f
 RewriteCond %{REQUEST_URI} !^/api/
 RewriteCond %{REQUEST_URI} !\.[A-Za-z0-9]+$
 RewriteRule . /index.html [L]
 ```
 
-Apache only knows the files on disk, so without these rules `/docs` or any other clean address gives a 404 when someone opens or reloads it. With them, every page address (no file extension, not under `/api/`) that is not a real file or folder opens `index.html` and the router takes over. A missing file such as `app.js`, or an `/api/` address, stays a plain 404, so code that asks for data never receives the page's HTML. Upload the file too (it starts with a dot, so some file managers hide it; turn on "show hidden files"). If the site lives in a folder, build with `--base /folder/` and the rules follow it. An `.htaccess` you keep in `public/` is used as it is. A relative base (`--base ./`, used by the desktop build) gets no file.
+Apache only knows the files on disk, so without these rules `/docs` or any other clean address gives a 404 when someone opens or reloads it. With them, every page address (no file extension, not under `/api/`) that is not a real file, or a folder with its own `index.html`, opens `index.html` and the router takes over. A missing file such as `app.js`, or an `/api/` address, stays a plain 404, so code that asks for data never receives the page's HTML. Upload the file too (it starts with a dot, so some file managers hide it; turn on "show hidden files"). If the site lives in a folder, build with `--base /folder/` and the rules follow it. An `.htaccess` you keep in `public/` is used as it is. A relative base (`--base ./`, used by the desktop build) gets no file.
 
 > [!NOTE]
 > This hosts the front end only. Login, the database and everything under `/api` need the Node.js server, which Apache does not run.
@@ -2195,7 +2205,8 @@ Go through this before your first real user:
 | `MCP_TOKEN` set, or MCP left off | The MCP endpoint is disabled in production without it. |
 | Tables listed in `kreftjs.config.json`, or no `--db` at all | `kreft serve` serves only the tables you list. |
 | No test user | Do not run `--seed` against production; delete `test@example.com` if it exists. |
-| HTTPS in front of the app | Cookies are `Secure` in production and on `https` URLs. |
+| HTTPS in front of the app, and `FORCE_HTTPS=true` | Cookies are `Secure` in production and on `https` URLs. Plain HTTP is only redirected to HTTPS with `FORCE_HTTPS=true` or an `https://` `APP_URL`. |
+| No `SESSION_SECURE_COOKIE=false` in `.env` | It switches the `Secure` flag off, so the login cookie is also sent over plain `http://`. Older templates wrote it; the server warns about it at start-up in production. |
 | `npm audit` and `kreft update` | Fix known vulnerabilities before release. |
 
 > [!NOTE]

package/kreftjs.d.ts

@@ -1,4 +1,4 @@
-// Type definitions for Kreft 0.0.9-beta
+// Type definitions for Kreft 0.0.10-beta
 // Use from TypeScript or for editor hints in plain JavaScript (// @ts-check).
 
 export interface Signal<T> { value: T }

package/kreftjs.js

@@ -1,5 +1,5 @@
 /*!
- * Kreft v0.0.9-beta — reactive by nature
+ * Kreft v0.0.10-beta — reactive by nature
  * The .kreft component language (state · derive · action · when · watch · on),
  * { } views with k-if / k-each / k-model, components, slots, router, stores,
  * share / receive, event bus and a template engine.
@@ -4678,6 +4678,7 @@
     same: 'The :attribute field must match :other.',
     different: 'The :attribute field and :other must be different.',
     confirmed: 'The :attribute field confirmation does not match.',
+    not_common_password: 'The :attribute is too common or too easy to guess. Choose another one.',
     regex: 'The :attribute field format is invalid.',
     digits: 'The :attribute field must be :digits digits.',
     min: { string: 'The :attribute field must be at least :min characters.', numeric: 'The :attribute field must be at least :min.', array: 'The :attribute field must have at least :min items.' },
@@ -4687,6 +4688,17 @@
   };
   const isEmptyValue = (v) => v === undefined || v === null || (typeof v === 'string' && v.trim() === '') || (isArray(v) && !v.length);
   const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  // not_common_password: the passwords people choose most (8+ characters, so they pass `min:8`), one character repeated, a run like
+  // 12345678 or abcdefgh, or the same as the email address. Not a replacement for a long passphrase.
