Skip to main content

Release notes

GuildGate 1.1.1​

Validation and package boundary​

  • Kernel execution rejects action objects that were not created through defineAction() by the installed package instance.
  • Operator payload parsers reject unknown fields, non-plain objects, and the dangerous keys __proto__, constructor, and prototype.
  • The npm tarball excludes source maps, source files, tests, workflows, environment files, checksums, and internal review reports.
  • Packed-package verification installs the generated tarball into an empty consumer project, imports all 16 public export paths, and runs all 3 CLI help targets.
  • Release metadata, secret-pattern scanning, package contents, coverage, load regression, and the public API map are part of release:verify.

Publishing​

  • The publish workflow uses npm Trusted Publishing through GitHub Actions OIDC instead of a repository npm token.
  • The verify job creates one tarball; the publish job downloads and publishes that exact artifact.
  • Release tag, package version, unpublished-version status, Node.js version, and npm CLI prerequisites are checked before publication.

Compatibility​

This is a patch release. Adapter contract 1.1, action contract 1.0, and realtime contract 1.0 remain unchanged. Existing consumers do not need a migration unless they created action-shaped objects manually or sent undocumented operator payload fields.

GuildGate 1.1.0 · July 26, 2026​

Transactions and idempotency​

  • PostgreSQL commit was separated from post-commit callback execution.
  • Nested PostgreSQL work gained savepoints and scoped rollback.
  • Idempotency records gained reservation ownership and compare-and-set completion.
  • Action deadlines began returning at the configured response boundary.
  • reliability.maximumLateSettlementMs bounded late-settlement observation.

Stores, realtime, and operations​

  • Official stores began enforcing per-user session caps atomically.
  • Audit paging moved to an opaque (createdAt, id) cursor.
  • Redis cache retagging and tag cleanup became atomic.
  • Discord OAuth refresh gained a distributed single-flight lease.
  • WebSocket and Socket.IO began sharing payload, rate, subscription, activity, and backpressure controls.
  • Outbox claim leases, batch size, and dispatch concurrency were bounded.

See migration and versioning for the 1.0.0 to 1.1.x adapter changes.

Documentation site 0.4.1​

  • Dependency overrides pin patched transitive versions of brace-expansion, fast-uri, serialize-javascript, and uuid without changing the Docusaurus public configuration.
  • Documentation readers normalize UTF-8 BOM, LF, and CRLF input before frontmatter and search-index processing.
  • Generated search data is kept on LF line endings across Windows and Linux checkouts.
  • Production verification distinguishes live content checks from response headers controlled by the external Pages and js.org layer.

Documentation site 0.4.0​

  • English is the default locale at /; Turkish remains available under /tr/.
  • Former /en/ routes redirect to the matching English route without a redirect chain.
  • Locale, canonical, alternate-language, search-index, navbar, footer, and 404 checks were added to the build gate.
  • Release metadata is maintained in one site module and checked against package and documentation versions.
  • The browser verification console gained bounded tokenization, input, line, token, flag, and rate limits.
  • Console security checks cover executable APIs, network APIs, browser storage, dangerous object keys, HTML payloads, and secret-like text.
  • Light-theme search contrast and IDE-style code block colors remain in place.
  • Security-header requirements are documented separately from what GitHub Pages can prove at repository level.

Documentation site 0.3.3​

  • Turkish and English pages were aligned with the GuildGate 1.1.0 public surface.
  • Documentation was expanded for transaction finality, reservation ownership, hard deadlines, atomic session caps, audit cursors, Redis retagging, OAuth single-flight, Socket.IO parity, and bounded outbox delivery.
Last updated on