Versions du core

0.3.4 à 0.3.10

25 octobre 2026

7 versions de maintenance, aucun changement de comportement.

Maintenance et documentation (7)

Reorder and update installation instructions
Reorganize module documentation into numbered files
Add start command in README
README · Update landing page to remove redundant commands
README · Update content and structure
Update documentation and CLI for version intermediately published on Fraza registry
Update registry and installation documentation

0.3.1

24 octobre 2026Changements cassantsAction après la mise à jour

Changements cassants (47)

Answer every API error from a French catalogue, let handlers throw ApiError
Version the module contract, refuse an unknown one at startup
Refuse an upload in French, with a stable code per layer
Keep only the Stripe webhook, verify its signature without the SDK
Publish a digest of a file's etag, never the value itself

Voir les 42 autres

Answer 404 for an unknown or refused admin page, inside the shell
Render Table as a compact list on narrow screens, open its rows from the keyboard
Replace Headless UI with a native dialog and a shared menu primitive
Ship IBM's own WOFF2 subsets of Plex Sans and Plex Mono
Resolve a path once per request, keep a failing resolver from taking the others down
Answer ETag, 304, byte ranges and Cache-Control in buildFileResponse
Declare a page's title and permission on the server, load its code on demand
Declare in sideEffects only the files that act when imported
Give each shared component its own entry, fail a module public page on a heavy barrel
Boot from @fraza/core/init, keep only the boot and the config at the root
Drop the public loading screen, which made every unknown URL answer 200
Answer a sign-up the same way whether or not the address has an account
Hash a new account's password before its transaction opens
Keep the admin role on its last holder
Refuse the admin password, address and reset routes on one's own account
Ship .env.example as a secret-free template, keep values in .env.local
Write the project .npmrc in mode 0600 and warn about a token that can publish
Store only the SHA-256 of session and link tokens, spend links atomically
Read admin.access from the roles, drop the legacy role column
Grant only what one holds, change only accounts one outranks
Move account rules into a core/users service, written in transactions
Refuse register() on an empty database
Find system roles by a stable key and lock their name
Store e-mail addresses normalized, unique regardless of case
Stop exposing setSessionCookie and refreshSessionCookie as actions
Remove dead user queries, refreshSession and the auth re-export shims
Stop the per-email counter from locking the owner out of their account
Throw from queueEmail when it cannot queue inside a transaction
Require Next.js 16
Call the Resend REST API with fetch instead of the SDK
Load the project env files without dotenv, require Node 20.12
Render emails with the core's own components instead of react-email
Validate storage policies and refuse an unknown type
Refuse an extension key or a route already taken by another source
Lock jobs across instances in fraza_cron_runs and record every run
Share counters through PostgreSQL, keep unknown addresses limited
Encode S3 metadata values and send the URL that was signed
Cap request bodies per route, answer 405 and 413
Add the shared http entry with apiFetch and the client IP readers
Add civil date helpers and todayInZone, format in fr-CA by default
Bound migration lock waits and reject malformed migrations
Verify the TLS certificate by default, whatever NODE_ENV says

À lancer après la mise à jour

npx fraza-update les enchaîne seul.

Terminal

$ npx fraza-db migrate
$ npx fraza-doctor --fix

Variables d’environnement (59)

+ FRAZA_ADMIN_SITE_LINK
+ FRAZA_AUTH_REDIRECT_AFTER_LOGIN
+ FRAZA_AUTH_REGISTRATION
+ FRAZA_AUTH_SESSION_COOKIE_NAME
+ FRAZA_AUTH_SESSION_MAX_AGE_DAYS

