shadlet 0.7.0

shadlet 0.7.0 is a focused performance and verification release. it keeps protocol v2 and 0.6.x source compatibility while lazy-loading heavy renderer adapters and making component support claims checkable. this release does not claim complete parity with the current shadcn/ui catalogue.

added

• Chart, calendar/date picker, and carousel adapters now load with React.lazy behind a suspense boundary. Applications that do not use them no longer load Recharts, react-day-picker, date-fns, or embla-carousel on first paint. Predictable chart, calendar, and carousel chunk names are emitted through Vite.
• npm run check:bundle enforces entry-chunk, total-JavaScript, and required-lazy-chunk budgets in CI.
• Added a generated component compatibility matrix from the Python component classes, renderer registry, and coverage data. All 56 pinned upstream components have a Python type and renderer adapter; the matrix reports 0 missing entries and 24 Shadlet-only components, including layout primitives.
• Added ui.DirectionProvider, declarative ui.Toast backed by the sonner runtime used by Context.toast, and shadlet.layout.ScrollArea matrix coverage.
• Added regression tests for lazy chart, calendar, date picker, and carousel resolution, plus direction and declarative toast rendering.

changed

• The main renderer entry chunk fell from 1,590.49 kB to 1,060.3 kB minified, and from 483.47 kB to 327.9 kB gzip. The entry remains above Vite's 500 kB advisory threshold but is now covered by an explicit release budget.
• Versions are aligned at 0.7.0 across Python, the renderer, protocol fixtures, templates, and documentation. The wire protocol remains version 2.
• Added a 0.6.0-to-0.7.0 migration guide and linked the generated compatibility matrix from the documentation navigation.
• Compatibility entries remain marked partial where the upstream component exposes richer props, events, keyboard behavior, or accessibility semantics than Shadlet maps today.

compatibility and scope

• Shadlet 0.7.0 is intended to remain source-compatible with 0.6.x applications. See the migration guide.
• Sessions, background tasks, uploads, and extensions retain their documented process-local and trust boundaries.
• See the component catalogue, compatibility matrix, and limitations for the verified support boundaries.

verification

• Python: Ruff lint and formatting, mypy, and Pyright passed; all 214 pytest tests passed. GitHub CI passed its Python 3.11–3.14 test matrix.
• Renderer: ESLint, Prettier, and TypeScript checks passed; all 41 Vitest tests passed; the production build and check:bundle budget guard passed.
• Browser: all 12 Playwright tests passed across Chromium, Firefox, and WebKit. The CI browser end-to-end job passed.
• Compatibility: generate_matrix.py --check confirmed the committed matrix is current.
• Packaging: the release workflow built the wheel and source distribution and verified bundled renderer assets. A clean Python 3.11 wheel installation reported version 0.7.0 with renderer ready and no Node.js.
• Documentation: strict MkDocs build passed.
• Release: the GitHub release and PyPI publish jobs completed successfully. See the release workflow.

See the changelog, migration guide, compatibility matrix, documentation, and PyPI package.

shadlet 0.6.0

shadlet 0.6.0 is a focused compatibility and developer-experience release. it keeps protocol v2, adds runnable starter material and agent skills, and corrects semantic layout serialization and server-side table bounds. this release does not claim complete parity with the current shadcn/ui catalogue.

added

• ui.Marker renders semantic highlighted text, and ui.CodeBlock renders copyable, line-numbered plain code.
• Added settings, authentication-demo, CRUD-demo, and responsive landing-page templates, plus a guided set of runnable examples.
• Added ten maintained Agent Skills for application building, interface design, component and extension authoring, debugging, contribution, review, testing, releases, and migration. The repository validates skill metadata, links, and host mirrors.

changed

• Python as_ options for Box, Grid, and Text now serialize to the renderer's as prop. Box and Grid accept id for fragment navigation.
• Server-side DataTable page sizes are constrained to the validated 1–500 range.
• Built-in templates target Shadlet 0.6.0. The wire protocol remains version 2.

fixed

• Pytest now uses a unique writable temporary directory per process, with a repository-local fallback if the system temp directory is unavailable. This avoids concurrent Windows runs sharing the problematic .pytest-tmp path.

