vanilla-jet 1.6.0 → 1.6.2

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable project changes are documented in this file.
 
 The format follows a structure inspired by Keep a Changelog and semantic versioning.
 
+## [1.6.2] - 2026-06-30
+
+### Fixed
+
+- **Template externalization now self-cleans:** disabling `externalize_templates` (or never enabling it)
+  removes any previously generated `public/scripts/templates.js` (+ `.gz`/`.br`), so toggling the flag
+  never leaves a stale 749 KB file behind (which the service worker would otherwise precache).
+
+### Notes
+
+- **`externalize_templates` caveat (WebView):** it shrinks the initial HTML for web browsers, but it injects
+  all templates via one synchronous `innerHTML`. On slower JS engines (native WebViews — WKWebView /
+  Android WebView) that block can stall the boot. **Prefer it OFF for apps loaded primarily inside a
+  WebView**; keep it ON only for pure-web apps that benefit from a smaller first byte.
+
+## [1.6.1] - 2026-06-29
+
+### Security
+
+- **Removed unused dependencies that carried known vulnerabilities:** `jsrsasign` (multiple high/critical
+  crypto advisories), `jwt-simple`, `blueimp-md5`, `js-beautify`, and `nodemon`. None were used by the
+  framework; this drops a large vulnerability + install-size footprint for consumers.
+
+### Added
+
+- **`settings.profile.static_cache_max_age`** (seconds, default `0`): sets `Cache-Control: public, max-age=N`
+  for NON-versioned static assets (images, fonts, animation JSON…), so they are reused across references
+  and reloads instead of revalidating every time. Versioned (`?v=`) assets stay `immutable`; `0` keeps the
+  previous `no-cache` behavior. Pairs with the service worker for clients without it (e.g. WebViews).
+
 ## [1.6.0] - 2026-06-29
 
 ### Added

package/framework/router.js

@@ -46,6 +46,10 @@ class Router {
     this.compressionFiles = [ 'vanilla.min.js', 'app.min.css' ];
     this.enablePrecompressedNegotiation = Boolean(server?.options?.enable_precompressed_negotiation);
     this.enableServiceWorker = Boolean(server?.options?.enable_service_worker);
+    // Cache-Control max-age (seconds) for NON-versioned static assets (images, fonts,
+    // animation JSON…). Lets the browser reuse them across references/reloads instead of
+    // revalidating each time. Versioned (?v=) assets stay immutable; 0 keeps no-cache.
+    this.staticCacheMaxAge = Number(server?.options?.static_cache_max_age) || 0;
 	}
 
 	routeToRegExp(route) {
@@ -284,6 +288,7 @@ class Router {
   }
 
   buildStaticHeaders(extHeader, candidates, contentEncoding, metadata, isImmutable) {
+    let obj = this;
     let staticHeaders = Object.assign({}, extHeader);
     if (contentEncoding) {
       staticHeaders['Content-Encoding'] = contentEncoding;
@@ -300,8 +305,13 @@ class Router {
       // This is the big win for clients without the service worker (e.g. native WebViews),
       // which otherwise revalidate every asset on every load.
       staticHeaders['Cache-Control'] = 'public, max-age=31536000, immutable';
+    } else if (obj.staticCacheMaxAge > 0) {
+      // Non-versioned assets (images, fonts, animation JSON…): cache for a while so they
+      // aren't re-fetched on every reference/reload. ETag/Last-Modified still allow a cheap
+      // 304 after expiry. Pick this when assets change rarely (e.g. a few days/weeks).
+      staticHeaders['Cache-Control'] = `public, max-age=${obj.staticCacheMaxAge}`;
     } else {
-      // Non-versioned assets: force revalidation to keep clients fresh without a hard reload.
+      // Default: force revalidation to keep clients fresh without a hard reload.
       staticHeaders['Cache-Control'] = 'no-cache, must-revalidate';
     }
     return staticHeaders;

package/framework/server.js

@@ -38,6 +38,7 @@ class Server {
       enable_precompressed_negotiation: false,
       enable_service_worker: false,
       defer_scripts: false,
+      static_cache_max_age: 0,
       request_timeout_ms: 30000,
       headers_timeout_ms: 35000,
       keep_alive_timeout_ms: 5000

