Version Packages (#6)

github-actions[bot] · web-flow · commit 755f32a92fbd · 2026-03-02T23:56:12.000-03:00
Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]@users.noreply.github.com&gt;
diff --git a/.changeset/security-hardening-and-fixes.md b/.changeset/security-hardening-and-fixes.md
diff --git a/packages/cache/CHANGELOG.md b/packages/cache/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @suckless/cache
 
+## 0.5.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/cache/package.json b/packages/cache/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/cache",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Minimal, type-safe cache with pluggable adapters",
 	"keywords": [
 		"adapter",
diff --git a/packages/cron/CHANGELOG.md b/packages/cron/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @suckless/cron
 
+## 0.5.0
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/cron/package.json b/packages/cron/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/cron",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Cron expression parser with next/prev schedule computation",
 	"keywords": [
 		"cron",
diff --git a/packages/duration/CHANGELOG.md b/packages/duration/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @suckless/duration
 
+## 0.5.0
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/duration/package.json b/packages/duration/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/duration",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Parse and format duration strings",
 	"keywords": [
 		"duration",
diff --git a/packages/emitter/CHANGELOG.md b/packages/emitter/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @suckless/emitter
 
+## 0.5.0
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/emitter/package.json b/packages/emitter/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/emitter",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Type-safe event emitter",
 	"keywords": [
 		"emitter",
diff --git a/packages/i18n/CHANGELOG.md b/packages/i18n/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @suckless/i18n
 
+## 0.5.0
+
+### Minor Changes
+
+- d9eee5c: Security hardening and bug fixes across packages
+
+  - **schema**: Use `Object.hasOwn` instead of `in` to prevent prototype pollution in object/union validation; use `Object.keys` instead of `for..in` for record iteration; wrap `structuredClone` to handle non-cloneable union inputs
+  - **jsx**: Validate tag names, reject event handler (`on*`) attributes, and harden `isRawHtml` against accessor-based spoofing
+  - **router**: Validate that patterns and paths start with `/`, reject empty param names and non-terminal wildcards
+  - **limiter**: Serialize concurrent `check()` calls per key to fix race condition
+  - **queue**: Retry transient adapter pull failures instead of exiting the worker; resolve `drain()` on dispose
+  - **key**: Detect and reject accessor properties during serialization
+  - **i18n**: Match locale tags case-insensitively per BCP 47
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/i18n/package.json b/packages/i18n/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/i18n",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Type-safe internationalization with BCP 47 locale resolution",
 	"keywords": [
 		"i18n",
diff --git a/packages/jsx/CHANGELOG.md b/packages/jsx/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @suckless/jsx
 
+## 0.5.0
+
+### Minor Changes
+
+- d9eee5c: Security hardening and bug fixes across packages
+
+  - **schema**: Use `Object.hasOwn` instead of `in` to prevent prototype pollution in object/union validation; use `Object.keys` instead of `for..in` for record iteration; wrap `structuredClone` to handle non-cloneable union inputs
+  - **jsx**: Validate tag names, reject event handler (`on*`) attributes, and harden `isRawHtml` against accessor-based spoofing
+  - **router**: Validate that patterns and paths start with `/`, reject empty param names and non-terminal wildcards
+  - **limiter**: Serialize concurrent `check()` calls per key to fix race condition
+  - **queue**: Retry transient adapter pull failures instead of exiting the worker; resolve `drain()` on dispose
+  - **key**: Detect and reject accessor properties during serialization
+  - **i18n**: Match locale tags case-insensitively per BCP 47
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/jsx/package.json b/packages/jsx/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/jsx",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "JSX-to-string runtime for server-side HTML rendering with XSS escaping and strict per-element types",
 	"keywords": [
 		"escape",
diff --git a/packages/key/CHANGELOG.md b/packages/key/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @suckless/key
 
+## 0.5.0
+
+### Minor Changes
+
+- d9eee5c: Security hardening and bug fixes across packages
+
+  - **schema**: Use `Object.hasOwn` instead of `in` to prevent prototype pollution in object/union validation; use `Object.keys` instead of `for..in` for record iteration; wrap `structuredClone` to handle non-cloneable union inputs
+  - **jsx**: Validate tag names, reject event handler (`on*`) attributes, and harden `isRawHtml` against accessor-based spoofing
+  - **router**: Validate that patterns and paths start with `/`, reject empty param names and non-terminal wildcards
+  - **limiter**: Serialize concurrent `check()` calls per key to fix race condition
+  - **queue**: Retry transient adapter pull failures instead of exiting the worker; resolve `drain()` on dispose
+  - **key**: Detect and reject accessor properties during serialization
+  - **i18n**: Match locale tags case-insensitively per BCP 47
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/key/package.json b/packages/key/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/key",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Deterministic serialization of complex values into stable string keys",
 	"keywords": [
 		"cache-key",
diff --git a/packages/limiter/CHANGELOG.md b/packages/limiter/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @suckless/limiter
 
+## 0.5.0
+
+### Minor Changes
+
+- d9eee5c: Security hardening and bug fixes across packages
+
+  - **schema**: Use `Object.hasOwn` instead of `in` to prevent prototype pollution in object/union validation; use `Object.keys` instead of `for..in` for record iteration; wrap `structuredClone` to handle non-cloneable union inputs
+  - **jsx**: Validate tag names, reject event handler (`on*`) attributes, and harden `isRawHtml` against accessor-based spoofing
+  - **router**: Validate that patterns and paths start with `/`, reject empty param names and non-terminal wildcards
+  - **limiter**: Serialize concurrent `check()` calls per key to fix race condition
+  - **queue**: Retry transient adapter pull failures instead of exiting the worker; resolve `drain()` on dispose
+  - **key**: Detect and reject accessor properties during serialization
+  - **i18n**: Match locale tags case-insensitively per BCP 47
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/limiter/package.json b/packages/limiter/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/limiter",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Token bucket rate limiter",
 	"keywords": [
 		"rate-limit",
diff --git a/packages/memo/CHANGELOG.md b/packages/memo/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @suckless/memo
 
