merge: resolve conflict with main, keep both tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bartlomieju

.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Deno
         uses: denoland/setup-deno@v2

.github/workflows/post_publish.yml

@@ -11,18 +11,18 @@ jobs:
     if: github.repository == 'denoland/fresh'
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Authenticate with Google Cloud
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           project_id: denoland
           credentials_json: ${{ secrets.GCP_SA_KEY }}
           export_environment_variables: true
           create_credentials_file: true
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@v3
         with:
           project_id: denoland
 

.github/workflows/publish.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository_owner == 'denoland'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Deno
         uses: denoland/setup-deno@v2

docs/latest/advanced/partials.md

@@ -208,6 +208,66 @@ Partial updates can be animated using the browser's
 alongside `f-client-nav` to enable smooth animated transitions between pages
 with zero JavaScript animation code.
 
+## Loading indicators
+
+When a partial request is in flight, you may want to show a loading spinner or
+disable a button. Fresh supports this through the `_freshIndicator` property.
+
+Attach an object with a `value` property to any element that triggers a partial
+navigation. Fresh will set `value` to `true` when the request starts and back to
+`false` when it completes (or fails).
+
+```tsx
+import { useSignal } from "@preact/signals";
+
+function NavLink() {
+  const loading = useSignal(false);
+
+  return (
+    <a
+      href="/next-page"
+      f-partial="/partials/next-page"
+      ref={(el) => {
+        if (el) el._freshIndicator = loading;
+      }}
+    >
+      {loading.value ? "Loading..." : "Go"}
+    </a>
+  );
+}
+```
+
+This works for links, forms, and submit buttons. For form submissions, Fresh
+checks the submitter element (e.g. the clicked button) first, then falls back to
+the form element itself. This lets you show per-button indicators when a form
+has multiple submit buttons.
+
+```tsx
+import { useSignal } from "@preact/signals";
+
+function MyForm() {
+  const saving = useSignal(false);
+
+  return (
+    <form action="/save" f-partial="/partials/save">
+      {/* indicator is on the button, not the form */}
+      <button
+        type="submit"
+        ref={(el) => {
+          if (el) el._freshIndicator = saving;
+        }}
+      >
+        {saving.value ? "Saving..." : "Save"}
+      </button>
+    </form>
+  );
+}
+```
+
+> [info]: Any object with a mutable `value` property works — Preact signals are
+> the most convenient choice because they automatically re-render the component
+> when the value changes.
+
 ## Bypassing or disabling Partials
 
 If you want to exempt a particular element from triggering a partial request

docs/latest/concepts/app.md

@@ -37,6 +37,23 @@ With `basePath: "/my-app"`, a route registered at `/about` will respond to
 mounted alongside other apps. The base path is available in handlers via
 `ctx.config.basePath`.
 
+### Reverse proxy support
+
+When running behind a reverse proxy (nginx, Caddy, etc.), set `trustProxy` to
+make `ctx.url` reflect the client-facing URL instead of the internal one:
+
+```ts
+const app = new App({ trustProxy: true });
+```
+
+With this enabled, Fresh reads `X-Forwarded-Proto` and `X-Forwarded-Host`
+headers and rewrites `ctx.url` accordingly. For example, if your proxy
+terminates TLS and forwards `X-Forwarded-Proto: https`, `ctx.url.protocol` will
+be `https:` instead of `http:`.
+
+> [warn]: Only enable `trustProxy` when your app is actually behind a trusted
+> reverse proxy. Untrusted clients could otherwise spoof these headers.
+
 All items are applied from top to bottom. This means that when you defined a
 middleware _after_ a `.get()` handler, it won't be included.
 

packages/fresh/src/app.ts

@@ -190,6 +190,7 @@ export class App<State> {
       root: ".",
       basePath: config.basePath ?? "",
       mode: config.mode ?? "production",
+      trustProxy: config.trustProxy ?? false,
     };
   }
 
@@ -392,6 +393,8 @@ export class App<State> {
       this.#onError,
     );
 