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanilla-jet",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "VannilaJet framework",
   "main": "index.js",
   "bin": {
@@ -30,14 +30,9 @@
   },
   "homepage": "https://github.com/nalancer08/VanillaJet#readme",
   "dependencies": {
-    "blueimp-md5": "2.19.0",
     "chalk": "4.1.2",
     "html-minifier-terser": "7.2.0",
-    "js-beautify": "1.15.4",
-    "jsrsasign": "11.1.0",
-    "jwt-simple": "0.5.6",
     "minimist": "1.2.8",
-    "nodemon": "3.1.10",
     "nunjucks": "3.2.4",
     "underscore": ">= 1.12.x",
     "del": "^6.0.0",

package/scripts/compile_html.js

@@ -201,6 +201,10 @@ async function createHTMLFile(content, filePath) {
   // bundle (defer + document order), so views still find their templates in the DOM at boot.
   if (opts.externalize_templates) {
     minified = externalizeTemplates(minified);
+  } else {
+    // Feature off: remove any previously generated templates.js so a stale 749KB file
+    // isn't left behind (and isn't precached by the service worker).
+    removeStaleTemplatesFile();
   }
 
   const publicPath = path.join(processCwd(), '/public/pages');
@@ -218,6 +222,22 @@ async function createHTMLFile(content, filePath) {
   console.log(chalk.green(`Created gzipped version at: ${absolutePath}.gz`));
 }
 
+// -- Remove a previously generated public/scripts/templates.js (+ compressed siblings)
+// when externalization is disabled, so toggling the flag never leaves a stale file behind.
+function removeStaleTemplatesFile() {
+  const base = path.join(processCwd(), 'public', 'scripts', 'templates.js');
+  ['', '.gz', '.br'].forEach((ext) => {
+    try {
+      if (fs.existsSync(base + ext)) {
+        fs.unlinkSync(base + ext);
+        console.log(chalk.green(`VanillaJet - removed stale public/scripts/templates.js${ext}`));
+      }
+    } catch (err) {
+      // Non-fatal: never fail the build over cleanup.
+    }
+  });
+}
+
 // -- Move all <script type="text/template"> blocks out of the page into
 // public/scripts/templates.js (a tiny injector that adds them to the DOM). Returns the
 // page HTML with those blocks replaced by a single deferred <script> tag (placed where the

package/test/router.test.js

@@ -48,6 +48,18 @@ test('isProtectedFile: blocks framework/external/node_modules and top-level file
   assert.equal(router.isProtectedFile('/public/scripts/vanilla.min.js'), false);
 });
 
+test('buildStaticHeaders: immutable for ?v=, max-age when configured, else no-cache', () => {
+  const meta = { size: 10, etag: 'W/"x"', lastModified: 'Mon, 01 Jan 2024 00:00:00 GMT' };
+  const plain = makeRouter();
+  assert.match(plain.buildStaticHeaders({}, [], '', meta, true)['Cache-Control'], /immutable/);
+  assert.match(plain.buildStaticHeaders({}, [], '', meta, false)['Cache-Control'], /no-cache/);
+
+  const cached = new Router({ options: { static_cache_max_age: 3600 } });
+  assert.match(cached.buildStaticHeaders({}, [], '', meta, false)['Cache-Control'], /max-age=3600/);
+  // Versioned still wins over max-age.
+  assert.match(cached.buildStaticHeaders({}, [], '', meta, true)['Cache-Control'], /immutable/);
+});
+
 test('mimes: serves common web fonts and icons', () => {
   const router = makeRouter();
   assert.equal(router.mimes['woff2'], 'font/woff2');