BeechCMS v0.6.1 — Release Notes

[fdemusso]

Released: July 10, 2026
Type: Patch — Bug Fixes & Security Hardening
Repository: fdemusso/BeechCMS
Closes: #184, #183, #182, #178, #139, #166, #162, #159, #136, #137, #134, #140, #158

---

Overview

v0.6.1 is a focused patch release that consolidates bug fixes and security hardening across the validation engine, authentication handlers, Kanban move operations, CORS configuration, rate-limiting, and query filters. It introduces depth and size bounds for json/tags branches, fixes the handling of explicit null values, restores correct top-level OR logic in engine query filters, and addresses all seven open findings from the security and validation audit tracked in 184.

All changes are non-breaking: no HTTP routes, public API payloads, or @beechcms/core barrel exports were modified. The full monorepo build and test suites (pnpm build && pnpm test) pass with zero TypeScript errors.

---

Bug Fixes

Validation Engine

• Explicit null rejection when allowNull: false — withEmptyPreprocessing previously passed explicit null through unchecked when the field's allowNull option was false. The value is now correctly rejected. (182)

• JSON and tags depth/size bounds — jsonOrTagsSchema accepted arbitrarily deep/large payloads with no cap, unlike the richtext branch. The schema is now split into jsonSchema (fail-fast size check + depth-guarded control-char stripping walk) and tagsSchema (z.array(z.string()) with a 100-item cap and per-tag cleanString/length checks). This prevents recursion errors and potential DoS on pathological inputs and also fixes the kanban-move.ts cast crash caused by non-string tag values. (183)

• Relation seed schema cached per idGenerator instance — compileSeedSchema always recompiled the full Zod tree for seeds with relation branches because the closure over idGenerator was skipping the cache entirely. The cache is now partitioned by idGenerator identity via WeakMap, and the single buildCacheKey() call is reused on cache miss. (178)

• isPlainObject rejects class instances — Date, Map, Set, and other class instances were accepted where a plain object was required. The proto-chain check now rejects anything whose prototype is not Object.prototype or null. (audit finding Devs #4, 184)

• isEffectivelyEmpty scoped to richtext branch only — A JSON field shaped as { type: 'doc', … } was misclassified as empty because the doc-root check was not gated on the actual branch type. (audit finding docs: aggiorna README e commento sicurezza login #3, 184)

• sanitizeRichtextJson wraps JSON.stringify in try/catch — Honors the documented "never throws" contract for the sanitizer. (audit finding Dashboard #7, 184)

• Depth guard added to gatherRichtextText — A RICHTEXT_MAX_DEPTH constant now prevents RangeError on pathological structures. (audit finding Dashboard #8, 184)

• Repeater sub-field required flag respects enforceRequiredFields — Sub-fields inside a repeater incorrectly ignored the enforceRequiredFields option. (audit finding Dashboard #5, 184)

• collectAssetListItems bounded to 100 items — MAX_ASSET_LIST_ITEMS = 100 cap prevents unbounded array processing. (audit finding Feature Request Algolia #10, 184)

• Clarified "no valid fields" error message — The error returned when a seed payload contains no recognized fields is now unambiguous. (audit finding Aggiornamento di Devs #1, 184)

API Query Filters

• Real OR-group support in engine filter query — logic: 'OR' was accepted and validated by the public API but every condition got mapped into its own FilterGroup; the engine always joined groups with AND, so OR silently returned narrower results. buildSelectQuery now honors a new filterLogic option to join top-level filter groups with OR while keeping conditions within a group AND-ed. status/search stay AND-ed regardless. (137)

Authentication

• Email lowercased on login to match signup normalization — Signup stored emails in lowercase, but login lookup was case-sensitive, permanently locking out users who typed their original casing. (158)
  (Note: this fix was tracked as auth: case-sensitive email lookup at login vs lowercase normalization at signup — user lockout #158 in the commit history and is included in this release.)

• Login min-length check aligned with setup/reset validation — validateLoginInput called trim() before the length check, rejecting passwords with trailing whitespace that setup and reset already accepted, permanently locking those users out. (159)

Kanban & Content

• Duplicate tags on Kanban move prevented — The server-side atomic swap in kanban-move.ts appended newValue without checking if withoutOld already contained it, causing duplicate tags on retried or cross-source moves. (140)

• Deleted card evicted from cache on 404 move — A stale cache entry for a deleted card was not cleared when a move operation returned 404, causing subsequent reads to serve ghost data. (139)

• findById wrapped in try/catch in kanbanPositionHandler — Unhandled exceptions from findById no longer crash the handler on invalid IDs. (136)

• Relation label read from flat row, not item.data — repository.findMany returns flat rows via rowToData — there is no .data property, so item.data[labelAlias] threw and was swallowed by the surrounding catch, leaving the relations map empty. (134)

CORS & Rate Limiting

• PATCH added to allowMethods; Idempotency-Key added to allowHeaders — Several endpoints (bulk, kanban-move, rename/retype, automation toggle, notifications read/unread) use PATCH, and the public API expects Idempotency-Key cross-origin. Both were missing from the CORS config, causing preflight failures for cross-origin clients. (166)

• Public rate-limit key now includes seed from request path — The key generator was not incorporating the request path, causing unrelated routes to share the same rate-limit bucket. (162)

---

Regression Tests Added

All seven audit findings from 184 are covered by new regression tests co-located with their respective source files (<filename>.test.ts). Additionally:

• logic: 'OR' filter group behavior verified end-to-end.
• Explicit null rejection with allowNull: false across all branch types.
• json/tags depth and size cap boundary cases.
• Duplicate-tag prevention on Kanban move retries.

---

Closed Issues

Issue	Title
184	Security & validation audit
183	JSON/tags depth and size bounds missing
182	Explicit null not rejected when allowNull: false
178	Relation seed schema not cached per idGenerator
166	CORS missing PATCH method and Idempotency-Key header
162	Public rate-limit key ignores request path
159	Login rejects passwords with trailing whitespace
158	Login case-sensitive email lookup
140	Duplicate tags on Kanban move
139	Deleted card not evicted from cache on 404 move
137	logic: 'OR' silently returns AND results
136	findById not guarded in kanbanPositionHandler
134	Relation label read from missing item.data property

---

Upgrade Notes

No migration steps are required. This release contains no schema changes, no new environment variables, and no breaking changes to the HTTP API or SDK surface.

Run the standard update procedure:

pnpm install
pnpm build

---

This discussion was created from the release BeechCMS v0.6.1 — Release Notes.