Skip to content

v0.3.4 — server-function guard on the canonical lineage

Choose a tag to compare

View all tags
@devlob devlob released this 13 Jul 17:23
· 112 commits to main since this release
v0.3.4
538c9e9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Runtime protection now covers the TanStack server-function path

Unifies the connector on the vendored node-waf engine and adds the server-function guard (#43), superseding 0.3.3 (which shipped only the browser-tunnel guard).

  • protect wires the guard as both a request middleware (browser → Supabase tunnel) and a function middleware (TanStack server functions) — so both of a Lovable app's data paths are covered, however it was built.
  • The WAF engine is vendored into the package (@patchstack/connect/protect); the installer scaffolds only guard.ts + rules.json.
  • protect is per-piece idempotent (clean re-runs and upgrades); ships types for the ./protect subpath.

Validated live end-to-end on a fresh Lovable app: a UI task-add carrying a stored-XSS marked payload is refused by the server-function guard (receipt returned, task never saved), while benign tasks save. Requires Node >= 18.

Assets 2
Loading