compatibility and scope

• Shadlet 0.6.0 is intended to remain source-compatible with 0.5.x applications. See the migration guide.
• The auth and CRUD templates are local demonstrations. They do not provide production identity, authorization, or database persistence.
• See the component catalogue and limitations for the verified support boundaries.

verification

• Python: pytest . -q passed with 210 tests; GitHub CI passed its Python 3.11–3.14 test matrix.
• Renderer: lint, formatting, TypeScript checks, Vitest tests, and production build passed in CI.
• Browser: Playwright end-to-end tests passed in Chromium, Firefox, and WebKit.
• Packaging: the release workflow built the wheel and source distribution and verified bundled renderer assets. The CI packaging job passed clean-wheel installation checks.
• Documentation: strict MkDocs build passed.
• Release: the GitHub release and PyPI publish jobs completed successfully. See the release workflow.
• The production renderer's main chunk remains above Vite's 500 kB advisory threshold; the recorded build measured 1,590.49 kB minified and 483.47 kB gzip.

See the changelog, examples, Agent Skills, documentation, and PyPI package.

shadlet 0.5.0

shadlet 0.5.0 adds a complete generated Lucide icon catalogue, local file storage for uploads, stronger runtime and path protections, and expanded extension build tooling.

added

• ui.icons exposes all 1,951 Lucide icon names (1,702 unique shapes), generated from lucide-react 0.577.0 and lazy-loaded in the browser. Icon, Button, MenuItem, TabItem, and SidebarItem validate icon names.
• LocalStorage supports safe relative keys, atomic and streaming writes, overwrite control, traversal checks, and size limits. UploadedFile adds safe_filename and save_to(storage, key=...).
• WebConfig adds max_event_payload_bytes, max_tree_nodes, and max_tree_depth limits.
• Extension manifests add validated description, requires_shadlet, and components metadata. shadlet extension build builds and validates browser assets; shadlet extension info reports manifest and asset metadata.
• Renderer component errors recover when subtree content changes, and loading buttons expose aria-busy.
• Added an icon guide and a 0.4.0-to-0.5.0 migration guide.

changed

• Request paths are percent-decoded exactly once; malformed or unsafe paths are rejected before route matching. Invalid routes and navigation requests use generic production responses, with details available in debug mode and logs.
• Extension scaffolds now pin a compatible Shadlet minor range and include manifest metadata.
• Versions are aligned at 0.5.0 across Python, the renderer, protocol fixtures, templates, and documentation; Lucide ISC and Feather MIT notices are included in distributions.

fixed

• Route parameters are no longer decoded twice.
• Unknown icons now fail explicitly instead of rendering an unrelated fallback.
• Storage rejects Windows drive and alternate-stream syntax, trailing dots or spaces, and symlink escapes as well as POSIX traversal.

verification

• Python: Ruff lint and formatting, mypy, and Pyright passed; all 176 pytest tests passed.
• Renderer: ESLint, Prettier, and TypeScript checks passed; all 29 Vitest tests passed; the production build succeeded.
• Browser: all 12 Playwright tests passed across Chromium, Firefox, and WebKit, including icons, component recovery, extension loading, DataTable search, and representative WCAG 2.1 A/AA axe checks.
• Documentation: strict MkDocs build passed.
• Extension smoke test: extension create followed by extension build installed dependencies, built assets, and passed validation with no npm audit vulnerabilities.
• Packaging: wheel and source distribution built at 0.5.0. A clean Python 3.11 wheel installation rendered an app and reported renderer ready without Node.js.
• GitHub Actions: the release workflow built the distributions, uploaded them to the GitHub release, and published to PyPI. The release-commit CI Docker deployment-example job failed; that job passed in the follow-up main CI run for ac4c917.