+## 0.5.0
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/memo/package.json b/packages/memo/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/memo",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Memoization with explicit key functions and optional LRU eviction",
 	"keywords": [
 		"cache",
diff --git a/packages/middleware/CHANGELOG.md b/packages/middleware/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @suckless/middleware
 
+## 0.5.0
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/middleware/package.json b/packages/middleware/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/middleware",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Generic composable middleware",
 	"keywords": [
 		"compose",
diff --git a/packages/queue/CHANGELOG.md b/packages/queue/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @suckless/queue
 
+## 0.5.0
+
+### Minor Changes
+
+- d9eee5c: Security hardening and bug fixes across packages
+
+  - **schema**: Use `Object.hasOwn` instead of `in` to prevent prototype pollution in object/union validation; use `Object.keys` instead of `for..in` for record iteration; wrap `structuredClone` to handle non-cloneable union inputs
+  - **jsx**: Validate tag names, reject event handler (`on*`) attributes, and harden `isRawHtml` against accessor-based spoofing
+  - **router**: Validate that patterns and paths start with `/`, reject empty param names and non-terminal wildcards
+  - **limiter**: Serialize concurrent `check()` calls per key to fix race condition
+  - **queue**: Retry transient adapter pull failures instead of exiting the worker; resolve `drain()` on dispose
+  - **key**: Detect and reject accessor properties during serialization
+  - **i18n**: Match locale tags case-insensitively per BCP 47
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/queue/package.json b/packages/queue/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/queue",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Producer/consumer queue with pluggable storage",
 	"keywords": [
 		"adapter",
diff --git a/packages/retry/CHANGELOG.md b/packages/retry/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @suckless/retry
 
+## 0.5.0
+
 ## 0.4.0
 
 ### Patch Changes
diff --git a/packages/retry/package.json b/packages/retry/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/retry",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Retry with exponential backoff and jitter",
 	"keywords": [
 		"backoff",
diff --git a/packages/router/CHANGELOG.md b/packages/router/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @suckless/router
 
+## 0.5.0
+
+### Minor Changes
+
+- d9eee5c: Security hardening and bug fixes across packages
+
+  - **schema**: Use `Object.hasOwn` instead of `in` to prevent prototype pollution in object/union validation; use `Object.keys` instead of `for..in` for record iteration; wrap `structuredClone` to handle non-cloneable union inputs
+  - **jsx**: Validate tag names, reject event handler (`on*`) attributes, and harden `isRawHtml` against accessor-based spoofing
+  - **router**: Validate that patterns and paths start with `/`, reject empty param names and non-terminal wildcards
+  - **limiter**: Serialize concurrent `check()` calls per key to fix race condition
+  - **queue**: Retry transient adapter pull failures instead of exiting the worker; resolve `drain()` on dispose
+  - **key**: Detect and reject accessor properties during serialization
+  - **i18n**: Match locale tags case-insensitively per BCP 47
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/router/package.json b/packages/router/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/router",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Fast URL pattern router",
 	"keywords": [
 		"pattern",
diff --git a/packages/schema/CHANGELOG.md b/packages/schema/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @suckless/schema
 
+## 0.5.0
+
+### Minor Changes
+
+- d9eee5c: Security hardening and bug fixes across packages
+
+  - **schema**: Use `Object.hasOwn` instead of `in` to prevent prototype pollution in object/union validation; use `Object.keys` instead of `for..in` for record iteration; wrap `structuredClone` to handle non-cloneable union inputs
+  - **jsx**: Validate tag names, reject event handler (`on*`) attributes, and harden `isRawHtml` against accessor-based spoofing
+  - **router**: Validate that patterns and paths start with `/`, reject empty param names and non-terminal wildcards
+  - **limiter**: Serialize concurrent `check()` calls per key to fix race condition
+  - **queue**: Retry transient adapter pull failures instead of exiting the worker; resolve `drain()` on dispose
+  - **key**: Detect and reject accessor properties during serialization
+  - **i18n**: Match locale tags case-insensitively per BCP 47
+
 ## 0.4.0
 
 ## 0.3.0
diff --git a/packages/schema/package.json b/packages/schema/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@suckless/schema",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Minimal runtime validation with compiled validators",
 	"keywords": [
 		"parser",

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@suckless/cache",`
`3`		`- "version": "0.4.0",`
	`3`	`+ "version": "0.5.0",`
`4`	`4`	`"description": "Minimal, type-safe cache with pluggable adapters",`
`5`	`5`	`"keywords": [`
`6`	`6`	`"adapter",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@suckless/cron",`
`3`		`- "version": "0.4.0",`
	`3`	`+ "version": "0.5.0",`
`4`	`4`	`"description": "Cron expression parser with next/prev schedule computation",`
`5`	`5`	`"keywords": [`
`6`	`6`	`"cron",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@suckless/duration",`
`3`		`- "version": "0.4.0",`
	`3`	`+ "version": "0.5.0",`
`4`	`4`	`"description": "Parse and format duration strings",`
`5`	`5`	`"keywords": [`
`6`	`6`	`"duration",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@suckless/emitter",`
`3`		`- "version": "0.4.0",`
	`3`	`+ "version": "0.5.0",`
`4`	`4`	`"description": "Type-safe event emitter",`
`5`	`5`	`"keywords": [`
`6`	`6`	`"emitter",`