+  const COMMON_PASSWORDS = new Set('00000000 11111111 111111111 123123123 12345678 123456789 1234567890 12345678910 123456789a 123456abc 1q2w3e4r 1q2w3e4r5t 1qaz2wsx 88888888 987654321 abc12345 abcd1234 abcdefg1 abcdefgh admin123 admin1234 administrator asdfghjk asdfghjkl baseball1 changeme changeme1 dragon123 football1 freedom1 google123 hello123 hello1234 iloveyou iloveyou1 kreft123 kreftjs123 letmein1 letmein123 login123 master123 monkey123 p@ssw0rd p@ssword pass1234 passpass passw0rd password password1 password12 password123 password1234 princess1 qazwsxedc qwerty12 qwerty123 qwertyui qwertyuiop secret123 shadow123 starwars1 sunshine1 superman1 test1234 testing123 trustno1 welcome1 welcome123 whatever1 zxcvbnm1'.split(' '));
+  const isCommonPassword = (v, data) => {
+    const p = String(v).toLowerCase();
+    if (COMMON_PASSWORDS.has(p) || /^(.)\1+$/.test(p)) return true;
+    const runs = (s) => { let up = true, down = true; for (let i = 1; i < s.length; i++) { const d = s.charCodeAt(i) - s.charCodeAt(i - 1); if (d !== 1) up = false; if (d !== -1) down = false; } return up || down; };
+    if (p.length >= 6 && runs(p)) return true;
+    const email = data && typeof data.email === 'string' ? data.email.toLowerCase() : '';
+    return Boolean(email) && (p === email || p === email.split('@')[0]);
+  };
   const dateOf = (v, data) => { const d = new Date(hasOwn(data, v) ? data[v] : v === 'today' ? new Date().toDateString() : v); return isNaN(d) ? null : d; };
   function parseRules(rules) {
     return (isArray(rules) ? rules : String(rules || '').split('|')).filter(Boolean).map((r) => {
@@ -4746,6 +4758,7 @@
           case 'same': failed = value !== getPath(data, a); extra = { other: a.replace(/_/g, ' ') }; break;
           case 'different': failed = value === getPath(data, a); extra = { other: a.replace(/_/g, ' ') }; break;
           case 'confirmed': failed = value !== getPath(data, field + '_confirmation'); break;
+          case 'not_common_password': failed = isCommonPassword(value, data); break;
           case 'regex': { const m = r.arg.match(/^\/(.*)\/([a-z]*)$/); failed = !new RegExp(m ? m[1] : r.arg, m ? m[2] : '').test(String(value)); break; }
           case 'digits': failed = !new RegExp(`^\\d{${Number(a)}}$`).test(String(value)); extra = { digits: a }; break;
           case 'min': failed = sizeOf(value) < Number(a); extra = { min: a }; break;
@@ -5023,7 +5036,7 @@
     stores, storeLog, busLog,
   };
 
-  const VERSION = '0.0.9-beta';
+  const VERSION = '0.0.10-beta';
   const Kreftjs = {
     version: VERSION,
     // PUBLIC_ values from .env (kreft dev and kreft build put them here); never secrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kreftjs",
-  "version": "0.0.9-beta",
+  "version": "0.0.10-beta",
   "description": "A tiny reactive framework with its own component language (.kreft files): router with nested routes, stores, saved data, animations, an API client, hot reload, DevTools and a template engine.",
   "license": "Elastic-2.0",
   "main": "kreftjs.js",
@@ -14,7 +14,7 @@
     "start": "node bin/kreftjs.js dev --api demo/db.json --db sqlite:demo/database/demo.db --migrations demo/database/migrations --server demo/server --backend demo --seed",
     "build": "node bin/kreftjs.js build demo --out dist/demo --include docs",
     "preview": "node bin/kreftjs.js dev dist --api demo/db.json --db sqlite:demo/database/demo.db --migrations demo/database/migrations --server demo/server --backend demo --seed",
-    "test": "node --test test/security.test.js test/prerender.test.js test/seo.test.js test/rebrand.test.js test/noauth.test.js test/winspawn.test.js test/htaccess.test.js",
+    "test": "node --test test/security.test.js test/prerender.test.js test/seo.test.js test/rebrand.test.js test/noauth.test.js test/winspawn.test.js test/htaccess.test.js test/cookie-secure.test.js test/password-rule.test.js",
     "electron": "kreftjs electron",
     "electron:dev": "kreftjs electron:dev",
     "electron:build": "kreftjs electron:build"

package/templates/app/_env.example

@@ -30,16 +30,17 @@ FILESYSTEM_DISK=local
 # REDIS_PORT=6379
 # REDIS_PASSWORD=
 # REDIS_DB=0
-# REDIS_PREFIX=som:
+# REDIS_PREFIX=kreft:
 # Environment & Debugging:
 # - local: plain HTTP allowed on localhost, interactive bug diagnostics & stack traces shown
 # - production: plain HTTP disallowed for security (enforces HTTPS & HSTS), bug details & stack traces hidden
 APP_ENV=local