Voir les 54 autres

+ FRAZA_CURRENCY
+ FRAZA_CURRENCY_SYMBOL
+ FRAZA_DATABASE_URL
+ FRAZA_DATE_FORMAT
+ FRAZA_DB_CONNECT_TIMEOUT_MS
+ FRAZA_DB_MIGRATION_LOCK_TIMEOUT_MS
+ FRAZA_DB_POOL_MAX
+ FRAZA_DB_SSL_CA
+ FRAZA_DB_STATEMENT_TIMEOUT_MS
+ FRAZA_DEVKIT
+ FRAZA_EMAIL_FROM_ADDRESS
+ FRAZA_EMAIL_FROM_NAME
+ FRAZA_EMAIL_LOGO
+ FRAZA_EMAIL_LOGO_URL
+ FRAZA_EMAIL_OUTBOX_RETENTION_DAYS
+ FRAZA_EMAIL_PROVIDER
+ FRAZA_EMAIL_RESEND_APIKEY
+ FRAZA_EMAIL_SMTP_HOST
+ FRAZA_EMAIL_SMTP_PASSWORD
+ FRAZA_EMAIL_SMTP_PORT
+ FRAZA_EMAIL_SMTP_REQUIRE_TLS
+ FRAZA_EMAIL_SMTP_SECURE
+ FRAZA_EMAIL_SMTP_TIMEOUT_MS
+ FRAZA_EMAIL_SMTP_TLS_NO_VERIFY
+ FRAZA_EMAIL_SMTP_USER
+ FRAZA_ENCRYPTION_KEY
+ FRAZA_IMAGE_CONCURRENCY
+ FRAZA_IMAGE_MAX_PIXELS
+ FRAZA_LOGO_URL
+ FRAZA_LOGO_URL_DARK
+ FRAZA_LOG_FORMAT
+ FRAZA_LOG_LEVEL
+ FRAZA_NAME
+ FRAZA_SEO
+ FRAZA_SEO_SEPARATOR
+ FRAZA_SEO_TITLE_TEMPLATE
+ FRAZA_SITE_URL
+ FRAZA_STORAGE_ACCESS_KEY
+ FRAZA_STORAGE_BUCKET
+ FRAZA_STORAGE_ENDPOINT
+ FRAZA_STORAGE_PROVIDER
+ FRAZA_STORAGE_REGION
+ FRAZA_STORAGE_SECRET_KEY
+ FRAZA_STORAGE_TIMEOUT_MS
+ FRAZA_SUPPORT_EMAIL
+ FRAZA_TEST_DATABASE_URL
+ FRAZA_TEST_SCHEMA_TTL_HOURS
+ FRAZA_TIMEZONE
+ FRAZA_TRUST_PROXY
+ FRAZA_UPDATE_CHAIN
+ FRAZA_UPDATE_CHECK
+ NEXT_PUBLIC_URL
+ NEXT_TELEMETRY_DISABLED
+ STRIPE_WEBHOOK_SECRET

Nouveautés (75)

Add tests for icons package refactor(package.server.js): add ICONS_NAME constant and update package profile
Add devkit colors page
core · Add markUnread and deleteNotification functions and routes
admin · Add devkit scenario endpoint
core · Add notification system