See the changelog, migration guide, icons guide, documentation, and PyPI package.

shadlet 0.4.0

shadlet 0.4.0 is a major runtime and release-readiness update. it expands the Python-first APIs, improves server-driven tables and accessibility, and adds extension tooling, deployment examples, and broader verification.

added

• ui.DataTable now supports controlled row selection, loading and error states, retry callbacks, per-column filters, column visibility, responsive scrolling, accessible sort announcements, and cancellation of superseded asynchronous server queries.
• shadlet extension create scaffolds a separately packaged Python and React extension. shadlet extension check validates its manifest and bundled assets.
• deployment examples include a multi-stage, non-root Docker image, a Render Blueprint, and a health check endpoint at GET /healthz.
• opt-in runtime benchmarks cover 10k-row table workloads, 1k-node rendering and protocol serialization, and concurrent updates across 50 sessions.
• representative axe-core accessibility checks and Chromium Playwright flows cover forms, feedback, tables, packaged extensions, URL state, and server-side table search.
• app.run() recognizes the platform PORT environment variable, with documented precedence and validation.

changed

• React protocol validation now uses Zod 4; the renderer development server is updated to Vite 7.3.7.
• extension discovery now registers transactionally and remains idempotent after success.
• pydantic form validation preserves multiple messages associated with the same field.
• built-in project templates now target Shadlet 0.4.0.

fixed

• server-side table search reliably dispatches changed queries to Python.
• closed sessions reject newly started background tasks without leaving them marked as running.
• form labels and controls now have improved accessible-name and id associations, including slider inputs and date-picker triggers.

verification

• Python: Ruff lint and formatting, mypy, and Pyright passed; all 145 pytest tests passed.
• renderer: ESLint, Prettier, and TypeScript checks passed; all 27 Vitest tests and all 3 Playwright tests passed; the production build succeeded.
• documentation: strict MkDocs build passed.
• packaging: wheel and source distribution built; renderer assets and built-in templates were verified in the wheel; an isolated wheel installation smoke test passed.
• dependencies: production npm audit --omit=dev reported zero vulnerabilities.
• GitHub CI, including the Docker deployment-example build, passed for the release commit. the tag-triggered release workflow successfully published both distributions to this GitHub release and PyPI.

see the changelog, documentation, and PyPI package.

shadlet 0.3.0

added

• ui.pydantic_form binds submissions to pydantic models, validates input on the server, and exposes field-level and form-level errors for reactive rendering.
• ui.DataTable supports server-driven pagination, sorting, search, and validated filters, so applications can query large datasets without sending every row to the browser.
• Context.start_task and Context.task_state provide session-owned asynchronous work with reactive progress, completion, failure, and cancellation state.
• App.upload registers multipart http upload routes with file and field access, size limits, multiple-file handling, origin checks, and optional application authentication.
• Context.query_state binds typed reactive state to URL query parameters, with parsing, serialization, and browser back/forward history support.
• python react extensions can be distributed as packages with shadlet.extensions entry points and bundled browser assets. the runtime discovers extensions, advertises them in the handshake, serves their declared assets, and loads namespaced components automatically; node.js is not required to run the installed application.
• shadlet create supports repeatable --var KEY=VALUE overrides and github-hosted templates, alongside the built-in minimal, dashboard, and landing-page templates.
• ci now includes a separately packaged extension-wheel integration test that runs without node.js and a playwright browser end-to-end suite for renderer and extension behavior.
• new guides cover forms, server-driven data tables, background tasks, query-parameter state, http uploads, react extensions, and project templates.

changed

• advanced the client/server wire protocol to version 2 for extension metadata and query-state URL updates; python and typescript validators now enforce the same contract.
• aligned the python package, runtime, renderer, templates, and release metadata at 0.3.0.
• expanded the react extensions guide with package and wheel layouts, manifests, component and event contracts, browser bundling, styling, security, compatibility, testing, and troubleshooting.
• expanded the changelog, README, configuration and cli references, limitations, and architecture documentation for the 0.3.0 APIs.
• the python test configuration uses httpx2 with starlette's test client, uses a repository-local pytest temporary directory, disables the filesystem cache provider, and treats warnings as errors.

fixed

• template manifests now apply declared variables and metadata, enforce min_shadlet, and reject malformed TOML, unknown sections or fields, invalid values, unused variables, and unknown overrides instead of silently ignoring them.
• shadlet create resolves built-in templates both from a source checkout and an installed wheel, renders project names and declared variables, reports template metadata, and cleans up only a destination it created when setup fails.
• github template fetching validates references and archive contents, rejects unsafe paths, links, duplicate entries and oversized extraction, and handles malformed archives as clear template errors.
• extension assets are restricted to their declared package root; unsafe paths and filesystem symlink escapes are rejected, and extension load or registration failures are surfaced rather than silently ignored.
• upload request limits and origin checks, websocket frame limits, disconnected renderer interactions, and production exception responses are enforced at their runtime boundaries.
• ci verifies python 3.11 through 3.14 and builds and inspects distributable packages.

