[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@internal/desktop-client@1.5.1

Patch Changes

• Updated dependencies [c43bbbe]:
  • @internal/node@3.1.1

@internal/docs@0.11.3

Patch Changes

• #467 c43bbbe Thanks @theogravity! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page.

  Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to ::1 is now watched as well as listed, since discovery and the bridge both ask loopback's two families.

  A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering application/xhtml+xml counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server.

  Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping.

  Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions.

@internal/node@3.1.1

Patch Changes

• #467 c43bbbe Thanks @theogravity! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page.

  Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to ::1 is now watched as well as listed, since discovery and the bridge both ask loopback's two families.

  A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering application/xhtml+xml counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server.

  Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping.

  Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions.

@internal/server@3.0.4

Patch Changes

• #467 c43bbbe Thanks @theogravity! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page.

  Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to ::1 is now watched as well as listed, since discovery and the bridge both ask loopback's two families.

  A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering application/xhtml+xml counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server.

  Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping.

  Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions.

• #468 433d012 Thanks @theogravity! - Update the web interface's Seroval dependency to fix serialization injection and deserialization denial-of-service vulnerabilities.

@internal/desktop-server@1.7.1

Patch Changes

• #468 433d012 Thanks @theogravity! - Update the web interface's Seroval dependency to fix serialization injection and deserialization denial-of-service vulnerabilities.
• Updated dependencies [c43bbbe, 433d012]:
  • @internal/server@3.0.4