Voir les 70 autres

tools · Accept an exact version in fraza-module release
tools · Bump the version in fraza-module release, patch by default
Update version and changelog content
api · Answer every API error from a French catalogue, let handlers throw ApiError
modules · Declare soft dependencies with manifest.optionalModules
modules · Version the module contract, refuse an unknown one at startup
compat · Check the peer range of a module even when it declares requiresCore
tools · Add fraza-module test-clean to drop the leftover test schemas
tools · Drop the live test schemas on SIGINT and SIGTERM
tools · Date the test schemas and sweep the ones a killed process left
api · Measure a file read on demand, answer its length and its ranges
api · Let a file descriptor add X- headers to its response
api · Let the read of a file refuse it with a status of its own
users · Export the account input rules from a neutral @fraza/core/users/validation
ui · Let Combobox search on the server
ui · Let a Table offer its own page sizes
tools · Give module tests the core tables, the migration context and the Next hook
crypto · Derive a key per purpose, sign and verify short tokens
database · Leave expected SQLSTATE codes out of the logs, add isUniqueViolation
sql · Add escapeLike and containsPattern, clamp a limit of many digits to max
http · Add truncateIp, the network of an address in CIDR form
storage · Add isStorageConfigured and deletePrefix
api · Export runAfterResponse and parseFormData
email · Export ADDRESS from a neutral @fraza/core/email/address entry
dates · Edit an instant in a time zone, hand the site's zone to the admin pages
api · Answer 502 and 503, let apiSuccess carry response headers
api · Let a file response refuse conditional requests
api · Answer 404 when the read of a file finds the object gone
ui · Render Table as a compact list on narrow screens, open its rows from the keyboard
ui · Replace Headless UI with a native dialog and a shared menu primitive
ui · Read the session of the admin and auth routes in a Suspense boundary under Cache Components
public-content · Add revalidatePublicContent(tag) for a module's cached public reads
api · Answer ETag, 304, byte ranges and Cache-Control in buildFileResponse
admin · Declare a page's title and permission on the server, load its code on demand
tools · Check a module's ./client entry for server code
components · Give each shared component its own entry, fail a module public page on a heavy barrel
init · Boot from @fraza/core/init, keep only the boot and the config at the root
doctor · Expect the error, loading and global error files in the project contract
ui · Add the error, loading and global error screens a project re-exports
doctor · Warn when a FRAZA_MODULE_* flag differs from the generated manifest
doctor · Report an env file tracked by git that carries a secret
env · Ship .env.example as a secret-free template, keep values in .env.local
auth · Read a session with its user in one query and end it after an absolute lifetime
auth · Hash passwords in a versioned scrypt format and rehash old ones at sign-in
admin · Check a new user's fields with the shared rules before sending
users · Find system roles by a stable key and lock their name
users · Store e-mail addresses normalized, unique regardless of case
email · Send a Resend idempotency key with every outbox attempt
email · Add the shared email parts entry
email · Render emails with the core's own components instead of react-email
registry · Refuse an extension key or a route already taken by another source
cron · Purge expired sessions, tokens, counters and old outbox rows hourly
email · Add an outbox that stores emails before sending and retries them
cron · Lock jobs across instances in fraza_cron_runs and record every run
rate-limit · Share counters through PostgreSQL, keep unknown addresses limited
api · Cap request bodies per route, answer 405 and 413
storage · Add bounded image processing on a lazily loaded sharp
storage · Add a streamed ZIP writer with ZIP64
tools · Fail the core build when a client-safe entry reaches server code
http · Add the shared http entry with apiFetch and the client IP readers
dates · Add civil date helpers and todayInZone, format in fr-CA by default
slug · Add a shared slugify and a database uniqueSlug
database · Add the shared sql helpers entry
database · Show the env files and the target database before fraza-db writes
database · Make the pool configurable, keep it on globalThis, return DATE as strings
logger · Keep error stacks, write failures to stderr, add json format and email masking
tools · Add the fraza-module command shared by every package
modules · Recognise the @fraza-pro scope for Pro modules
docs · Add icon support and documentation
Initial Fraza 0.1.0 codebase

Corrections (86)

docs · Remove and rephrase description of requiresCore in module creation guide
api · Remove redundant sibling handling logic
Remove deprecated components
core · Update documentation for authentication page handling
shared-icons · Update icon sources and documentation

