FormLogic v0.1.13

FormLogic 0.1.13 moves to Softn v0.0.27 on ZIPP v0.0.32, runs native apps without Node where Softn carries its runner, and takes the pending dependency updates.

Before you update

• Native apps run on softn-runner. On Linux and Windows x86-64 the API now runs native apps on softn-runner, which this release's Softn runtime carries, instead of Node; the native-hosting check says which one a server uses. Nothing needs setting up. Node still runs them on any other platform, or where FORMLOGIC_NATIVE_RUNNER=node asks for it. What an app's backend may notice is listed in softn-runner's README: among it, SQLite is 3.53.2 and keeps temporary data in memory, and softn.time.format ends some 262,000 years from year 0.
• On Linux, softn-runner locks itself down before it reads a request (Landlock and seccomp): it may read the app's own folder and write only in its database folder, and it cannot start a program, open a socket or signal another process. It needs no root, container or configuration; a kernel without Landlock still gets the seccomp filters.
• Native app SQL on either runner: a LIKE or GLOB pattern over 1,000 characters now fails its statement, and a request whose transaction SQLite ends under it (INSERT OR ROLLBACK) writes nothing more.
• The script engine is larger: 7.34 MB (about 1.8 MB with Brotli), downloaded once by a browser that opens a form with logic. It is still left out of the offline precache.

What's new

• Softn v0.0.27. The app runtime, Builder and Studio that FormLogic embeds are the v0.0.27 release (from v0.0.25). Among it: a template expression can no longer write onto the page's shared objects; an app writes the clipboard, saves a file or opens a file picker only from a press aimed at it; an app's stylesheet can no longer redraw the permission bar's words or open a picker over it; and the host's notices are drawn where an app's CSS cannot hide them. See the Softn v0.0.26 and v0.0.27 notes.
• ZIPP v0.0.32. The script engine, in the browser and in the server sandbox, is 0.0.32 (it was 0.0.29). An arrow function in a class method reads the method's own variable where that has the class's name, a typed array subclass's own methods are called, and String.prototype.normalize follows Unicode 18.0. Logic still has no WebAssembly and nothing of Node (process, require, Buffer), in the browser and in the server sandbox.
• Native apps without Node. softn-runner answers native app requests with the app's logic in ZIPP compiled to WebAssembly under wasmtime, and the API server needs no Node for them. Each runner and its licences are held to the digests the installed runtime records.

Security and access

• A link in place of a native app's database, or of its data or private folder, is refused (409) before the records view, record management, event dispatch, the backup or an update opens it, and no events are delivered from one. A link left there could otherwise have handed the app's owner another app's records.
• Build tools: zod 4.6.7 (high: memory exhaustion validating oversized collections), fast-uri 3.1.9 and serialize-javascript 7.1.4. All three are build-time only; nothing a server or browser loads changed.

Maintenance

• Dependencies updated: framer-motion 14.6.0, lucide-react 1.61.0, zustand 5.0.16, Vite 8.3.5, typescript-eslint 8.72.0, PostCSS 8.5.31 and PHPStan 2.3.2.
• The server sandbox is built from ZIPP v0.0.32's source with Rust 1.92.0, as before.
• preact stays on its current major: custom screens run on it.

Tested with Softn v0.0.27 and the CLI of OAIY 0.1.10.

Full Changelog: v0.1.12...v0.1.13