Skip to content

FormLogic v0.1.12

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 13:20
· 121 commits to main since this release
v0.1.12
d59b89c

FormLogic 0.1.12 moves to Softn v0.0.25 on ZIPP v0.0.29, closes a round of access and billing holes, and takes the pending dependency updates.

Before you update

  • PayPal webhook. Subscribe the webhook (/api/billing/webhook/paypal) to PAYMENT.CAPTURE.COMPLETED, .REFUNDED, .REVERSED, .DECLINED and .DENIED. Without the refund and reversal events, a refunded payment keeps the time it bought. See DEPLOYMENT.md.
  • Behind a reverse proxy, set TRUSTED_PROXY_HEADER to the one header your proxy writes the client address into (x-forwarded-for, x-real-ip or client-ip). Unset keeps the old order of headers, in which a client could choose the address it is limited and logged as; a misspelt value trusts none. IPv6 clients are now rate-limited by their /64, so IPv6 counters start again.
  • Package exports made before this release carry no record of the account that exported them, so they import as community (an untrusted screen) even into their own account, and REQUIRE_VERIFIED_PACKAGES refuses them. Apps already stored as verified stay as they are. Export again from 0.1.12 for a verified round trip.
  • Members-only native apps start with empty browser storage for each member: what such an app kept in the browser before is not handed to any account. Archived native apps no longer run, for their owner either; draft previews still do. See docs/NATIVE_RUNTIME_SESSION_ISOLATION.md.

What's new

  • Softn v0.0.25. The app runtime, Builder and Studio that FormLogic embeds are the v0.0.25 release (from v0.0.19): an app's page may be written as HTML, with every existing .ui and .logic app reading as before; an app's styles stay inside the app; softn.net.fetch sends no cookies or referring address, and net without allowed_hosts no longer reaches this computer or its local network; local AI runs GGUF models on ZIPP; and logic that opens with "use strict" runs strict. See the Softn v0.0.25 notes.
  • ZIPP v0.0.29. The script engine, in the browser and in the server sandbox, is 6.57 MB (about 1.6 MB with Brotli). An error's stack now counts from the app's own logic.
  • Native apps keep each account's data apart. A members-only native app's browser data is kept per installation and account, and an app runs only for the account the server admitted it for: signing out, an expired session or switching accounts clears the departing account's data, and other tabs follow. An app on Softn v0.0.21 or later is told when its writes are stored.
  • Offline submissions. A queued submission survives maintenance, waits however long the server cannot be reached, and resumes when the form is reopened; one that failed can be sent again or discarded, and none stays on the device for good. A submission answered by a Wi-Fi sign-in page is no longer taken as sent.
  • Python apps keep their client imports and public package declarations when they are imported or edited.
  • Dates from the server are read as UTC everywhere, so they show the right time, and Safari shows them at all.

Security and access

  • Members: only the owner changes a member with an app-level role, and members no longer see drafts, forms they cannot open, or linked labels they may not read. Files, linked records, exports and app configs are held to what the caller may read.
  • Packages: this server's signature is trusted only for the account that exported the package, and an imported pack cannot bring consent or raw link targets with it.
  • Billing: a capture whose amount or currency differs from the order is not credited, and turning complimentary access off no longer ends paid months.
  • Installer: the database step runs before .env is written, an installed site's install step cannot replace .env from outside the server, an uninstalled site behind a local proxy is not open to every visitor, and a replaced .env is kept as a backup. It can be run again after a failed step.
  • Sign-in and AI tools: the per-account limit holds for every spelling of an address, "Ask first" holds on the hosted path, scoped tokens stay inside their scope, and revoking a connection ends its grant.
  • Outbound requests and flows: the address checks know more reserved ranges, a flow's Host header or line break cannot reroute a request, and the flow key-value store is capped per app.
  • The server sandbox cannot stall on its child's output, reports itself unavailable when PHP cannot start processes, and storage/ is never served over HTTP.

Maintenance

  • Dependencies updated: React 19.3.1, framer-motion 14.3.0, lucide-react 1.59.0, ESLint 10.13.0, typescript-eslint 8.71.2, Vitest 5.0.5, jsdom 30.1.3, Playwright 1.64.1, @axe-core/playwright 4.14.0, PostCSS 8.5.30, uuid 14.0.3, @types/node 24.19.2 and PHPStan 2.3.1.
  • Three new DOMPurify advisories, reached through the code editor (Monaco), are fixed with DOMPurify 3.4.17.
  • On PHP 8.2, the once-an-hour warning about a client-address setting reads its marker's time from disk (8.2's touch() left the old time cached).
  • preact stays on its current major: custom screens run on it.

Tested with Softn v0.0.25 and the CLI of OAIY 0.1.9.

Full Changelog: v0.1.11...v0.1.12

Assets 3
Loading