 APP_DEBUG=true
 
-# Force all traffic over secure HTTPS in production (auto-redirects HTTP -> HTTPS with HSTS)
-FORCE_HTTPS=false
-SESSION_SECURE_COOKIE=false
+# Redirect plain HTTP to HTTPS in production (with HSTS). Turn it on once the site has HTTPS:
+# FORCE_HTTPS=true
+# The login cookie is Secure in production and on an https:// APP_URL by itself. Do not set this to false in production:
+# SESSION_SECURE_COOKIE=true
 
 # Security & Sessions
 # A login token nobody used for this many days stops working

package/templates/app/backend/app/Http/Controllers/Auth/NewPasswordController.js

@@ -10,7 +10,7 @@ class NewPasswordController {
     const data = await req.validate({
       token: 'required',
       email: 'required|email',
-      password: 'required|min:8|confirmed',
+      password: 'required|min:8|confirmed|not_common_password',
     })
     const email = data.email.toLowerCase()
     const row = await DB.table('password_reset_tokens').where('email', email).first()

package/templates/app/backend/app/Http/Controllers/Auth/RegisteredUserController.js

@@ -8,7 +8,7 @@ class RegisteredUserController {
     const data = await req.validate({
       name: 'required|string|max:255',
       email: 'required|string|email|max:255|unique:users,email',
-      password: 'required|min:8|confirmed',
+      password: 'required|min:8|confirmed|not_common_password',
     })
     const user = await User.create({ name: data.name, email: data.email.toLowerCase(), password: Hash.make(data.password) })
     await user.sendEmailVerificationNotification()

package/templates/app/backend/app/Http/Controllers/ProfileController.js

@@ -42,7 +42,7 @@ class ProfileController {
     if (req.accessToken && req.accessToken.type !== 'session' && !req.accessToken.can('*')) {
       abort(403, 'Changing the account password requires a browser session.')
     }
-    const data = await req.validate({ current_password: 'required|string|max:255', password: 'required|string|min:8|max:255|confirmed' })
+    const data = await req.validate({ current_password: 'required|string|max:255', password: 'required|string|min:8|max:255|confirmed|not_common_password' })
     if (!Hash.check(data.current_password, req.user.password)) {
       throw new ValidationError({ current_password: ['The password is incorrect.'] })
     }

package/templates/app/backend/lang/ar/validation.json

@@ -16,6 +16,6 @@
     "password": "كلمة المرور",
     "title": "العنوان",
     "name": "الاسم"
-  }
+  },
+  "not_common_password": "كلمة :attribute شائعة جداً أو يسهل تخمينها. اختر كلمة أخرى."
 }
-

package/templates/app/backend/lang/en/validation.json

@@ -14,6 +14,6 @@
   "attributes": {
     "email": "email address",
     "password": "password"
-  }
+  },
+  "not_common_password": "The :attribute is too common or too easy to guess. Choose another one."
 }
-

package/templates/app/frontend/errors/ErrorMonitor.kreft

@@ -92,7 +92,7 @@ state docs = (Kreftjs.env.PUBLIC_DOCS_URL || 'http://kreftjs.com').replace(/\/+$
         <div class="badges">
           <span class="badge danger-badge">HTTP {status}</span>
           <span class="badge solid">{currentTitle}</span>
-          <span class="badge">Kreft {Kreftjs.version || '0.0.9-beta'}</span>
+          <span class="badge">Kreft {Kreftjs.version || '0.0.10-beta'}</span>
         </div>
         <div class="actions">
           <button class="sm" @click={copyReport}>{copied ? 'Copied Markdown' : 'Copy Report'}</button>
@@ -189,7 +189,7 @@ state docs = (Kreftjs.env.PUBLIC_DOCS_URL || 'http://kreftjs.com').replace(/\/+$
         <h3>Kreft Runtime</h3>
         <table>
           <tbody>
-            <tr><th>Engine</th><td><code>Kreft v{Kreftjs.version || '0.0.9-beta'}</code></td></tr>
+            <tr><th>Engine</th><td><code>Kreft v{Kreftjs.version || '0.0.10-beta'}</code></td></tr>
             <tr><th>Sanitizer</th><td><code>Active (cleanHtml / SafeHtml)</code></td></tr>
             <tr><th>Environment</th><td><code>development (APP_DEBUG=true)</code></td></tr>
           </tbody>

package/templates/app/frontend/kreftjs.d.ts

@@ -1,4 +1,4 @@
-// Type definitions for Kreft 0.0.9-beta
+// Type definitions for Kreft 0.0.10-beta
 // Use from TypeScript or for editor hints in plain JavaScript (// @ts-check).
