sproutboat 0.11.1 → 0.11.3

package/CHANGELOG.md

@@ -10,6 +10,29 @@ maintained going forward by the `release` skill.
 
 ## [Unreleased]
 
+## [0.11.3] - 2026-09-14
+### Fixed
+- Bumped `@sproutboat/runtime` to `^0.6.4`, picking up the encode-side half of
+  the same `O(n^2)` string-building bug `v0.11.2` fixed on the decode side.
+  `__sbToBytes` sits behind every `crypto.subtle` call a handler makes:
+  `digest`, `importKey`, `sign`, `verify` and the PBKDF2/scrypt path all funnel
+  their data, keys, salts and signatures through it, so hashing a request body
+  was quadratic in the body's size. `__sbHexOrBytes`, which decodes the
+  `expected` side of an HMAC verify, was worse still; it rewrote its
+  accumulator's last character on every odd nibble, copying the whole string
+  twice per byte (baronunread/sproutboat#180).
+
+## [0.11.2] - 2026-09-14
+### Fixed
+- Bumped `@sproutboat/runtime` to `^0.6.3`. `v0.11.1` bumped it to `^0.6.2`,
+  which fixed the mojibake but not a second, compounding bug in the same
+  code path: `__sbFromUtf8` built its result with repeated `out +=` string
+  concatenation, which is `O(n^2)` in Porffor's runtime (no rope/cons
+  string optimization). A fresh install of `v0.11.1` silently carried this
+  forward, since `^0.6.2` is satisfied by `0.6.2` -- a real deployment
+  regressed back to 2.6s+ per request from a plain `bun install` picking up
+  that exact version, until the dependency was explicitly bumped further.
+
 ## [0.11.1] - 2026-09-13
 ### Fixed
 - Bumped `@sproutboat/runtime` to `^0.6.2`, picking up a fix for a handler
@@ -459,7 +482,9 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.1...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.3...HEAD
+[0.11.3]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.2...v0.11.3
+[0.11.2]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.1...v0.11.2
 [0.11.1]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.0...v0.11.1
 [0.11.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.3...v0.11.0
 [0.10.3]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.2...v0.10.3

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.1 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.11.3 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,7 +64,7 @@
     "@sproutboat/artifact": "^0.2.0",
     "@sproutboat/assets": "^0.2.0",
     "@sproutboat/config": "^0.3.0",
-    "@sproutboat/runtime": "^0.6.2",
+    "@sproutboat/runtime": "^0.6.4",
     "@sproutboat/toolchain": "^0.4.0",
     "@sproutboat/wire": "^0.5.0",
     "esbuild": "^0.28.2"
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.1",
-    "@sproutboat/cli-darwin-x64": "0.11.1",
-    "@sproutboat/cli-linux-arm64": "0.11.1",
-    "@sproutboat/cli-linux-x64": "0.11.1"
+    "@sproutboat/cli-darwin-arm64": "0.11.3",
+    "@sproutboat/cli-darwin-x64": "0.11.3",
+    "@sproutboat/cli-linux-arm64": "0.11.3",
+    "@sproutboat/cli-linux-x64": "0.11.3"
   },
   "engines": {
     "node": ">=18"