YunCMS 0.1.38: Native Flows, scripts and API-first automation

YunCMS 0.1.38 adds native Flows for reusable, API-driven automation and fixes password admission and Studio permission/interaction defects.

Native Flows

• Build independent trigger/operation graphs with success and failure branches, merging, saved positions and execution traces. Triggers include manual actions, native events, webhooks, UTC cron and child flows. Operations include native data access, conditions, transformations, HTTP/HTTPS requests, email and trusted JavaScript.
• Create and manage flows through REST. Portable JSON import/export preserves graph structure and literal script source, omits server ids/revisions/history and imports as an independent inactive flow. Preview import validates without persisting a definition.
• Grant filtered native yuncms_flows read access through the existing Permissions API or Studio. Read/export/history access and manual execution grants are independent. Creating, importing, editing, deleting and activating definitions requires Administrator access.
• Run trusted ESM or CommonJS scripts with installed Node/npm dependencies and native context.items() data services. Script execution is disabled by default; enable FLOWS_SCRIPTS_ENABLED only for trusted Flow administrators. Scripts have full server privileges and are not sandboxed. Install dependencies in the running project (/data/node_modules in the official Docker image).
• Browse a separate catalogue with server-side search, filters and 10/20-record pagination. Selected and new flows open dedicated wide editor pages; run history opens in a separate paginated modal with on-demand details. All controls support the eight Studio languages.

Fixes

• Native password changes consult cancellable admission before credential/session mutation, preserving verified accountability and managed transactions (#74).
• Ordinary Content users receive permission-scoped metadata and only their permitted actions (#75, #76).
• Closed inspectors stay closed after late saves; rapid edits preserve their values and keyboard focus; long headers keep Close reachable (#77, #79, #80).
• Saved graph nodes/connections retain measured state through reloads (#78).
• Queue lease cleanup avoids locking active unexpired jobs and conflicting with worker completion (#81).
• Real-worker acceptance uses readiness/polling barriers rather than assuming process or queue timing (#82). Pagination clears stale links immediately (#83); Flow history restores focus explicitly in WebKit (#84).
• The real UTC upgrade regression verifies the complete pending migration chain, physical Flow resources, legacy-session revocation, identity preservation and idempotent restart (#85).

Validation

Node.js 24: 662 fast regressions, 946 complete source tests and 120 strict real MySQL/API/Redis/migration/upgrade/Docker integration tests passed with zero failures or skips. Flow acceptance includes 52 unit/process checks, 33 native MySQL/API checks and 189 Playwright scenarios across Chromium, Firefox and WebKit with zero retries or skips. Flow tests use pure logic and actual database/network/process/browser execution, without service/database/clock/browser-network mocks.

All four accepted package tarballs passed a clean consumer installation and 32 native API checks. ARM64 and AMD64 candidates passed runtime/Studio/authorization checks and actual Flow JSON, role, native CRUD and ESM/CommonJS/npm script execution. Physical backup/restore is included in the strict gate. The secured React example passed 7 tests, 19 API/RBAC checks and 5 MCP checks; its AI checks use a labeled deterministic provider fixture and do not claim inference quality.

Published acceptance: all four canonical npm latest tags are 0.1.38, and downloaded package bytes match the accepted SHA-512 integrities. Clean registry installation, 32 API checks and the secured example passed. Docker 0.1.38 and latest resolve to sha256:789c52aa8b241b547c75158d7fac187a0cc2c88a1d08e661ac172e7046b7fe93 with ARM64/AMD64 SPDX SBOM and SLSA provenance. Both published architectures passed actual runtime, native authorization, Flow API/JSON/npm-script and physical backup/restore checks. Trivy 0.75.0 reported zero OS vulnerabilities on each architecture using the database updated 2026-10-15; complete reports and checksums are attached. npm production audit reported zero vulnerabilities.

Install @yunsoft/yuncms, @yunsoft/yuncms-core, @yunsoft/yuncms-api and @yunsoft/yuncms-extensions-sdk at 0.1.38, or use yunsoftofficial/yuncms:0.1.38. Review Flows, importable recipes, Docker and upgrades. Back up the database and local project state before upgrading, and apply native bootstrap/migrations before starting the new runtime.

Fixes #74, #75, #76, #77, #78, #79, #80, #81, #82, #83, #84 and #85. Main and dev are synchronized at the release commit; no new branch was created.