diff --git a/.changeset/authorize-file-replacement.md b/.changeset/authorize-file-replacement.md deleted file mode 100644 index c7337a61..00000000 --- a/.changeset/authorize-file-replacement.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -'@edgestore/server': patch -'@edgestore/shared': patch ---- - -Require `beforeDelete` to replace or overwrite existing files from the browser. - -Replacing a file deletes it, so a browser upload with `replaceTargetUrl`, or -with a `manualFileName` that matches an existing file, now runs the bucket's -`beforeDelete` on that file first. Replacement targets must be in the same -bucket. Without `beforeDelete` these uploads fail. Generated file names and -backend uploads are unchanged. - -Custom providers that let the browser choose file names should call the new -`authorizeOverwrite` request parameter with any file already at the key. diff --git a/.changeset/harden-context-cookie.md b/.changeset/harden-context-cookie.md deleted file mode 100644 index 8037d3b4..00000000 --- a/.changeset/harden-context-cookie.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -'@edgestore/server': patch ---- - -Harden the `edgestore-ctx` cookie against cross-site requests. - -- The cookie now defaults to `SameSite=Lax` and `HttpOnly`, and to `Secure` - when `NODE_ENV` is `production`. `cookieConfig.ctx.options` still overrides - each default; a frontend on a different site needs `sameSite: 'none'` and - `secure: true`. Browsers don't store `Secure` cookies over plain HTTP - (Safari not even on `localhost`), so set `secure: false` to test a production - build over HTTP. -- Requests with a body must use `Content-Type: application/json`, as - `@edgestore/react` already does. Other content types get a `400`. -- The encrypted context now expires with the cookie's `maxAge` instead of - always after 30 days. diff --git a/.changeset/update-cli-smol-toml.md b/.changeset/update-cli-smol-toml.md deleted file mode 100644 index 44d1c2a7..00000000 --- a/.changeset/update-cli-smol-toml.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@edgestore/cli": patch ---- - -Update `smol-toml` to 1.9.1 so a malformed or very large Codex `config.toml` can no longer hang the CLI (GHSA-7w5x-hrqm-74c2, GHSA-r4xh-jqrq-34v2). diff --git a/docs/package.json b/docs/package.json index 1689e024..5d1014db 100644 --- a/docs/package.json +++ b/docs/package.json @@ -14,8 +14,8 @@ }, "dependencies": { "@ai-sdk/react": "4.0.74", - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "@fumadocs/mdx-remote": "1.4.4", "@langfuse/otel": "5.10.1", "@langfuse/tracing": "5.10.1", diff --git a/examples/astro-basic/package.json b/examples/astro-basic/package.json index c7ae62da..683a2103 100644 --- a/examples/astro-basic/package.json +++ b/examples/astro-basic/package.json @@ -12,8 +12,8 @@ "dependencies": { "@astrojs/node": "11.0.2", "@astrojs/react": "6.0.1", - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "astro": "7.1.3", "react": "19.2.7", "react-dom": "19.2.7" diff --git a/examples/basic-access-control/package.json b/examples/basic-access-control/package.json index 10372e45..cbc783ec 100644 --- a/examples/basic-access-control/package.json +++ b/examples/basic-access-control/package.json @@ -9,8 +9,8 @@ "lint": "eslint --cache --report-unused-disable-directives src" }, "dependencies": { - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "next": "16.4.1", "react": "19.2.7", "react-dom": "19.2.7", diff --git a/examples/components/package.json b/examples/components/package.json index 4f553cc9..5720bb6f 100644 --- a/examples/components/package.json +++ b/examples/components/package.json @@ -9,8 +9,8 @@ "lint": "eslint --cache --report-unused-disable-directives src" }, "dependencies": { - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "@hookform/resolvers": "5.4.0", "@radix-ui/react-dropdown-menu": "2.1.6", "@radix-ui/react-label": "2.1.12", diff --git a/examples/express-basic/package.json b/examples/express-basic/package.json index 0b66ec9a..2ff4e06c 100644 --- a/examples/express-basic/package.json +++ b/examples/express-basic/package.json @@ -6,7 +6,7 @@ "dev": "dotenv -e .env.local -- tsx src/index.ts" }, "dependencies": { - "@edgestore/server": "^1.0.0", + "@edgestore/server": "^1.0.1", "cookie-parser": "1.4.7", "cors": "2.8.6", "express": "5.2.1" diff --git a/examples/fastify-basic/package.json b/examples/fastify-basic/package.json index 5aff786e..059cdc37 100644 --- a/examples/fastify-basic/package.json +++ b/examples/fastify-basic/package.json @@ -6,7 +6,7 @@ "dev": "dotenv -e .env.local -- tsx src/index.ts" }, "dependencies": { - "@edgestore/server": "^1.0.0", + "@edgestore/server": "^1.0.1", "@fastify/cookie": "11.1.2", "@fastify/cors": "11.3.0", "fastify": "5.10.0" diff --git a/examples/hono-basic/package.json b/examples/hono-basic/package.json index de3f0add..d4cea595 100644 --- a/examples/hono-basic/package.json +++ b/examples/hono-basic/package.json @@ -9,7 +9,7 @@ "start": "node dist/index.js" }, "dependencies": { - "@edgestore/server": "^1.0.0", + "@edgestore/server": "^1.0.1", "@hono/node-server": "2.0.11", "hono": "4.12.31" }, diff --git a/examples/next-advanced/package.json b/examples/next-advanced/package.json index 7ad4e044..29cbc35b 100644 --- a/examples/next-advanced/package.json +++ b/examples/next-advanced/package.json @@ -9,8 +9,8 @@ "lint": "eslint --cache --report-unused-disable-directives src" }, "dependencies": { - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "next": "16.4.1", "react": "19.2.7", "react-dom": "19.2.7", diff --git a/examples/next-basic-aws/package.json b/examples/next-basic-aws/package.json index 994399cd..dd849c44 100644 --- a/examples/next-basic-aws/package.json +++ b/examples/next-basic-aws/package.json @@ -12,8 +12,8 @@ "dependencies": { "@aws-sdk/client-s3": "3.1091.0", "@aws-sdk/s3-request-presigner": "3.1091.0", - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "next": "16.4.1", "react": "19.2.7", "react-dom": "19.2.7", diff --git a/examples/next-basic-with-intl/package.json b/examples/next-basic-with-intl/package.json index 7ce5699a..25610294 100644 --- a/examples/next-basic-with-intl/package.json +++ b/examples/next-basic-with-intl/package.json @@ -9,8 +9,8 @@ "lint": "eslint --cache --report-unused-disable-directives src" }, "dependencies": { - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "next": "16.4.1", "next-intl": "4.13.3", "react": "19.2.7", diff --git a/examples/next-basic/package.json b/examples/next-basic/package.json index 225d33ab..d1804ef0 100644 --- a/examples/next-basic/package.json +++ b/examples/next-basic/package.json @@ -9,8 +9,8 @@ "lint": "eslint --cache --report-unused-disable-directives src" }, "dependencies": { - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "next": "16.4.1", "react": "19.2.7", "react-dom": "19.2.7", diff --git a/examples/next-complete/package.json b/examples/next-complete/package.json index d333388f..3181e4cd 100644 --- a/examples/next-complete/package.json +++ b/examples/next-complete/package.json @@ -9,9 +9,9 @@ "lint": "eslint --cache --report-unused-disable-directives src" }, "dependencies": { - "@edgestore/react": "^1.0.0", - "@edgestore/sdk": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/sdk": "^1.0.1", + "@edgestore/server": "^1.0.1", "next": "16.4.1", "react": "19.2.7", "react-dom": "19.2.7", diff --git a/examples/remix-basic/package.json b/examples/remix-basic/package.json index c6cdff2e..50e0b481 100644 --- a/examples/remix-basic/package.json +++ b/examples/remix-basic/package.json @@ -10,8 +10,8 @@ "typecheck": "react-router typegen && tsc" }, "dependencies": { - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "@react-router/node": "8.2.0", "@react-router/serve": "8.2.0", "isbot": "5.2.1", diff --git a/examples/start-basic/package.json b/examples/start-basic/package.json index 40d0c8a4..0a68452d 100644 --- a/examples/start-basic/package.json +++ b/examples/start-basic/package.json @@ -10,8 +10,8 @@ "preview": "vite preview" }, "dependencies": { - "@edgestore/react": "^1.0.0", - "@edgestore/server": "^1.0.0", + "@edgestore/react": "^1.0.1", + "@edgestore/server": "^1.0.1", "@tanstack/react-router": "1.170.41", "@tanstack/react-start": "1.168.60", "@tanstack/router-plugin": "1.168.23", diff --git a/examples/vite-basic/package.json b/examples/vite-basic/package.json index c96ced1c..dce37b84 100644 --- a/examples/vite-basic/package.json +++ b/examples/vite-basic/package.json @@ -10,7 +10,7 @@ "preview": "vite preview" }, "dependencies": { - "@edgestore/react": "^1.0.0", + "@edgestore/react": "^1.0.1", "react": "19.2.7", "react-dom": "19.2.7" }, diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 132d46bb..1d20c025 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,13 @@ # @edgestore/cli +## 1.0.1 + +### Patch Changes + +- [#307](https://github.com/edgestorejs/edgestore/pull/307) [`394fded`](https://github.com/edgestorejs/edgestore/commit/394fdedc531a97d70212dda101dc4d821b2e1697) Thanks [@raviships](https://github.com/raviships)! - Update `smol-toml` to 1.9.1 so a malformed or very large Codex `config.toml` can no longer hang the CLI (GHSA-7w5x-hrqm-74c2, GHSA-r4xh-jqrq-34v2). +- Updated dependencies []: + - @edgestore/sdk@1.0.1 + ## 1.0.0 ### Major Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 680d1620..f7b6de51 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@edgestore/cli", - "version": "1.0.0", + "version": "1.0.1", "description": "Command-line interface for EdgeStore accounts and projects", "homepage": "https://edgestore.dev", "license": "MIT", @@ -48,7 +48,7 @@ "@babel/parser": "7.29.7", "@babel/types": "7.29.7", "@clack/prompts": "1.7.0", - "@edgestore/sdk": "1.0.0", + "@edgestore/sdk": "1.0.1", "@manypkg/find-root": "3.1.0", "@manypkg/get-packages": "3.1.0", "@napi-rs/keyring": "1.3.0", diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md index ec185a81..ec887813 100644 --- a/packages/react/CHANGELOG.md +++ b/packages/react/CHANGELOG.md @@ -1,5 +1,12 @@ # @edgestore/react +## 1.0.1 + +### Patch Changes + +- Updated dependencies [[`85791bb`](https://github.com/edgestorejs/edgestore/commit/85791bbfbaa2cd53ce9a23b13d656bc12c8393e7)]: + - @edgestore/shared@1.0.1 + ## 1.0.0 ### Major Changes diff --git a/packages/react/package.json b/packages/react/package.json index ae834622..4dfffd1f 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -1,6 +1,6 @@ { "name": "@edgestore/react", - "version": "1.0.0", + "version": "1.0.1", "description": "Upload files with ease from React/Next.js", "homepage": "https://edgestore.dev", "license": "MIT", @@ -72,7 +72,7 @@ "!**/__tests__" ], "dependencies": { - "@edgestore/shared": "1.0.0" + "@edgestore/shared": "1.0.1" }, "peerDependencies": { "react": ">=16.8.0", diff --git a/packages/sdk/CHANGELOG.md b/packages/sdk/CHANGELOG.md index da0757a7..c9506302 100644 --- a/packages/sdk/CHANGELOG.md +++ b/packages/sdk/CHANGELOG.md @@ -1,5 +1,9 @@ # @edgestore/sdk +## 1.0.1 + +No changes in this release. + ## 1.0.0 ### Major Changes diff --git a/packages/sdk/package.json b/packages/sdk/package.json index ecd77f6b..18ddf82e 100644 --- a/packages/sdk/package.json +++ b/packages/sdk/package.json @@ -1,6 +1,6 @@ { "name": "@edgestore/sdk", - "version": "1.0.0", + "version": "1.0.1", "description": "Official low-level TypeScript SDK for the EdgeStore API", "homepage": "https://edgestore.dev", "license": "MIT", diff --git a/packages/sdk/src/version.ts b/packages/sdk/src/version.ts index b8c79a0a..5bee0bb3 100644 --- a/packages/sdk/src/version.ts +++ b/packages/sdk/src/version.ts @@ -1,2 +1,2 @@ export const EDGE_STORE_PACKAGE_NAME = '@edgestore/sdk'; -export const EDGE_STORE_PACKAGE_VERSION = '1.0.0'; +export const EDGE_STORE_PACKAGE_VERSION = '1.0.1'; diff --git a/packages/server/CHANGELOG.md b/packages/server/CHANGELOG.md index eda9250a..3714510d 100644 --- a/packages/server/CHANGELOG.md +++ b/packages/server/CHANGELOG.md @@ -1,5 +1,37 @@ # @edgestore/server +## 1.0.1 + +### Patch Changes + +- [#309](https://github.com/edgestorejs/edgestore/pull/309) [`85791bb`](https://github.com/edgestorejs/edgestore/commit/85791bbfbaa2cd53ce9a23b13d656bc12c8393e7) Thanks [@raviships](https://github.com/raviships)! - Require `beforeDelete` to replace or overwrite existing files from the