Prepare clearfetch 1.0.7 release - #49
Merged
Merged
Conversation
- validate query containers and cross-realm URLSearchParams inputs\n- reject non-serializable JSON configuration consistently\n- cancel abandoned response bodies before HTTP retries\n- add regression coverage for the hardened behaviors
- verify annotated release tags are reachable from main\n- add strict and rerunnable publish dry-run modes\n- extend CI coverage through Node.js 24\n- document the release-path check in contributor guidance
- record request validation and retry cleanup semantics\n- clarify package compatibility versus security support\n- document strict and rerunnable release validation\n- correct empty-response guidance for HTTP 304
- snapshot normalized request inputs and replayable bodies across attempts - handle cross-realm platform values and effective retry eligibility - reflect client response defaults in public types and regression coverage
- validate lockfile origins, integrity, and install-script scope before installs - add browser, TypeScript-floor, and packed-artifact guardrails - publish one verified tarball with isolated authority and provenance checks
- describe stable retry replay, response typing, and runtime constraints - record package, supply-chain, and exact-artifact release guardrails - publish the 1.0.7 changelog and contributor verification guidance
- separate hook-visible request context from normalized execution state - give response hooks independent clones and abort abandoned attempts - preserve special query keys and cover lifecycle regressions
- move happy-dom coverage outside the default test glob - keep cross-realm FormData cases in the dedicated browser-like suite
Validate option and default containers, headers, retry fields, and timer bounds. Snapshot query and cross-realm URL inputs, preserve abort classification through response hooks, and cover the behavior across supported Node and browser runtimes.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- retain response-type inference for configured and extended clients - cover legacy HttpClient annotations on TypeScript 5.0 and current types
bmurdock
marked this pull request as ready for review
July 29, 2026 21:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
1.0.7package/changelog metadata and strengthen CI, dependency, package, and trusted-publishing guardrailsWhy
The release candidate consolidates correctness and reliability fixes found during repository-wide review. The main root causes were mutable caller-owned inputs being reread across attempts, incomplete runtime validation at public boundaries, platform-specific abort/error shapes, and release verification that did not bind every stage to one smoke-tested artifact.
Impact
Consumers get more predictable retries and hooks, stable
ConfigError/timeout/abort behavior, safer cross-realm handling, and stronger type compatibility. The package remains ESM-only, has no runtime dependencies or lifecycle scripts, and retains the existing public package surface.Release readiness
package.json,package-lock.json, andCHANGELOG.mdagree on1.0.71.0.7is not currently published and nov1.0.7tag or GitHub Release existsorigin/main; local merge simulation is conflict-freenpmenvironment, tag policy, Actions permissions, main protection, vulnerability reporting, and immutable-release settings were verifiedValidation
npm ci --ignore-scripts --no-audit --registry=https://registry.npmjs.orgnpm run check:lockfilenpm run lintnpm test(151 tests; also verified on Node.js 18 and 24 locally)npm run test:browser-likenpm run test:browser-realnpm run test:types-compatnpm run buildnpm run check:dependency-audit(0 vulnerabilities)npm run check:dependency-signatures(17 verified signatures, 6 attestations)npm run check:package-metadatanpm run check:pack-smoke -- --retainnpm run check:publish-dry-run -- release-artifact/*.tgzgit diff --check