Voir les 81 autres

Set position: relative on shell and main for better overflow handling
Update paths in package.json and documentation
tools · Warn about breaking changes in a patch release instead of refusing it
tools · Find each dependency on disk instead of trusting npm's path
tools · Refuse to bump again over a release stopped after its commit
tools · Push the release branch and its tag atomically
tools · Fetch before a release, refuse a branch behind its remote
tools · Refuse a release level below the breaking changes waiting
package · Bump version to 0.2.0
api · Percent-encode ' ( ) * in filename* as RFC 8187 asks
admin · Show the French message of a refused profile or user call
media-registry · Answer a write without the media module in French, with a code
api · Give Content-Disposition a readable ASCII filename fallback
payments · Answer the Stripe webhook refusals in French
storage · Refuse a file in French, answer a storage outage with a 502
auth · Answer the user and role routes in French, leave internal errors to the router
admin · Clear a page's error when its path changes under the same slug
storage · Refuse an upload in French, with a stable code per layer
media-registry · Pass client to the block helpers and getMediaByIds, keep the 404 out of caches
admin · Pass the server title down to the header of the roles page
ui · Name each selection checkbox of a table after its row
ui · Open a table row from a real button on its title, not a focusable tr
ui · Keep a disabled menu item focusable, announced as disabled
ui · Describe a dialog by its sentence, make a confirmation an alert dialog
ui · Open a dialog again after a native close its caller did not follow
ui · Let Escape close the « Aucun résultat » panel of TagInput, not its dialog
tools · Count a call in an initializer, a default export or a top-level if as an effect
admin · Download a page again after a failed chunk, on the way back too
admin · Hide a nav item without the permission of the page it opens
api · Publish a digest of a file's etag, never the value itself
admin · Answer 404 for an unknown or refused admin page, inside the shell
admin · Make the closed mobile drawer inert, close it on Escape, size it by dvh
ui · Label the core form fields by useId, describe them and mark their errors
blocks · Render a linked image from the filename the Medias module resolves
hooks · Remove the mirror history entry of useUnsavedChanges once clean
editor · Keep the block selection keys inside the editor that holds them
blocks · Keep block links to http, https, mailto, tel and relative addresses
admin · Filter the bottom nav items by permission, mark them active in the browser
ui · Drop the public loading screen, which made every unknown URL answer 200
auth · Apply the name rules on PUT /users/:id
users · Bound the memory a stored password hash may ask for, not each parameter
auth · Check an older password hash in the time of a current one at sign-in
auth · Answer a sign-up the same way whether or not the address has an account
auth · Issue and queue the verification link after the response of resendVerificationAction
users · Hash a new account's password before its transaction opens
auth · Check the password before the address, count wrong current passwords
auth · Let an invited account whose invitation is gone still be activated
auth · Keep the admin role on its last holder
auth · Refuse the admin password, address and reset routes on one's own account
registry · Write the project .npmrc in mode 0600 and warn about a token that can publish
auth · Issue and queue the reset link after the response of forgotPasswordAction
auth · Close the other sessions on a password or address change
auth · Stop writing the session cookie while rendering, make it last the whole session
auth · Store only the SHA-256 of session and link tokens, spend links atomically
storage · Read admin.access from the roles, drop the legacy role column
auth · Grant only what one holds, change only accounts one outranks
auth · Refuse register() on an empty database
auth · Stop exposing setSessionCookie and refreshSessionCookie as actions
auth · Log a wrong password as one warning line, not an error with its stack
auth · Rethrow Next.js control flow from getSession instead of logging it
auth · Stop the per-email counter from locking the owner out of their account
rate-limit · Keep the public guessing presets on the caller's address
cron · Run a locked job once per tick, not once per instance
maintenance · Purge in batches so a first purge fits under statement_timeout
email · Throw from queueEmail when it cannot queue inside a transaction
database · Raise when PostgreSQL turns the COMMIT of transaction() into a ROLLBACK
release · Annotate the version tag so git push --follow-tags sends it
dates · Read the years 0 to 99 as given in daysBetweenISO
slug · Spell the combining marks range with escapes
storage · Validate storage policies and refuse an unknown type
api · Apply a route's permission on user routes too
auth · Rate limit sign-in and password flows per targeted e-mail too
email · Bound SMTP connection, TLS handshake and whole send, add REQUIRE_TLS
storage · Bound every S3 request, retry idempotent ones, batch deletes
storage · Encode S3 metadata values and send the URL that was signed
payments · Rate limit the Stripe webhook and cap its body at 64 KiB
database · Bound migration lock waits and reject malformed migrations
database · Verify the TLS certificate by default, whatever NODE_ENV says
database · Rethrow non-database errors from transaction() untouched
database · Check table, column and index existence in the current schema
Correct dimensions and descriptions for the admin bar

Performances (9)

fonts · Ship IBM's own WOFF2 subsets of Plex Sans and Plex Mono
public-content · Resolve a path once per request, keep a failing resolver from taking the others down
hooks · Track the dirty state of useUnsavedChanges with a revision counter
editor · Render only the changed block on a keystroke
build · Declare in sideEffects only the files that act when imported

Voir les 4 autres

api · Check admin.access and a route's permission with one read
users · Count a role's permissions and holders with subqueries
auth · Ask once per request whether an account exists
auth · Read the session and the permissions once per request

