# Changelog ## Unreleased Nothing yet. ## v0.2.6 — 2026-11-12 The accounts app emits typed, transactional events. No breaking changes. Upgrade all five modules to v0.2.6 together. - `contrib/accounts` declares and emits typed events: `UserCreated`, `LoggedIn`, `LoginFailed`, `LoggedOut` and `PasswordChanged` (listed by `accounts.Events()` and included in `Descriptor`/`Service.App`). Payloads carrying `Tx` are emitted inside the account transaction, so handler writes commit with the change, a handler error rolls it back, and `database.OnCommit(e.Tx, fn)` defers side effects. `Service.Create`, `Login`, `Logout`, `ChangePassword` and `ResetPassword` now run through `database.Atomic`; `Create` returns a zero `User` when it fails. Accounts now requires core v0.2.5. See `docs/events.md`. ## v0.2.5 — 2026-11-12 Adds typed application events, the event-hook contract for installable packages. No breaking changes. Upgrade all five modules to v0.2.5 together. - Added typed application events (SVC-08), the package-system event-hook contract. The new `events` package declares an event with `events.New[T](owner, name)`; an app lists the events it emits in `App.Events` and its handlers, created with `Event.Handle`, in `App.Subscriptions`. `cicadel.New` builds an immutable dispatcher and fails when an app declares another app's event, a declaration is duplicated or its name reused, or a subscription names an event no installed app declares. `Event.Emit` runs handlers synchronously in app dependency order, stops at the first error (`*events.HandlerError`), checks cancellation before each handler and bounds nested emission (`events.MaxDepth`, `events.ErrDepth`). Requests, `Start` and cleanup hooks, app commands and every `manage.go` command carry the dispatcher; the new `Application.Context(ctx)` attaches it, the signing keys and the static manifest for other work such as jobs, and `Application.Events()` returns the dispatcher. `manage.go apps` lists `emits` and `handles` lines. See `docs/events.md`. - First-party app manifests (`accounts`, `formsets`, `migrations`, `querygen`) report the module version selected by the build, read from Go build information, instead of a fixed `v0.1.0`. `manage.go apps` now shows the real version; checkout builds without a released version report `v0.0.0`. - Generated projects subscribe in the new `project/events.go`, and the `startpackage` template declares and emits a typed `Greeted` event with a subscriber test. ## v0.2.4 — 2026-11-11 Adds typed per-package settings and completes the readiness checklist. No breaking changes. Upgrade all five modules to v0.2.4 together. - Formset saves (`contrib/formsets`) now run through `database.Atomic`, so model-form hooks registered with `database.OnCommit` during a formset `Save` run after the formset commits instead of failing with `database.ErrNoTransaction`. - Added the typed per-package settings contract (DEV-04). An app declares a struct whose `setting:"NAME"` fields (`,secret` for credentials) may be overridden by `CICADEL__`; it returns `App.Settings: settings.NewPackage(options)` and reads `Package.Value()`. `cicadel.New` resolves settings from `Settings.Env` before `Start`, rejects key collisions with project settings and other apps, and `check`/`check --json` report `:settings:invalid` naming the key, never the value. `manage.go apps` lists keys and values with secrets redacted. New: `settings.NewPackage`, `Package`, `LoadPackage`, `PackageSettings`, `Field`, `PackagePrefix`, `CoreKeys`, `Redacted`, `Settings.Env`, `App.Settings`, `Application.PackageSettings`, `AppSettings`. The `startpackage` scaffold uses it, and `contrib/accounts` `Options` now declares `CICADEL_ACCOUNTS_SESSION_LIFETIME`, `_RECOVERY_LIFETIME`, `_IDLE_TIMEOUT` and `_BCRYPT_COST` with `Options.Validate`; generated projects wire them through `AccountOptions`. No breaking changes. See `docs/package-settings.md`. ## v0.2.3 — 2026-11-11 Adds transaction post-commit hooks and moves to Go 1.26.11 for a standard-library security fix. No breaking changes. Upgrade all five modules to v0.2.3 together and raise your project's `go` line to 1.26.11. - Added transaction post-commit hooks (DB-03): `database.Atomic` runs a function in a PostgreSQL transaction (a savepoint when nested) and `database.OnCommit(tx, fn)` registers a callback that runs after the outermost transaction commits, in registration order. Hooks are discarded on rollback, on failed commit and with a rolled-back savepoint; outside an `Atomic` transaction `OnCommit` returns `database.ErrNoTransaction`. Hook errors and panics are logged and cannot undo the commit; hooks receive a context without the caller's cancellation. Model form (`Bound.Create`/`Update`) and administration