From ed3921f95e6f31e6e82da2471132cd62de1e0931 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 14:56:58 +0000 Subject: [PATCH] Version Packages --- .changeset/buy-the-validators.md | 11 ----------- CHANGELOG.md | 12 ++++++++++++ package.json | 2 +- src-tauri/Cargo.lock | 2 +- src-tauri/Cargo.toml | 2 +- src-tauri/tauri.conf.json | 2 +- 6 files changed, 16 insertions(+), 15 deletions(-) delete mode 100644 .changeset/buy-the-validators.md diff --git a/.changeset/buy-the-validators.md b/.changeset/buy-the-validators.md deleted file mode 100644 index a9bf39e..0000000 --- a/.changeset/buy-the-validators.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'fiber': patch ---- - -Validate request bodies with Ajv, and read credential paths with real JSONPath. - -Body linting was a hand-written walker over "a deliberately useful subset" of JSON Schema, and the subset was the problem: no `$ref`, no `minimum`, `pattern`, `uniqueItems`, `minLength`, `patternProperties`, `if`/`then` or `dependentSchemas`. All of those passed silently, so a body could be reported clean and still be rejected by the API that published the schema. Ajv is the reference implementation of what that walker was approximating. - -What stays hand-written is the part that isn't JSON Schema: OpenAPI 3.0's `nullable`, folded into a union type, and `type` values that don't exist. One real 3.1 document arrives with `"type": "undefined"` 310 times alongside `emoji`, `icon`, `void` and `http` — Ajv rejects those at compile time, which would cost that schema all of its linting rather than one field's, so the invented names are dropped and every valid constraint beside them keeps working. Messages are unchanged, including the "must be number, not string" phrasing Ajv leaves out. - -Credential paths now go through `serde_json_path`, so a capture rule can use `$..id_token` to find a token whose nesting depth you don't know, or `$.keys[?(@.active == true)].secret` to pick the entry that is current rather than pinning an index that moves. The dotted form every saved rule already uses keeps working: it isn't valid JSONPath — `$.data.tokens.0.value` needs `[0]` under RFC 9535 — so the query is tried first and the original walk answers for anything it rejects. A query matching several nodes reports nothing rather than picking arbitrarily. diff --git a/CHANGELOG.md b/CHANGELOG.md index 1c5b7c4..4ed8d2d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,17 @@ # fiber +## 0.14.7 + +### Patch Changes + +- [#83](https://github.com/MathiasWP/fiber/pull/83) [`5f8fde8`](https://github.com/MathiasWP/fiber/commit/5f8fde84220b5168a9a41ffe4884b9da7e8ba00d) Thanks [@MathiasWP](https://github.com/MathiasWP)! - Validate request bodies with Ajv, and read credential paths with real JSONPath. + + Body linting was a hand-written walker over "a deliberately useful subset" of JSON Schema, and the subset was the problem: no `$ref`, no `minimum`, `pattern`, `uniqueItems`, `minLength`, `patternProperties`, `if`/`then` or `dependentSchemas`. All of those passed silently, so a body could be reported clean and still be rejected by the API that published the schema. Ajv is the reference implementation of what that walker was approximating. + + What stays hand-written is the part that isn't JSON Schema: OpenAPI 3.0's `nullable`, folded into a union type, and `type` values that don't exist. One real 3.1 document arrives with `"type": "undefined"` 310 times alongside `emoji`, `icon`, `void` and `http` — Ajv rejects those at compile time, which would cost that schema all of its linting rather than one field's, so the invented names are dropped and every valid constraint beside them keeps working. Messages are unchanged, including the "must be number, not string" phrasing Ajv leaves out. + + Credential paths now go through `serde_json_path`, so a capture rule can use `$..id_token` to find a token whose nesting depth you don't know, or `$.keys[?(@.active == true)].secret` to pick the entry that is current rather than pinning an index that moves. The dotted form every saved rule already uses keeps working: it isn't valid JSONPath — `$.data.tokens.0.value` needs `[0]` under RFC 9535 — so the query is tried first and the original walk answers for anything it rejects. A query matching several nodes reports nothing rather than picking arbitrarily. + ## 0.14.6 ### Patch Changes diff --git a/package.json b/package.json index 2fe4912..f420384 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "fiber", "private": true, - "version": "0.14.6", + "version": "0.14.7", "type": "module", "packageManager": "pnpm@11.22.0", "engines": { diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index e0bb9ab..0583385 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -1285,7 +1285,7 @@ dependencies = [ [[package]] name = "fiber" -version = "0.14.6" +version = "0.14.7" dependencies = [ "base64 0.23.1", "dirs", diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index f738e97..2479e8b 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "fiber" -version = "0.14.6" +version = "0.14.7" description = "A local-first API client" authors = ["Mathias Picker"] license = "MIT" diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json index df67df8..52dd946 100644 --- a/src-tauri/tauri.conf.json +++ b/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "../node_modules/@tauri-apps/cli/config.schema.json", "productName": "Fiber", - "version": "0.14.6", + "version": "0.14.7", "identifier": "dev.fiber.app", "build": { "frontendDist": "../build",