browser. + + Replacing a file deletes it, so a browser upload with `replaceTargetUrl`, or + with a `manualFileName` that matches an existing file, now runs the bucket's + `beforeDelete` on that file first. Replacement targets must be in the same + bucket. Without `beforeDelete` these uploads fail. Generated file names and + backend uploads are unchanged. + + Custom providers that let the browser choose file names should call the new + `authorizeOverwrite` request parameter with any file already at the key. + +- [#308](https://github.com/edgestorejs/edgestore/pull/308) [`83cba2a`](https://github.com/edgestorejs/edgestore/commit/83cba2acf21ab4999f8939dfe96dd09b57432ee3) Thanks [@raviships](https://github.com/raviships)! - Harden the `edgestore-ctx` cookie against cross-site requests. + + - The cookie now defaults to `SameSite=Lax` and `HttpOnly`, and to `Secure` + when `NODE_ENV` is `production`. `cookieConfig.ctx.options` still overrides + each default; a frontend on a different site needs `sameSite: 'none'` and + `secure: true`. Browsers don't store `Secure` cookies over plain HTTP + (Safari not even on `localhost`), so set `secure: false` to test a production + build over HTTP. + - Requests with a body must use `Content-Type: application/json`, as + `@edgestore/react` already does. Other content types get a `400`. + - The encrypted context now expires with the cookie's `maxAge` instead of + always after 30 days. + +- Updated dependencies [[`85791bb`](https://github.com/edgestorejs/edgestore/commit/85791bbfbaa2cd53ce9a23b13d656bc12c8393e7)]: + - @edgestore/shared@1.0.1 + - @edgestore/sdk@1.0.1 + ## 1.0.0 ### Major Changes diff --git a/packages/server/package.json b/packages/server/package.json index 7d8c1e78..343264f2 100644 --- a/packages/server/package.json +++ b/packages/server/package.json @@ -1,6 +1,6 @@ { "name": "@edgestore/server", - "version": "1.0.0", + "version": "1.0.1", "description": "Upload files with ease from React/Next.js", "homepage": "https://edgestore.dev", "license": "MIT", @@ -122,8 +122,8 @@ "!**/__tests__" ], "dependencies": { - "@edgestore/sdk": "1.0.0", - "@edgestore/shared": "1.0.0", + "@edgestore/sdk": "1.0.1", + "@edgestore/shared": "1.0.1", "@standard-schema/spec": "^1.1.0", "cookie": "^2.0.1", "jose": "^6.2.3", diff --git a/packages/server/src/version.ts b/packages/server/src/version.ts index c9753e97..a0ca13ec 100644 --- a/packages/server/src/version.ts +++ b/packages/server/src/version.ts @@ -1,2 +1,2 @@ export const EDGE_STORE_PACKAGE_NAME = '@edgestore/server'; -export const EDGE_STORE_PACKAGE_VERSION = '1.0.0'; +export const EDGE_STORE_PACKAGE_VERSION = '1.0.1'; diff --git a/packages/shared/CHANGELOG.md b/packages/shared/CHANGELOG.md index 67d6575f..d31b5d3b 100644 --- a/packages/shared/CHANGELOG.md +++ b/packages/shared/CHANGELOG.md @@ -1,5 +1,20 @@ # @edgestore/shared +## 1.0.1 + +### Patch Changes + +- [#309](https://github.com/edgestorejs/edgestore/pull/309) [`85791bb`](https://github.com/edgestorejs/edgestore/commit/85791bbfbaa2cd53ce9a23b13d656bc12c8393e7) Thanks [@raviships](https://github.com/raviships)! - Require `beforeDelete` to replace or overwrite existing files from the browser. + + Replacing a file deletes it, so a browser upload with `replaceTargetUrl`, or + with a `manualFileName` that matches an existing file, now runs the bucket's + `beforeDelete` on that file first. Replacement targets must be in the same + bucket. Without `beforeDelete` these uploads fail. Generated file names and + backend uploads are unchanged. + + Custom providers that let the browser choose file names should call the new + `authorizeOverwrite` request parameter with any file already at the key. + ## 1.0.0 ### Major Changes diff --git a/packages/shared/package.json b/packages/shared/package.json index 306df0aa..90d4c823 100644 --- a/packages/shared/package.json +++ b/packages/shared/package.json @@ -1,6 +1,6 @@ { "name": "@edgestore/shared", - "version": "1.0.0", + "version": "1.0.1", "description": "Upload files with ease from React/Next.js", "homepage": "https://edgestore.dev", "license": "MIT",