saves now run through `database.Atomic`, so `AfterSave` hooks can register post-commit work; formsets adopt it once that module requires this release. See `docs/transactions.md`. - Require Go 1.26.11 (was 1.26.10) in every module and in generated projects, picking up the standard-library `net/http` fix for GO-2026-6859. Projects should raise the `go` line in `go.mod` to 1.26.11; with the default `GOTOOLCHAIN=auto` the toolchain is downloaded automatically. ## v0.2.2 — 2026-11-11 Adds signed, expiring tokens with secret-key rotation. No breaking changes: existing projects keep working, and `check --deploy` warns until `CICADEL_SECRET_KEY` is set. Upgrade all five modules to v0.2.2 together. - Added the `signing` package (SEC-04): purpose-bound, timestamped, URL-safe tokens signed with HMAC-SHA256 under per-purpose derived keys; `Verify` with a maximum age, `VerifyNoExpiry`, typed `SignJSON`/`VerifyJSON[T]`, `ErrInvalid`/`ErrExpired`/`ErrNoKey`, a one-minute clock-skew bound and `WithClock` for tests. New settings `SecretKey` (`CICADEL_SECRET_KEY`) and `SecretKeyFallbacks` (`CICADEL_SECRET_KEY_FALLBACKS`) sign with the current key and verify with previous ones during rotation. Handlers use `signing.For(r.Context(), purpose)`; commands and jobs use `Application.Signer`. `cicadel secretkey` generates a key, `check --deploy` reports `settings:secret_key` when none is set, and `apptest.Settings()` uses the fixed `apptest.TestSecretKey`. See `docs/signing.md`. ## v0.2.1 — 2026-11-10 Adds security headers and HTTPS policy. No breaking changes: existing projects keep their behavior until they opt in. Upgrade all five modules to v0.2.1 together. - Added security-header defaults and HTTPS policy (SEC-03). New settings: `HSTSSeconds` (`CICADEL_HSTS_SECONDS`), `SecureRedirect` (`CICADEL_SECURE_REDIRECT`), `TrustedProxies` (`CICADEL_TRUSTED_PROXIES`) and `ContentSecurityPolicy` (`CICADEL_CONTENT_SECURITY_POLICY`), with `settings.DefaultContentSecurityPolicy` and `settings.HSTSYear`. `security.IsHTTPS` reports HTTPS through TLS or a trusted proxy. Generated projects enable HSTS and the default policy; existing projects keep their behavior and get `check --deploy` warnings until they opt in. See `docs/security-headers.md`. - Added the versioning standard to `docs/releases.md`: patches carry fixes and backward-compatible additions, the minor version moves only when a milestone is complete, and v1.0 requires Django-level completeness. ## v0.2.0 — 2026-11-10 Adds pagination and flash messages, the first two open core gaps, and fixes two v0.1.0 problems. No breaking changes: upgrade all five modules to v0.2.0 together. - Added `paginate`: validated page parsing, ordered GORM pagination in one read-only snapshot, slice pagination, query-preserving relative links, Django-style elided page ranges and the accessible `paginate.Nav` component. - Fixed `management.ExitCode` returning success for errors whose wrapped cause is nil. `cicadel ui check` now exits 1 on type errors instead of 0, and `manage.go` commands report such failures. - The core modules now require each other at v0.1.0, so each builds on its own with `GOWORK=off`; v0.1.0's modules pinned an older framework revision without `App.Static`. CI builds the migrations and query-generation modules standalone. - Added `flash`: session-backed, consume-once messages with info/success/warning/error levels, size limits and the accessible `flash.List` component. See `docs/pagination-and-messages.md`. ## v0.1.0 — 2026-11-10 First release. The core framework is ready for building applications: projects and apps, settings, routing, GORM models with recorded PostgreSQL migrations, typed components with Tailwind and htmx, forms, accounts with sessions and CSRF, static files, email, logging, test helpers and installable packages. From this release, APIs follow the stability guarantee in `docs/releases.md`; the root module and the `contrib/accounts`, `contrib/formsets`, `contrib/migrations` and `contrib/querygen` modules are released together at the same version. Next: pagination and flash messages. Install: `go run github.com/fauzaanu/cicadel/cmd/cicadel@v0.1.0 startproject myapp example.com/myapp`. ### Changes included in v0.1.0 - Added typed static-file contributions: `App.Static` publishes app-owned public files at `/static//` with content-hashed, immutably cached URLs, revalidated authored names, `static.URL` request resolution, `settings.StaticURL`/`CICADEL_STATIC_URL` (local path or https CDN prefix) and an offline `collectstatic` command writing hashed files plus `manifest.json`. Accounts, the starter project, `startapp`, `startpackage` and the component-library example now use it; the `/accounts/style.css` and `/static/app.css` routes are