 
 export interface Signal<T> { value: T }

package/templates/app/frontend/kreftjs.js

@@ -1,5 +1,5 @@
 /*!
- * Kreft v0.0.9-beta — reactive by nature
+ * Kreft v0.0.10-beta — reactive by nature
  * The .kreft component language (state · derive · action · when · watch · on),
  * { } views with k-if / k-each / k-model, components, slots, router, stores,
  * share / receive, event bus and a template engine.
@@ -4678,6 +4678,7 @@
     same: 'The :attribute field must match :other.',
     different: 'The :attribute field and :other must be different.',
     confirmed: 'The :attribute field confirmation does not match.',
+    not_common_password: 'The :attribute is too common or too easy to guess. Choose another one.',
     regex: 'The :attribute field format is invalid.',
     digits: 'The :attribute field must be :digits digits.',
     min: { string: 'The :attribute field must be at least :min characters.', numeric: 'The :attribute field must be at least :min.', array: 'The :attribute field must have at least :min items.' },
@@ -4687,6 +4688,17 @@
   };
   const isEmptyValue = (v) => v === undefined || v === null || (typeof v === 'string' && v.trim() === '') || (isArray(v) && !v.length);
   const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  // not_common_password: the passwords people choose most (8+ characters, so they pass `min:8`), one character repeated, a run like
+  // 12345678 or abcdefgh, or the same as the email address. Not a replacement for a long passphrase.
+  const COMMON_PASSWORDS = new Set('00000000 11111111 111111111 123123123 12345678 123456789 1234567890 12345678910 123456789a 123456abc 1q2w3e4r 1q2w3e4r5t 1qaz2wsx 88888888 987654321 abc12345 abcd1234 abcdefg1 abcdefgh admin123 admin1234 administrator asdfghjk asdfghjkl baseball1 changeme changeme1 dragon123 football1 freedom1 google123 hello123 hello1234 iloveyou iloveyou1 kreft123 kreftjs123 letmein1 letmein123 login123 master123 monkey123 p@ssw0rd p@ssword pass1234 passpass passw0rd password password1 password12 password123 password1234 princess1 qazwsxedc qwerty12 qwerty123 qwertyui qwertyuiop secret123 shadow123 starwars1 sunshine1 superman1 test1234 testing123 trustno1 welcome1 welcome123 whatever1 zxcvbnm1'.split(' '));
+  const isCommonPassword = (v, data) => {
+    const p = String(v).toLowerCase();
+    if (COMMON_PASSWORDS.has(p) || /^(.)\1+$/.test(p)) return true;
+    const runs = (s) => { let up = true, down = true; for (let i = 1; i < s.length; i++) { const d = s.charCodeAt(i) - s.charCodeAt(i - 1); if (d !== 1) up = false; if (d !== -1) down = false; } return up || down; };
+    if (p.length >= 6 && runs(p)) return true;
+    const email = data && typeof data.email === 'string' ? data.email.toLowerCase() : '';
+    return Boolean(email) && (p === email || p === email.split('@')[0]);
+  };
   const dateOf = (v, data) => { const d = new Date(hasOwn(data, v) ? data[v] : v === 'today' ? new Date().toDateString() : v); return isNaN(d) ? null : d; };
   function parseRules(rules) {
     return (isArray(rules) ? rules : String(rules || '').split('|')).filter(Boolean).map((r) => {
@@ -4746,6 +4758,7 @@
           case 'same': failed = value !== getPath(data, a); extra = { other: a.replace(/_/g, ' ') }; break;
           case 'different': failed = value === getPath(data, a); extra = { other: a.replace(/_/g, ' ') }; break;
           case 'confirmed': failed = value !== getPath(data, field + '_confirmation'); break;
+          case 'not_common_password': failed = isCommonPassword(value, data); break;
           case 'regex': { const m = r.arg.match(/^\/(.*)\/([a-z]*)$/); failed = !new RegExp(m ? m[1] : r.arg, m ? m[2] : '').test(String(value)); break; }
