gridstart: v0.10.0

0.10.0 (2026-07-13)

Features

• add Cloudflare KV CacheProvider with explicit CACHE_PROVIDER selection (#194) (6afd82e)
• add DAST scanning against staging (#92) (60194e9)
• add Permissions-Policy header to server responses (#101) (#108) (da95cbc)
• add sync-staging.sh script to force-push main -> staging (#78) (65302e6)
• configurable cache layer with Redis/Upstash support (#41) (03f8e1a)
• Phase 6 Docs & Release (#44, #149, #150) (#201) (7c706a8)
• production deploy workflow with CALENDAR_FEEDS_LOCAL_JSON override (#105) (cc5d1c0)
• replace in-memory rate limiter with Redis-backed provider pattern (#141) (#170) (45f7ebb)
• validate upstream feed responses with Zod (#139) (#164) (f24e358)

Bug Fixes

• add missing PWA icon precaching and landing-page favicon links (#118, #114) (#173) (dd2c858)
• all-day events crash ICS export with invalid date format (#76) (3c75fa5)
• bump esbuild to 0.28.1 and wrangler to 4.100.0 (#67) (#69) (dcf9652)
• bump esbuild to 0.28.1 and wrangler to 4.100.0 (#67) (#69) (6d7c215)
• dast: remove invalid issue_label input for ZAP full scan (#122) (5836fe1)
• deduplicate MotoGP events when merging PulseLive API responses (#207) (388504e), closes #206
• detect SPA routes by Content-Type for Cache-Control and CSP (#166) (e158488)
• disable ZAP issue writing to prevent 403 error (#97) (c297337)
• ensure Content-Type is present on proxied asset responses (#129) (#134) (eb5854f)
• exclude /export.ics from SW navigation fallback (#75) (192c630)
• freeze Date in tests to prevent time-dependent failures (#52) (7c0a34b)
• override @babel/core to ^7.29.6 to fix CVE-2026-49356 (#89) (290101d)
• prevent browser caching of sw.js so SW updates propagate promptly (#177) (617fd2e)
• prevent deploy before CI passes and fix secret interpolation (#142, #143) (#179) (8a9cb33)
• remove unnecessary quotes from ZAP cmd_options (#94) (9bc2803)
• revert @cloudflare/workers-types to ^4.20260701.1 to resolve wrangler peer dep conflict (#200) (82781c5)
• route file writes through cp /dev/stdin to satisfy CodeQL js/http-to-file-access (#191) (11d8a73)
• set Cache-Control no-cache on sw.js to force SW update checks (#178) (335f195)
• set Cache-Control private to prevent edge caching of non-hashed assets (#136) (#172) (260c187)
• set Content-Type on JS assets via _headers file + harden Worker (#136) (#175) (dc5e2f8)
• use --config instead of -config for ZAP long options (#95) (3fd3395)
• validate feedsConfig at build time and guarantee deterministic event ordering (#148, #147) (#171) (116d7bb)
• wrap ZAP config options inside -z flag (#96) (ffbbc97)