diff --git a/.changeset/share-smart-cdn-image-policy.md b/.changeset/share-smart-cdn-image-policy.md deleted file mode 100644 index 73e6855f..00000000 --- a/.changeset/share-smart-cdn-image-policy.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -"@transloadit/utils": patch ---- - -Add a framework-neutral `createSmartCdnImageCandidates` policy with an injected signer, and make -the existing Node candidate helper share it. Optional intrinsic source dimensions now prevent -upscaling and renditions whose derived height exceeds Smart CDN's image limit. Framework adapters -can reuse the exported format and width normalization instead of copying those limits. - -Candidate policy now distinguishes millisecond timestamps from accidentally seconds-based expiry -values and reports an invalid width by its index. Runtime `null` qualities are rejected consistently -with the exported TypeScript contract instead of being treated as an omitted format. - -Ignore a legacy caller-provided `sig` while signing instead of including a value that the generated -signature replaces, which could otherwise produce an unverifiable URL. -Unsigned URLs now omit caller-provided `auth_key`, `exp`, and `sig` fields so they remain -unambiguously unsigned and round-trip through the parser. - -Require callers to select a trusted workspace Template explicitly. The helper no longer defaults -to the arbitrary-origin `builtin/serve-image` Template. Require a separate browser `fallbackUrl` -because Template inputs are not necessarily browser-resolvable URLs. These intentional patch-level -replacements affect only the newly introduced, not-yet-adopted image-candidate API. diff --git a/packages/utils/CHANGELOG.md b/packages/utils/CHANGELOG.md index eea99c12..7ef8f394 100644 --- a/packages/utils/CHANGELOG.md +++ b/packages/utils/CHANGELOG.md @@ -1,5 +1,28 @@ # @transloadit/utils +## 4.7.1 + +### Patch Changes + +- ed75f00: Add a framework-neutral `createSmartCdnImageCandidates` policy with an injected signer, and make + the existing Node candidate helper share it. Optional intrinsic source dimensions now prevent + upscaling and renditions whose derived height exceeds Smart CDN's image limit. Framework adapters + can reuse the exported format and width normalization instead of copying those limits. + + Candidate policy now distinguishes millisecond timestamps from accidentally seconds-based expiry + values and reports an invalid width by its index. Runtime `null` qualities are rejected consistently + with the exported TypeScript contract instead of being treated as an omitted format. + + Ignore a legacy caller-provided `sig` while signing instead of including a value that the generated + signature replaces, which could otherwise produce an unverifiable URL. + Unsigned URLs now omit caller-provided `auth_key`, `exp`, and `sig` fields so they remain + unambiguously unsigned and round-trip through the parser. + + Require callers to select a trusted workspace Template explicitly. The helper no longer defaults + to the arbitrary-origin `builtin/serve-image` Template. Require a separate browser `fallbackUrl` + because Template inputs are not necessarily browser-resolvable URLs. These intentional patch-level + replacements affect only the newly introduced, not-yet-adopted image-candidate API. + ## 4.7.0 ### Minor Changes diff --git a/packages/utils/package.json b/packages/utils/package.json index 36e49b45..8a6b8aca 100644 --- a/packages/utils/package.json +++ b/packages/utils/package.json @@ -1,6 +1,6 @@ { "name": "@transloadit/utils", - "version": "4.7.0", + "version": "4.7.1", "description": "Transloadit shared utilities", "type": "module", "license": "MIT",