Fusion Framework — State Management Module, Context Navigation Plugin & Security Fixes 🚀

[odinr]

This release ships a brand-new reactive state management module with optional
CouchDB/PouchDB sync, a new context-navigation plugin that decouples URL routing
from the context module, and a batch of Dependabot security fixes across
module-state and the CLI/dev-portal/dev-server build output.

🗄️ New: @equinor/fusion-framework-module-state

@equinor/fusion-framework-module-state@1.0.0 introduces reactive state
management with built-in synchronization and a comprehensive event system.

• PouchDbSyncStorage — bidirectional sync with a remote CouchDB, with
  configurable heartbeat, retry, and timeout options.
• Event system — StateEntryCreatedEvent / Updated / Deleted, plus
  StateSyncChangeEvent / CompleteEvent / ErrorEvent / StatusEvent,
  dispatched through the app's event module so onStateSync.* listeners
  registered via useAppModule('event').addEventListener(...) actually fire.
• StateProvider — reactive, observable-backed state management with a
  pluggable storage interface.

@equinor/fusion-framework-app@12.0.0 adds enableState (importable from
./enable-state) to wire the module into an app with app-scoped storage
key prefixing.

@equinor/fusion-framework-react-app@13.0.0 adds the consumer-facing hooks:

import { enableAppState } from '@equinor/fusion-framework-react-app/state';

export const configure = (configurator) => {
  enableAppState(configurator);
};

import { useAppState, useStateSyncEvents } from '@equinor/fusion-framework-react-app/state';

const [count, setCount] = useAppState('counter', { defaultValue: 0 });
const events = useStateSyncEvents(20);

useAppState is a persistent, cross-component-synchronized drop-in for
useState, backed by the module's storage. useStateSyncEvents returns the
most recent sync events (oldest first, bounded to limit).

The app-react-state cookbook was merged with app-react-state-replication
into one comprehensive example covering the full surface — basics, object/list
state, and optional CouchDB replication (unset FUSION_SPA_COUCHDB_URL and it
runs with zero Docker setup).

Note: all of the above require the optional peer dependency
@equinor/fusion-framework-module-state.

🧭 New: Context Navigation Plugin

@equinor/fusion-framework-plugin-context-navigation@0.1.0 is a new
adapter-based, event-driven plugin that reconciles context selection with the
browser URL for portal hosts. Ships with query-param, path-segment, and
custom-URL adapters, plus two pre-wired source strategies:

• app-first — the app sets context, the plugin encodes it to the URL.
• context-first — the plugin decodes context from the URL on startup,
  redirecting to a configurable null-context URL when no context resolves.

import { enableContextNavigation } from '@equinor/fusion-framework-plugin-context-navigation';
import { createAppFirstSource } from '@equinor/fusion-framework-plugin-context-navigation/sources';

enableContextNavigation(configurator, (builder) => {
  builder.setSourceFactory(createAppFirstSource());
});

@equinor/fusion-framework-module-context@8.0.2's resolveInitialContext no
longer resolves context from the URL path itself — that responsibility moved
to the plugin. Migration: apps don't need to change anything; portal hosts
should enable @equinor/fusion-framework-plugin-context-navigation to restore
URL-based context resolution.

@equinor/fusion-framework-dev-portal@9.0.0 now uses the plugin instead of an
ad-hoc hook-based approach.

@equinor/fusion-framework-module-navigation@7.0.7 fixes basename boundary
matching (/apps/my-app no longer false-matches /apps/my-app-other/foo) and
trailing-slash handling, and replaces regex-based pathname normalization with
an iterative scan — closing a CodeQL-flagged ReDoS (Regular Expression Denial
of Service) vulnerability when processing user-controlled basename values.

🔒 Security & Dependency Maintenance

• module-state: happy-dom 18.0.1 → 20.8.9 — resolves Happy DOM VM
  context escape/RCE, ECMAScriptModuleCompiler code injection, and
  cross-origin cookie disclosure advisories (dev/test only).
• module-state: vitest ^2.0.5 → ^4.1.0 — resolves the Vitest UI server
  arbitrary file read/execute advisory (< 3.2.6).
• module-state: uuid ^11.0.3 → ^11.1.1 → ^14.0.1 — resolves a
  missing buffer bounds check advisory and aligns with the version used
  elsewhere in the monorepo.
• plugin-context-navigation: vitest ^3.1.1 → ^4.1.10, matching the
  monorepo-wide version.
• cli / dev-portal / dev-server: bumped pnpm.overrides for undici
  (< 7.29.0), brace-expansion (< 2.1.4), fast-uri (< 3.1.5), and
  postcss (<= 8.5.22) — these packages bundle their dependency tree via
  rollup/vite, so transitive overrides are changesetted even when only the
  root lockfile resolution moves.
• module: pinned explicit generic types on the reduce operator in
  createModuleConfigs so the accumulator type isn't inferred as unknown
  under TypeScript 7's stricter inference — this was breaking builds for
  consumers using composite project references.

📦 Released Packages

Package	Version	Type
@equinor/fusion-framework-module-state	1.0.0	major
@equinor/fusion-framework-cookbook-app-react-state	1.0.0	major
@equinor/fusion-framework-app	12.0.0	minor
@equinor/fusion-framework-react-app	13.0.0	minor
@equinor/fusion-framework-plugin-context-navigation	0.1.0	minor
@equinor/fusion-framework-cli	15.2.4	patch
@equinor/fusion-framework-cli-plugin-ai-base	4.0.8	patch (dep cascade)
@equinor/fusion-framework-cli-plugin-ai-chat	3.0.8	patch (dep cascade)
@equinor/fusion-framework-cli-plugin-ai-index	3.0.9	patch (dep cascade)
@equinor/fusion-framework-dev-portal	9.0.0	patch
@equinor/fusion-framework-dev-server	2.0.18	patch (dep cascade)
@equinor/fusion-framework	8.0.13	patch (dep cascade)
@equinor/fusion-framework-module-analytics	3.0.5	patch (dep cascade)
@equinor/fusion-framework-module-context	8.0.2	patch
@equinor/fusion-framework-module	6.1.2	patch
@equinor/fusion-framework-module-navigation	7.0.7	patch
@equinor/fusion-framework-module-telemetry	7.0.2	patch (dep cascade)
@equinor/fusion-framework-module-widget	16.0.5	patch (dep cascade)
@equinor/fusion-framework-vite-plugin-spa	4.0.16	patch (dep cascade)
@equinor/fusion-framework-cookbook-app-react-ag-grid	2.0.11	patch (dep cascade)
@equinor/fusion-framework-cookbook-app-react-context	5.0.6	patch (dep cascade)
@equinor/fusion-framework-cookbook-app-react-context-custom-error	5.0.6	patch (dep cascade)
@equinor/fusion-framework-cookbook-app-react-feature-flag	2.0.5	patch (dep cascade)
poc-portal	1.1.93	patch (dep cascade)
portal	0.1.78	patch (dep cascade)
portal-analytics	0.4.46	patch (dep cascade)

🔗 Key PRs

• State management module — #3286
• Context navigation plugin — #4751
• happy-dom security bump — #5215
• vitest bump (module-state) — #5217
• undici/brace-expansion/fast-uri/postcss/uuid overrides — #5218
• vitest bump (context-navigation) — #5222
• uuid bump to 14 — #5223
• Release PR — #5210

🤖 Bip Bop — Release notes assembled by Fusion Assistant. Your state, now with
less hand-rolled sync code.