           case 'digits': failed = !new RegExp(`^\\d{${Number(a)}}$`).test(String(value)); extra = { digits: a }; break;
           case 'min': failed = sizeOf(value) < Number(a); extra = { min: a }; break;
@@ -5023,7 +5036,7 @@
     stores, storeLog, busLog,
   };
 
-  const VERSION = '0.0.9-beta';
+  const VERSION = '0.0.10-beta';
   const Kreftjs = {
     version: VERSION,
     // PUBLIC_ values from .env (kreft dev and kreft build put them here); never secrets

package/templates/app/frontend/pages/Dashboard.kreft

@@ -112,7 +112,7 @@ state docs = (Kreftjs.env.PUBLIC_DOCS_URL || 'http://kreftjs.com').replace(/\/+$
         <div class="info-list">
           <div class="info-item">
             <span class="info-label">Framework Engine</span>
-            <span class="info-value">Kreft {Kreftjs.version || '0.0.9-beta'}</span>
+            <span class="info-value">Kreft {Kreftjs.version || '0.0.10-beta'}</span>
           </div>
           <div class="info-item">
             <span class="info-label">Active Database</span>

package/templates/app/frontend/pages/Profile.kreft

@@ -9,7 +9,7 @@ state info = form(
 )
 state pass = form(
   { current_password: '', password: '', password_confirmation: '' },
-  { current_password: 'required', password: 'required|min:8|confirmed' },
+  { current_password: 'required', password: 'required|min:8|confirmed|not_common_password' },
 )
 state saved = ''
 state passSaved = ''

package/templates/app/frontend/pages/auth/Register.kreft

@@ -1,7 +1,7 @@
 <!-- /register: make an account (POST /api/register, app/Http/Controllers/Auth/RegisteredUserController.js) -->
 state f = form(
   { name: '', email: '', password: '', password_confirmation: '' },
-  { name: 'required|max:255', email: 'required|email|max:255', password: 'required|min:8|confirmed' },
+  { name: 'required|max:255', email: 'required|email|max:255', password: 'required|min:8|confirmed|not_common_password' },
 )
 state problem = ''
 

package/templates/app/frontend/pages/auth/ResetPassword.kreft

@@ -3,7 +3,7 @@ prop token = ''
 
 state f = form(
   { email: $route.query.email || '', password: '', password_confirmation: '' },
-  { email: 'required|email', password: 'required|min:8|confirmed' },
+  { email: 'required|email', password: 'required|min:8|confirmed|not_common_password' },
 )
 state problem = ''
 

package/templates/app/lang/ar/validation.json

@@ -12,6 +12,7 @@
     "array": "يجب ألا يحتوي :attribute على أكثر من :max عناصر."
   },
   "confirmed": "تأكيد :attribute غير متطابق.",
+  "not_common_password": "كلمة :attribute شائعة جداً أو يسهل تخمينها. اختر كلمة أخرى.",
   "attributes": {
     "email": "البريد الإلكتروني",
     "password": "كلمة المرور",
@@ -19,4 +20,3 @@
     "title": "العنوان"
   }
 }
-

package/templates/app/lang/en/validation.json

@@ -12,6 +12,7 @@
     "array": "The :attribute field must not have more than :max items."
   },
   "confirmed": "The :attribute confirmation does not match.",
+  "not_common_password": "The :attribute is too common or too easy to guess. Choose another one.",
   "attributes": {
     "email": "email address",
     "password": "password",
@@ -19,4 +20,3 @@
     "title": "title"
   }
 }
-

package/templates/errors/ErrorMonitor.kreft

@@ -118,7 +118,7 @@ state docs = (Kreftjs.env.PUBLIC_DOCS_URL || 'http://kreftjs.com').replace(/\/+$
         <div class="hero-badges">
           <span class="badge-exception">{currentTitle}</span>
           <span class="badge-env">Node.js {typeof process !== 'undefined' ? process.version : 'v22.0.0'}</span>
-          <span class="badge-env">Kreft v0.0.9-beta</span>
+          <span class="badge-env">Kreft v0.0.10-beta</span>
         </div>
         <h1 class="hero-error-message">{currentMessage}</h1>
       </div>