removed

• removed template dependency metadata that was parsed but never installed; unsupported [dependencies] sections are rejected. generated project dependencies belong in pyproject.toml or package.json and are installed by the respective package manager.

verification

• python: 130 tests passed; mypy passed for 56 source files; pyright reported 0 errors, warnings, or informations.
• renderer: lint, formatting, and typecheck passed; all 19 renderer tests passed; production build succeeded with a non-blocking large-bundle advisory.
• docs: strict mkdocs build passed using the ci-compatible mkdocs 1.x toolchain.
• packaging: the 0.3.0 wheel and source distribution built and passed metadata checks; required renderer and template files were verified in the wheel; a clean wheel installation and installed shadlet create smoke test passed.
• release: the tag-triggered build, github release upload, and pypi publish jobs all succeeded.

see the changelog, react extensions guide, and the documentation for details.

shadlet 0.2.0

added

• explicit websocket handshake: the browser sends hello, the server validates it, negotiates the protocol, then sends the initial render.
• token-based session restoration so reconnecting clients keep their state, with TTL expiry and session limits.
• origin validation with configurable allowed origins and a connection authentication hook (App(authenticate=...)).
• per-session event and message rate limiting, message size limits, handshake timeouts, and connection generation tracking.
• shared protocol fixtures validated by both pydantic and zod contract tests.
• renderer patch validation and automatic resynchronization when a patch or sequence fails.
• session manager tests covering isolation, restoration, expiry, and limits.
• dedicated security, deployment, session, and configuration documentation.

changed

• centralised the package version; pyproject.toml, the runtime, the CLI, and the renderer now agree on 0.2.0.
• renderer assets are served from /_shadlet_assets, so project /assets no longer shadows bundled renderer files.
• protocol schemas no longer include desktop messages; the renderer no longer contains desktop bridge code.
• session.refresh, toast delivery, and navigation tasks are tracked and cancelled when a session closes.
• websocket payloads are parsed with the shared pydantic models instead of ad-hoc dictionaries.
• ci now tests python 3.11, 3.12, 3.13, and 3.14 exactly once each and verifies a clean wheel install.

removed

• the reload server message, desktop_request, and desktop_result protocol messages.
• frozen/embedded desktop asset lookup from the web server.

fixed

• the first render is never sent before the client handshake is validated.
• non-root initial routes receive an init message instead of an out-of-order navigation message.
• state changes made while an event handler holds the session lock are no longer dropped.
• invalid, stale, duplicate, oversized, and rate-limited messages are rejected without corrupting session state.
• out-of-range insert/remove patches are rejected instead of silently splicing.
• reconnecting clients can restart their event sequence, and fatal protocol errors stop automatic reconnect loops.
• connected sessions are no longer expired by the idle-session sweep.
• queued toasts are retained when a reconnect happens during delivery.

shadlet 0.1.1

added

• python runtime with app lifecycle, components, state, events, and routing.
• versioned json protocol between python and react.
• react renderer with tailwind css and 56 shadcn/ui base-vega components.
• web runtime with starlette and websocket transport.
• typer and rich cli.
• github project template fetcher.
• mkdocs documentation website.
• examples: counter, todo, and dashboard.
• templates: minimal, dashboard, and landing-page.
• streamlit-tier hot reload with debounced file watching and granular diff patches.
• top banner showing reconnection status and manual reconnect action.
• pypi packaging readiness with embedded renderer distribution assets.

changed

• web-only framework architecture.
• cli streamlined to create, dev, run, doctor, info, and clean.
• prebuilt renderer bundled into wheel distribution.

fixed

• windows console utf-8 encoding on standard output and error streams.
• initial launch asset serving.
• port conflict auto-detection.
• dynamic module reload spec resolution.
• template and example rendering stability.