+    const trustProxy = this.config.trustProxy;
+
     return async (
       req: Request,
       conn: Deno.ServeHandlerInfo = DEFAULT_CONN_INFO,
@@ -400,6 +403,18 @@ export class App<State> {
       // Prevent open redirect attacks
       url.pathname = url.pathname.replace(/\/+/g, "/");
 
+      // Apply X-Forwarded-* headers when behind a reverse proxy
+      if (trustProxy) {
+        const proto = req.headers.get("x-forwarded-proto");
+        if (proto) {
+          url.protocol = proto + ":";
+        }
+        const host = req.headers.get("x-forwarded-host");
+        if (host) {
+          url.host = host;
+        }
+      }
+
       const method = req.method.toUpperCase() as Method;
       const matched = router.match(method, url);
       let { params, pattern, item: handler, methodMatch } = matched;

packages/fresh/src/build_cache.ts

@@ -11,6 +11,7 @@ export interface FileSnapshot {
   filePath: string;
   hash: string | null;
   contentType: string;
+  immutable?: boolean;
 }
 
 export interface BuildSnapshot<State> {
@@ -28,6 +29,7 @@ export interface StaticFile {
   contentType: string;
   readable: ReadableStream<Uint8Array> | Uint8Array;
   close(): void;
+  immutable?: boolean;
 }
 
 // deno-lint-ignore no-explicit-any
@@ -87,6 +89,7 @@ export class ProdBuildCache<State> implements BuildCache<State> {
       size: stat.size,
       readable: file.readable,
       close: () => file.close(),
+      immutable: info.immutable,
     };
   }
 }

packages/fresh/src/config.ts

@@ -11,6 +11,16 @@ export interface FreshConfig {
    * The mode Fresh can run in.
    */
   mode?: "development" | "production";
+  /**
+   * When enabled, Fresh will respect `X-Forwarded-Proto` and
+   * `X-Forwarded-Host` headers to construct `ctx.url`. Enable
+   * this when running behind a reverse proxy.
+   *
+   * Only enable `trustProxy` when your app is actually behind a trusted
+   * reverse proxy. Untrusted clients could otherwise spoof these headers.
+   * @default false
+   */
+  trustProxy?: boolean;
 }
 
 /**
@@ -27,6 +37,15 @@ export interface ResolvedFreshConfig {
    * The mode Fresh can run in.
    */
   mode: "development" | "production";
+  /**
+   * When enabled, Fresh will respect `X-Forwarded-Proto` and
+   * `X-Forwarded-Host` headers to construct `ctx.url`. Enable
+   * this when running behind a reverse proxy.
+   *
+   * Only enable `trustProxy` when your app is actually behind a trusted
+   * reverse proxy. Untrusted clients could otherwise spoof these headers.
+   */
+  trustProxy: boolean;
 }
 
 export function parseDirPath(

packages/fresh/src/dev/dev_build_cache.ts

@@ -438,6 +438,7 @@ export interface PendingStaticFile {
   pathname: string;
   filePath: string;
   hash: string | null;
+  immutable?: boolean;
 }
 
 export async function writeCompiledEntry(outDir: string) {
@@ -561,7 +562,13 @@ export async function prepareStaticFile(
   item: PendingStaticFile,
   outDir: string,
 ): Promise<
-  { name: string; hash: string; filePath: string; contentType: string }
+  {
+    name: string;
+    hash: string;
+    filePath: string;
+    contentType: string;
+    immutable?: boolean;
+  }
 > {
   const file = await Deno.open(item.filePath);
   const hash = item.hash ? item.hash : await hashContent(file.readable);
@@ -576,6 +583,7 @@ export async function prepareStaticFile(
         : item.filePath,
     ),
     contentType: getContentType(item.filePath),
+    immutable: item.immutable,
   };
 }
 

packages/fresh/src/middlewares/static_files.ts

@@ -89,7 +89,8 @@ export function staticFiles<T>(): Middleware<T> {
         (BUILD_ID === cacheKey ||
           url.pathname.startsWith(
             `${ctx.config.basePath}/_fresh/js/${BUILD_ID}/`,
-          ))
+          ) ||
+          file.immutable)
       ) {
         span.setAttribute("fresh.cache", "immutable");
         headers.append("Cache-Control", "public, max-age=31536000, immutable");