Skip to content

CHANGELOG.md

Latest commit

 

History

History
117 lines (97 loc) · 5.2 KB

CHANGELOG.md

File metadata and controls

117 lines (97 loc) · 5.2 KB
Raw

Changelog

All notable changes to PocketStack are documented here. The format is based on Keep a Changelog and this project follows Semantic Versioning.

Per-release detail lives under docs/release-notes/.

1.2.0 - 2026-07-18

Added

  • A self-contained composite GitHub Action that analyzes Compose pull requests, generates browser-compatible projects, deploys stable Cloudflare Pages branch aliases, updates one sticky PR comment, and writes the job summary.
  • Static compatibility, error, and closed-preview reports. Partial and blocked projects fail the check and never present arbitrary containers as working app previews.
  • Three complete showcase applications: Pocket Supply storefront (frontend + mock-http), Northstar sprint board (frontend + postgres-pglite), and Clearview analytics (static-web).
  • A showcase deployment workflow and a moving v1 Action tag maintained by the release workflow.

Changed

  • Reframed the website, README, and documentation around the pull-request workflow: add one Action and receive a static preview for every compatible Compose PR.
  • The release and Action workflows pin third-party Actions and Wrangler to reviewed revisions.

Security

  • Action analysis confines the Compose file, bind mounts, env_file entries, labeled assets, and symlink targets to the checked-out repository.
  • Fork and Dependabot pull requests analyze without receiving deployment secrets or a writable comment token.
  • Untrusted analysis content is length-capped and escaped before it reaches static HTML reports or GitHub-flavored Markdown.

1.1.1 - 2026-06-29

Documentation and internal-structure release. The CLI behaves identically to v1.1.0.

Added

  • Published documentation site (VitePress) at /docs/ with a new information architecture — getting-started, installation, CLI reference, concepts and glossary, troubleshooting, per-adapter guides, the manifest and service-URL references, and a developer guide.

Changed

  • Internal Go layout: split internal/compose into compose (model) and analyzer (analysis); renamed internal/staticdemo → internal/generator. Browser code (runtime, studio, site) moved under web/. Import paths changed; CLI behavior unchanged.
  • README slimmed and documentation deduplicated to single sources of truth.

1.1.0 - 2026-06-28

Added

  • extends: services are reported as an explicit, actionable blocker with a suggestion to flatten the service.
  • pocketstack analyze prints project-level warnings (COOP/COEP, network access, skipped profile services) in its default human-readable output.
  • "Compose Features" documentation; SECURITY.md supported-versions table and private vulnerability reporting channel.
  • CLI tests and regression tests for port ranges, image normalization, profile skipping, extends, and the WASI UTF-8 fix.

Changed

  • Services gated behind profiles: are skipped to match a default docker compose up; they no longer count toward or block readiness.
  • Browser runtime packages (WebContainer, PGlite, sql.js, Wasmer) loaded from public CDNs are version-pinned.
  • The GitHub Pages build skips missing demos/media with a warning instead of failing.

Fixed

  • Port ranges such as 3000-3005:3000-3005 no longer abort analysis.
  • Registry-qualified and Docker Hub official image names (docker.io/library/postgres:16, library/postgres, ghcr.io/org/app) now resolve to the correct adapter.
  • WASI fd_write decodes UTF-8 sequences split across iovec boundaries instead of corrupting them.
  • The PGlite query panel and bridge use exec so multi-statement SQL (insert …; select …;) runs, matching the SQLite adapter.

Security

  • The generated demo dashboard escapes service names and OpenAPI route data before rendering, preventing HTML/script injection from untrusted input.
  • PocketStack Studio sandboxes its uploaded-HTML preview iframe.
  • Frontend, mock-http, database, and WASI demos now surface honest failure messages for missing cross-origin isolation, file:// hosting, and CDN load failures.

1.0.3 - 2026-05-27

Refocused the product around browser-native readiness: analyze reports a readiness score, blockers, suggestions, and next steps; clearer primary unsupported reasons; conversion guide. See release notes.

1.0.2 - 2026-05-27

Hosted Studio, generated example demos, and the GitHub Pages site. See release notes.

1.0.1 - 2026-05-26

Hardening release. See release notes.

1.0.0 - 2026-05-26

Initial browser-native PocketStack release.