shadlet 0.5.0

shadlet 0.5.0 adds a complete generated Lucide icon catalogue, local file storage for uploads, stronger runtime and path protections, and expanded extension build tooling.

added

• ui.icons exposes all 1,951 Lucide icon names (1,702 unique shapes), generated from lucide-react 0.577.0 and lazy-loaded in the browser. Icon, Button, MenuItem, TabItem, and SidebarItem validate icon names.
• LocalStorage supports safe relative keys, atomic and streaming writes, overwrite control, traversal checks, and size limits. UploadedFile adds safe_filename and save_to(storage, key=...).
• WebConfig adds max_event_payload_bytes, max_tree_nodes, and max_tree_depth limits.
• Extension manifests add validated description, requires_shadlet, and components metadata. shadlet extension build builds and validates browser assets; shadlet extension info reports manifest and asset metadata.
• Renderer component errors recover when subtree content changes, and loading buttons expose aria-busy.
• Added an icon guide and a 0.4.0-to-0.5.0 migration guide.

changed

• Request paths are percent-decoded exactly once; malformed or unsafe paths are rejected before route matching. Invalid routes and navigation requests use generic production responses, with details available in debug mode and logs.
• Extension scaffolds now pin a compatible Shadlet minor range and include manifest metadata.
• Versions are aligned at 0.5.0 across Python, the renderer, protocol fixtures, templates, and documentation; Lucide ISC and Feather MIT notices are included in distributions.

fixed

• Route parameters are no longer decoded twice.
• Unknown icons now fail explicitly instead of rendering an unrelated fallback.
• Storage rejects Windows drive and alternate-stream syntax, trailing dots or spaces, and symlink escapes as well as POSIX traversal.

verification

• Python: Ruff lint and formatting, mypy, and Pyright passed; all 176 pytest tests passed.
• Renderer: ESLint, Prettier, and TypeScript checks passed; all 29 Vitest tests passed; the production build succeeded.
• Browser: all 12 Playwright tests passed across Chromium, Firefox, and WebKit, including icons, component recovery, extension loading, DataTable search, and representative WCAG 2.1 A/AA axe checks.
• Documentation: strict MkDocs build passed.
• Extension smoke test: extension create followed by extension build installed dependencies, built assets, and passed validation with no npm audit vulnerabilities.
• Packaging: wheel and source distribution built at 0.5.0. A clean Python 3.11 wheel installation rendered an app and reported renderer ready without Node.js.
• GitHub Actions: the release workflow built the distributions, uploaded them to the GitHub release, and published to PyPI. The release-commit CI Docker deployment-example job failed; that job passed in the follow-up main CI run for ac4c917.

See the changelog, migration guide, icons guide, documentation, and PyPI package.