vanilla-jet 1.6.0 → 1.6.1

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable project changes are documented in this file.
 
 The format follows a structure inspired by Keep a Changelog and semantic versioning.
 
+## [1.6.1] - 2026-06-29
+
+### Security
+
+- **Removed unused dependencies that carried known vulnerabilities:** `jsrsasign` (multiple high/critical
+  crypto advisories), `jwt-simple`, `blueimp-md5`, `js-beautify`, and `nodemon`. None were used by the
+  framework; this drops a large vulnerability + install-size footprint for consumers.
+
+### Added
+
+- **`settings.profile.static_cache_max_age`** (seconds, default `0`): sets `Cache-Control: public, max-age=N`
+  for NON-versioned static assets (images, fonts, animation JSON…), so they are reused across references
+  and reloads instead of revalidating every time. Versioned (`?v=`) assets stay `immutable`; `0` keeps the
+  previous `no-cache` behavior. Pairs with the service worker for clients without it (e.g. WebViews).
+
 ## [1.6.0] - 2026-06-29
 
 ### Added

package/framework/router.js

@@ -46,6 +46,10 @@ class Router {
     this.compressionFiles = [ 'vanilla.min.js', 'app.min.css' ];
     this.enablePrecompressedNegotiation = Boolean(server?.options?.enable_precompressed_negotiation);
     this.enableServiceWorker = Boolean(server?.options?.enable_service_worker);
+    // Cache-Control max-age (seconds) for NON-versioned static assets (images, fonts,
+    // animation JSON…). Lets the browser reuse them across references/reloads instead of
+    // revalidating each time. Versioned (?v=) assets stay immutable; 0 keeps no-cache.
+    this.staticCacheMaxAge = Number(server?.options?.static_cache_max_age) || 0;
 	}
 
 	routeToRegExp(route) {
@@ -284,6 +288,7 @@ class Router {
   }
 
   buildStaticHeaders(extHeader, candidates, contentEncoding, metadata, isImmutable) {
+    let obj = this;
     let staticHeaders = Object.assign({}, extHeader);
     if (contentEncoding) {
       staticHeaders['Content-Encoding'] = contentEncoding;
@@ -300,8 +305,13 @@ class Router {
       // This is the big win for clients without the service worker (e.g. native WebViews),
       // which otherwise revalidate every asset on every load.
       staticHeaders['Cache-Control'] = 'public, max-age=31536000, immutable';
+    } else if (obj.staticCacheMaxAge > 0) {
+      // Non-versioned assets (images, fonts, animation JSON…): cache for a while so they
+      // aren't re-fetched on every reference/reload. ETag/Last-Modified still allow a cheap
+      // 304 after expiry. Pick this when assets change rarely (e.g. a few days/weeks).
+      staticHeaders['Cache-Control'] = `public, max-age=${obj.staticCacheMaxAge}`;
     } else {
-      // Non-versioned assets: force revalidation to keep clients fresh without a hard reload.
+      // Default: force revalidation to keep clients fresh without a hard reload.
       staticHeaders['Cache-Control'] = 'no-cache, must-revalidate';
     }
     return staticHeaders;

package/framework/server.js

@@ -38,6 +38,7 @@ class Server {
       enable_precompressed_negotiation: false,
       enable_service_worker: false,
       defer_scripts: false,
+      static_cache_max_age: 0,
       request_timeout_ms: 30000,
       headers_timeout_ms: 35000,
       keep_alive_timeout_ms: 5000

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanilla-jet",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "VannilaJet framework",
   "main": "index.js",
   "bin": {
@@ -30,14 +30,9 @@
   },
   "homepage": "https://github.com/nalancer08/VanillaJet#readme",
   "dependencies": {
-    "blueimp-md5": "2.19.0",
     "chalk": "4.1.2",
     "html-minifier-terser": "7.2.0",
-    "js-beautify": "1.15.4",
-    "jsrsasign": "11.1.0",
-    "jwt-simple": "0.5.6",
     "minimist": "1.2.8",
-    "nodemon": "3.1.10",
     "nunjucks": "3.2.4",
     "underscore": ">= 1.12.x",
     "del": "^6.0.0",

package/test/router.test.js

@@ -48,6 +48,18 @@ test('isProtectedFile: blocks framework/external/node_modules and top-level file
   assert.equal(router.isProtectedFile('/public/scripts/vanilla.min.js'), false);
 });
 
+test('buildStaticHeaders: immutable for ?v=, max-age when configured, else no-cache', () => {
+  const meta = { size: 10, etag: 'W/"x"', lastModified: 'Mon, 01 Jan 2024 00:00:00 GMT' };
+  const plain = makeRouter();
+  assert.match(plain.buildStaticHeaders({}, [], '', meta, true)['Cache-Control'], /immutable/);
+  assert.match(plain.buildStaticHeaders({}, [], '', meta, false)['Cache-Control'], /no-cache/);
+
+  const cached = new Router({ options: { static_cache_max_age: 3600 } });
+  assert.match(cached.buildStaticHeaders({}, [], '', meta, false)['Cache-Control'], /max-age=3600/);
+  // Versioned still wins over max-age.
+  assert.match(cached.buildStaticHeaders({}, [], '', meta, true)['Cache-Control'], /immutable/);
+});
+
 test('mimes: serves common web fonts and icons', () => {
   const router = makeRouter();
   assert.equal(router.mimes['woff2'], 'font/woff2');