v0.1.2 — Toast dismiss race fix
Fixed
- A dismiss (click or very short delay) racing the
connect()animation frame could re-add the fade-in class after removal, leaving the toast stuck visible with no timer. The pending frame is now cancelled indismiss()anddisconnect().
Added
- 14 Vitest/jsdom tests for both Stimulus controllers, security paths first: tampered cookie payload rendered as inert text (no XSS), cookie cleared before rendering, no replay on Turbo cache restores, type filtering, malformed payload handling,
roleby toast type — plus fade-in/auto-dismiss/click behavior - CI now runs the JS test suite (node 22)
Full changelog: v0.1.1...v0.1.2