Release core 0.7.3, server 0.8.3, and cli 0.10.0

changelog/cli/0.10.0.md

@@ -0,0 +1,24 @@
+---
+package: "@webjsdev/cli"
+version: 0.10.0
+date: 2026-06-01T12:00:00+05:30
+commit_count: 2
+---
+## Features
+
+- **`webjs vendor` command surface for importmap pinning** ([#105](https://github.com/webjsdev/webjs/pull/105)) [`4db2360`](https://github.com/webjsdev/webjs/commit/4db2360)
+  Brings Rails `importmap-rails` parity to the CLI. `webjs vendor pin [pkg]`
+  resolves bare npm specifiers and writes them to a committed
+  `.webjs/vendor/importmap.json`, with `unpin` / `list` to manage it.
+  `--from <provider>` selects the CDN (`jspm` default, plus `jsdelivr`,
+  `unpkg`, `skypack`) and persists the choice in the pin file so later
+  `update` runs stay on the same CDN. `webjs vendor audit` checks pinned
+  versions against the npm security-advisory endpoint and exits non-zero on
+  any CVE; `webjs vendor outdated` lists pinned packages trailing their
+  registry `latest`; `webjs vendor update` re-resolves the outdated set.
+  `--download` caches the bundles under `.webjs/vendor/` for offline serving.
+
+- **direct jspm.io vendor resolution (Rails-style no-build)** ([#89](https://github.com/webjsdev/webjs/pull/89)) [`988b37b`](https://github.com/webjsdev/webjs/commit/988b37b)
+  Adds the first `webjs vendor pin` path and the scaffold wiring behind it,
+  resolving npm dependencies to CDN URLs at serve time with no bundler, so a
+  freshly scaffolded app can pin its vendor dependencies out of the box.

changelog/core/0.7.3.md

@@ -0,0 +1,23 @@
+---
+package: "@webjsdev/core"
+version: 0.7.3
+date: 2026-06-01T12:00:00+05:30
+commit_count: 2
+---
+## Fixes
+
+- **client router no longer intercepts JS-handled links** ([#157](https://github.com/webjsdev/webjs/pull/157)) [`c70860b`](https://github.com/webjsdev/webjs/commit/c70860b)
+  The router's click listener ran in the capture phase, ahead of a
+  component's own `@click` handler, so a link whose handler calls
+  `e.preventDefault()` was still hijacked and SPA-navigated. The listener
+  is now registered in the bubble phase, so the router sees
+  `event.defaultPrevented` and leaves the link alone. Plain `<a href>`
+  links are still SPA-navigated as before.
+
+- **client router no longer intercepts JS-handled forms** ([#151](https://github.com/webjsdev/webjs/pull/151)) [`7d84355`](https://github.com/webjsdev/webjs/commit/7d84355)
+  The submit listener had the same capture-phase bug: a form that handles
+  submission in JS (`@submit=${e => { e.preventDefault(); ... }}`, the live
+  chat and comment boxes) was hijacked by the router, which navigated the
+  page and dropped the just-sent message. The submit listener is now a
+  bubble listener too, so a preventDefaulted form keeps its submission and
+  the router stays out of it.

changelog/server/0.8.3.md

@@ -0,0 +1,25 @@
+---
+package: "@webjsdev/server"
+version: 0.8.3
+date: 2026-06-01T12:00:00+05:30
+commit_count: 2
+---
+## Fixes
+
+- **modulepreload hints stay within the servable set** ([#161](https://github.com/webjsdev/webjs/pull/161)) [`04f6cef`](https://github.com/webjsdev/webjs/commit/04f6cef)
+  The SSR preload emitter (`transitiveDeps`) walked the module graph
+  differently from the source-serving authorization gate
+  (`reachableFromEntries`), so the framework emitted
+  `<link rel="modulepreload">` hints for URLs it then 404s. Two causes,
+  both fixed: the preload walk now stops at `.server.*` boundaries like the
+  gate (a server-only util reached through a server action is no longer
+  preloaded), and the import scanner masks string / template-literal
+  content so an `import` shown as example code inside an `html\`\`` template
+  is no longer mistaken for a real dependency. The preload set is now a
+  subset of the servable set by construction.
+
+- **`webjs check` no longer leaks a git env var across worktrees** ([#156](https://github.com/webjsdev/webjs/pull/156)) [`9a83ea2`](https://github.com/webjsdev/webjs/commit/9a83ea2)
+  The check-ignore lookup inherited a `GIT_*` environment variable that, in
+  a git worktree, pointed at the parent checkout, so ignore resolution ran
+  against the wrong directory. The lookup now runs with a clean env scoped
+  to the target repo.

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/cli",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "type": "module",
   "description": "webjs CLI - dev, start, create, db",
   "bin": {

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/core",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "type": "module",
   "description": "webjs core runtime - html/css tags, WebComponent base, isomorphic renderers",
   "types": "./index.d.ts",

packages/create-webjs/package.json

@@ -11,7 +11,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@webjsdev/cli": "^0.9.0"
+    "@webjsdev/cli": "^0.10.0"
   },
   "publishConfig": {
     "access": "public"

packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

packages/webjsdev/package.json

@@ -11,7 +11,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@webjsdev/cli": "^0.9.0"
+    "@webjsdev/cli": "^0.10.0"
   },
   "publishConfig": {
     "access": "public"