shadlet 0.3.0

added

• ui.pydantic_form binds submissions to pydantic models, validates input on the server, and exposes field-level and form-level errors for reactive rendering.
• ui.DataTable supports server-driven pagination, sorting, search, and validated filters, so applications can query large datasets without sending every row to the browser.
• Context.start_task and Context.task_state provide session-owned asynchronous work with reactive progress, completion, failure, and cancellation state.
• App.upload registers multipart http upload routes with file and field access, size limits, multiple-file handling, origin checks, and optional application authentication.
• Context.query_state binds typed reactive state to URL query parameters, with parsing, serialization, and browser back/forward history support.
• python react extensions can be distributed as packages with shadlet.extensions entry points and bundled browser assets. the runtime discovers extensions, advertises them in the handshake, serves their declared assets, and loads namespaced components automatically; node.js is not required to run the installed application.
• shadlet create supports repeatable --var KEY=VALUE overrides and github-hosted templates, alongside the built-in minimal, dashboard, and landing-page templates.
• ci now includes a separately packaged extension-wheel integration test that runs without node.js and a playwright browser end-to-end suite for renderer and extension behavior.
• new guides cover forms, server-driven data tables, background tasks, query-parameter state, http uploads, react extensions, and project templates.

changed

• advanced the client/server wire protocol to version 2 for extension metadata and query-state URL updates; python and typescript validators now enforce the same contract.
• aligned the python package, runtime, renderer, templates, and release metadata at 0.3.0.
• expanded the react extensions guide with package and wheel layouts, manifests, component and event contracts, browser bundling, styling, security, compatibility, testing, and troubleshooting.
• expanded the changelog, README, configuration and cli references, limitations, and architecture documentation for the 0.3.0 APIs.
• the python test configuration uses httpx2 with starlette's test client, uses a repository-local pytest temporary directory, disables the filesystem cache provider, and treats warnings as errors.

fixed

• template manifests now apply declared variables and metadata, enforce min_shadlet, and reject malformed TOML, unknown sections or fields, invalid values, unused variables, and unknown overrides instead of silently ignoring them.
• shadlet create resolves built-in templates both from a source checkout and an installed wheel, renders project names and declared variables, reports template metadata, and cleans up only a destination it created when setup fails.
• github template fetching validates references and archive contents, rejects unsafe paths, links, duplicate entries and oversized extraction, and handles malformed archives as clear template errors.
• extension assets are restricted to their declared package root; unsafe paths and filesystem symlink escapes are rejected, and extension load or registration failures are surfaced rather than silently ignored.
• upload request limits and origin checks, websocket frame limits, disconnected renderer interactions, and production exception responses are enforced at their runtime boundaries.
• ci verifies python 3.11 through 3.14 and builds and inspects distributable packages.

removed

• removed template dependency metadata that was parsed but never installed; unsupported [dependencies] sections are rejected. generated project dependencies belong in pyproject.toml or package.json and are installed by the respective package manager.

verification

• python: 130 tests passed; mypy passed for 56 source files; pyright reported 0 errors, warnings, or informations.
• renderer: lint, formatting, and typecheck passed; all 19 renderer tests passed; production build succeeded with a non-blocking large-bundle advisory.
• docs: strict mkdocs build passed using the ci-compatible mkdocs 1.x toolchain.
• packaging: the 0.3.0 wheel and source distribution built and passed metadata checks; required renderer and template files were verified in the wheel; a clean wheel installation and installed shadlet create smoke test passed.
• release: the tag-triggered build, github release upload, and pypi publish jobs all succeeded.

see the changelog, react extensions guide, and the documentation for details.