replaced and `ComponentAssets` paths are now relative to `App.Static`. See `docs/static-files.md`. - Made accounts and formsets standard project defaults; added offline `makemigrations` and `generatequeries` management commands from the shared model registry. - Consolidated migration application, planning, verification, adoption and recovery on the recorded-history runner. Removed the separate `database.Migrate`/`Migrator` executor; existing Goose histories require verified adoption. - Preserved first-party handwritten SQL with reviewed historical manifests and verified legacy serial/unique/timestamp-default support. Updated application guides and installable contracts to describe core defaults. - Breaking: renamed Yutqin to Cicadel, including Go modules and packages, CLI executables, environment variables, generated artifacts, cache paths, and framework-owned database identifiers. - Added typed installable runtime model catalogs with explicit app/table/type ownership, offline validation and isolated discovery. Recorded migrations remain authoritative. - Completed application foundation tooling: all operational settings overrides and redacted diagnostics, sorted command help and exit statuses, structured/deployment checks, and safe component/CSS rebuild/restart through `cicadel dev`. Added generated-executable and reload acceptance tests; see `docs/foundation.md`. - Added a green-and-black Tailwind default theme and optional `startproject --accounts` browser starter with compiled login/recovery/reset/account/password-change pages, CSRF protection, PostgreSQL cookie sessions and shared account revocation. - Added SMTP with verified STARTTLS/implicit TLS, batch connection reuse, MIME alternatives and attachments, CC/BCC, reply-to and console/file/capture/discard backends. - Added named logging configuration with levels, filters, propagation, JSON/text/custom handlers, file rotation, optional error email, grouped credential redaction, correlated panic records and private GORM timing. - Reconciled current authentication, component, PostgreSQL migration, mail and logging documentation; administration remains a separate later battery. - Completed standalone typed forms and accessible widgets; added revision-based stale-edit detection, bounded upload fields with compensating cleanup and multipart CSRF integration, and atomic model-form/formset administration. See `docs/forms-completion.md`. - Added core `contrib/formsets`: bounded related-row collections with scoped identities, add/delete limits, parent locking, transactional hooks and atomic saves; added the core `Form.InTransaction` composition API. - Added `forms/model`: explicit GORM field allowlists, typed binding, scoped relationship checks, authorized row-locked updates, safe constraint errors and transactional validation/save hooks. Verified with PostgreSQL concurrency and rollback tests; see `docs/model-forms.md`. - Added the installable-app foundation: manifests, API/dependency compatibility checks, namespaced commands/checks/resources, route-scoped middleware and per-host startup/cleanup. - Added `startpackage`, generated `project/apps.go`, `manage.go apps`, and `apptest.Check`; tested independent Go-module install/upgrade/removal and PostgreSQL migration/data retention. - Implemented React/Cotton-inspired compiled component UI; retained legacy Go templates for compatibility and completed the component-engine acceptance checks. - Added a source-linked Django battery inventory with explicit support decisions and completion criteria. - Reclassified existing integrations as partial batteries; model-driven PostgreSQL migrations now have a documented supported subset, other database backends are excluded, and broader package-system contracts remain planned. - Removed the experimental native `locale` package; i18n/l10n and GIS are third-party-only by design. - Django-familiar project/app scaffolding, typed settings, explicit app registration and management commands. - Standard HTTP routing with namespaced reversal, escaped embedded templates, response helpers and static assets. - PostgreSQL/GORM integration and locked, versioned Goose migrations. - Sessions, password primitives, CSRF protection, bounded forms and explicit authorization. - Working articles and catalog/admin examples with real HTTP/database tests. - API helpers, mail transport/capture, bounded storage/cache, observability hooks and River jobs. - PostgreSQL integration/race tests, fuzz targets, generated-project validation, vulnerability checks and performance baselines. Requires Go 1.26.10+ to incorporate standard-library security fixes. No upgrade migration is required from a prior Cicadel release because none has been published by this implementation.