v0.1.0

What's Changed

• build(deps): Bump actions/checkout from 4.4.0 to 7.0.1 by @dependabot[bot] in #17
• build(deps): Bump imagesize from 0.13.0 to 0.15.0 by @dependabot[bot] in #18
• docs: security model, contributing guide, architecture, templates by @productdevbook in #19
• editor: escape API data before inserting it into the DOM by @productdevbook in #21
• ci: release binaries and GHCR image on tags by @productdevbook in #22
• test: property tests for every parser fed untrusted input by @productdevbook in #23
• ci: Playwright end-to-end suite for the browser side by @productdevbook in #20
• security: constant-time tokens, tenant quota, HTTP timeouts, cookie SameSite flag by @productdevbook in #33
• mdx: pages and content entries through the satteri-mdxjs crate by @productdevbook in #32
• content: read content.config.ts statically (glob base, file loader, date fields) by @productdevbook in #34
• security: caps and a deadline for Sass compilation by @productdevbook in #35
• api: tenant export and import as tar.gz by @productdevbook in #36
• islands: resolve package components for client:component-path by @productdevbook in #37
• islands: Vue and Svelte renderers with in-browser SFC compilation by @productdevbook in #41
• chat: streamed replies, saved conversations, screenshot tool by @productdevbook in #39
• preview: run endpoint routes (src/pages/*.ts) in the browser by @productdevbook in #38
• security: source size cap and a big-stack thread for the parsers by @productdevbook in #43
• metrics: Prometheus endpoint with compile latency histograms by @productdevbook in #40
• sfc: strip TypeScript from Vue and Svelte script blocks in the daemon by @productdevbook in #50
• ops: bound how many compiles run at once by @productdevbook in #53
• chat: window conversations, cap stored ones, and bound the screenshot tool by @productdevbook in #58
• preview: swap CSS in place instead of reloading by @productdevbook in #56
• preview: accept the token on every request so a framed preview works by @productdevbook in #49
• bases: reload at runtime, an optional watcher, and multi-node notes by @productdevbook in #59
• errors: stop serving a failed build as empty content by @productdevbook in #57
• docs: make every claim true of the code again by @productdevbook in #75
• store: contain base symlinks, and make a delete actually delete by @productdevbook in #77
• import: refuse a bomb before it lands, and never half-apply an archive by @productdevbook in #78
• security: a deadline on every compile, so one tenant cannot starve the rest by @productdevbook in #79
• build(deps): Bump docker/login-action from 3.7.0 to 4.6.0 by @dependabot[bot] in #68
• build(deps): Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #69
• build(deps): Bump docker/setup-qemu-action from 3.7.0 to 4.3.0 by @dependabot[bot] in #70
• build(deps): Bump docker/build-push-action from 6.19.2 to 7.3.0 by @dependabot[bot] in #72
• tests: one fixture constructor, so a new field stops breaking other people's branches by @productdevbook in #82
• build(deps): Bump docker/setup-buildx-action from 3.12.0 to 4.3.0 by @dependabot[bot] in #71
• ops: stop three paths from costing far more than the caller expects by @productdevbook in #81
• report what is actually true: restore failures, stale swaps, the endpoint census by @productdevbook in #80
• ratchets: scan the whole file, and say what the checks do not prove by @productdevbook in #84
• vue: support defineProps() by stripping types after compileScript by @productdevbook in #85
• preview: run the tenant's middleware by @productdevbook in #98
• editor: create, rename, delete and upload files by @productdevbook in #99
• store: decide and act under one lock, and report a torn delete by @productdevbook in #100
• content: cache it, bound it, and stop hiding 503s in the 500 bucket by @productdevbook in #102
• limits: bound the file count and the chat, and stop re-summing the overlay by @productdevbook in #103
• survive a panic, keep the runtime free, and say what is true about the flags by @productdevbook in #104
• record every write, and refuse one to a deleted tenant by @productdevbook in #105

New Contributors

• @dependabot[bot] made their first contribution in #17
• @productdevbook made their first contribution in #19

Full Changelog: https://github.com/productdevbook/sandbox-lite/commits/v0.1.0