Maintenance et documentation (70)

ui · Update icon references in multiple documents and code files
cli · Update release command to include adjacent packages and Fraza dependency versions
Improve usage instructions for icon package
core · Align dependencies with core range
Docs/refactor: add documentation for fraza-update and fraza-doctor
Docs/02-guides/mettre-a-jour-un-projet.md,.docs/03-reference/05-cli/fraza-doctor.md,src/core/doctor/imports.server.js,test/doctor-imports.test.js: Update deprecated imports for @fraza/icons (0.2.22)
module · Update package notices and documentation
Docs/drive): Improve menu actions and add copy functionality
shared · Update documentation and component descriptions
Add detailed drawing rules for icons
Update permissions and roles documentation
drive · Update icon logic and documentation
Enhance installation and tour guides
Update API route paths
admin · Update widget registration with title, description, and size
Handle close event delay during reopens
admin · Update breadcrumb logic and documentation
Update theme descriptions and styles
admin · Reorganize and improve components layout
auth · Add anti-bot feature and update security guidelines
publication · Describe how @fraza/start runs fraza-module and its version module
posts · Document the term_taken refusal of a duplicate term title
design-system · Describe the inert mobile drawer and the title button of a table row
guides · Answer a storage failure with a 502 and a failed job with the catalogue 500
posts · Document the French refusals and codes of the post and term routes
pages · Document the codes of the conflicts of a page
medias · Document the codes of a refused media and the French file route texts
forms · Document details.fieldErrors and the codes of a refusal
drive · Document the error codes of the drive routes
booking · Document the error answers and their codes
facturation · Document the error answers of the billing routes
The media module is an optional module, reminded by fraza-doctor
Drop the long dash inside sentences of the api barrel, the logger and the handler signature comments
drive · Link listCronRuns to the cron reference without a guessed anchor
medias · GetMediaByIds reads on the caller's client
drive · Describe the bounded history, the share unlock counter, the deletion queue and the core zip
booking · Describe one slot rule, the signed form token, framing, the outbox and theme colours
billing · Describe the serialized ledger, the module's own Stripe and PDF, credit notes and the outbox
posts · Describe strict declarations, private fields everywhere, batched reads and transactional writes
pages · Describe the server-paged tree, the restricted delete, the recursive resolution and the cache tag
medias · Describe the type table, the core image pipeline and the references in a transaction
forms · Describe the per-type validation, the signed delay token, privacy and retention
payments · Keep only the Stripe webhook, verify its signature without the SDK
The compact list keeps the depth of a child
billing · The public invoice sends both layouts of its lines
posts · The block editor loads with the form, not with the lists
pages · The block editor loads with the form, not with the list
drive · The counted download refuses conditional requests
drive · A preview or thumbnail whose object is gone answers 404
modules · Describe the admin 404 without the read permission, the compact lists and the file answers of the adapted modules
drive · The unlock route counts on the share_unlock preset
env · Align the env file comments with .env.local and the platform variables
users · Name consumeEmailChangeToken, which replaced verifyEmailChangeToken
users · Move account rules into a core/users service, written in transactions
users · Keep the password and name rules in one shared module
users · Remove dead user queries, refreshSession and the auth re-export shims
modules · Say the version module comes from fraza-module sync-version
database · Say which hosted databases need FRAZA_DB_SSL_CA
email · Call the Resend REST API with fetch instead of the SDK
drive · Say the blocklist reads the raw suffix of the name
modules · Document the body ceilings of the drive, medias and forms uploads
http · Point the proxy settings at the http page
Split modules into Gratuit and Pro, drop login from getting started
admin · Enhance sidebar section toggle and state persistence
admin · Update navigation sections and groups
auth · Update logo positioning and page dimensions
auth · Removed unused AuthLogoContext
icons · Remove old icons
admin · Remove unused mention from sidebar description
Initial commit

Ce qui change dans le core, version par version.

0.3.14

Corrections (1)

0.3.12 à 0.3.13

0.3.11

Corrections (1)

0.3.4 à 0.3.10

0.3.3

Corrections (1)

0.3.2

0.3.1

Changements cassants (47)

À lancer après la mise à jour

Variables d’environnement (59)

Nouveautés (75)

Corrections (86)

Performances (9)

Pas encore de projet ? Il tient en une commande.