From e73cfb6b4773d1af5d794b7588d6319d2d583c03 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 03:55:04 +0000 Subject: [PATCH] Publish packages --- .../guard-receivers-against-detached-nodes.md | 14 -------------- examples/custom-element/CHANGELOG.md | 7 +++++++ examples/custom-element/package.json | 2 +- examples/getting-started/CHANGELOG.md | 7 +++++++ examples/getting-started/package.json | 2 +- examples/kitchen-sink/CHANGELOG.md | 8 ++++++++ examples/kitchen-sink/package.json | 2 +- packages/core/CHANGELOG.md | 14 ++++++++++++++ packages/core/package.json | 2 +- packages/signals/CHANGELOG.md | 17 +++++++++++++++++ packages/signals/package.json | 4 ++-- pnpm-lock.yaml | 2 +- 12 files changed, 60 insertions(+), 21 deletions(-) delete mode 100644 .changeset/guard-receivers-against-detached-nodes.md diff --git a/.changeset/guard-receivers-against-detached-nodes.md b/.changeset/guard-receivers-against-detached-nodes.md deleted file mode 100644 index 7b651dc0..00000000 --- a/.changeset/guard-receivers-against-detached-nodes.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -'@remote-dom/signals': patch -'@remote-dom/core': patch ---- - -Guard receivers against late mutations on detached nodes - -`RemoteReceiver` and `SignalRemoteReceiver` now drop `insertChild`, `removeChild`, `updateProperty`, and `updateText` mutations whose target node is no longer in the receiver's `attached` map, instead of throwing a `TypeError` while dereferencing the missing node. - -This race surfaces in production as unhandled promise rejections such as `TypeError: undefined is not an object (evaluating 'x.properties')` (Safari) / `TypeError: Cannot read properties of undefined (reading 'properties')` (V8) when a remote sender dispatches a mutation for a node whose host-side state has just been removed (for example, a `removeChild` for an ancestor was processed earlier in the same batch, or arrived first from a separate batched payload). - -PR #533 previously added a similar guard to `removeChild` for the case where the _child slot_ at a given index was empty, but did not handle the case where the _parent itself_ was missing, and did not touch `updateProperty` or `updateText`. This change applies the same defensive pattern uniformly to every connection callback that dereferences `attached.get(id)`. - -Late mutations targeting a detached subtree are by definition no-ops — there is nothing left to mutate. diff --git a/examples/custom-element/CHANGELOG.md b/examples/custom-element/CHANGELOG.md index 498fbbd7..442372ac 100644 --- a/examples/custom-element/CHANGELOG.md +++ b/examples/custom-element/CHANGELOG.md @@ -1,5 +1,12 @@ # example-custom-element +## 0.0.26 + +### Patch Changes + +- Updated dependencies [[`f20f6e7`](https://github.com/Shopify/remote-dom/commit/f20f6e75cbd20d673cb32b76f582e0199055d27d)]: + - @remote-dom/core@1.11.1 + ## 0.0.25 ### Patch Changes diff --git a/examples/custom-element/package.json b/examples/custom-element/package.json index 4a92bfe9..1521f148 100644 --- a/examples/custom-element/package.json +++ b/examples/custom-element/package.json @@ -1,6 +1,6 @@ { "name": "example-custom-element", - "version": "0.0.25", + "version": "0.0.26", "type": "module", "private": true, "scripts": { diff --git a/examples/getting-started/CHANGELOG.md b/examples/getting-started/CHANGELOG.md index f109724c..9c992025 100644 --- a/examples/getting-started/CHANGELOG.md +++ b/examples/getting-started/CHANGELOG.md @@ -1,5 +1,12 @@ # example-getting-started +## 0.0.26 + +### Patch Changes + +- Updated dependencies [[`f20f6e7`](https://github.com/Shopify/remote-dom/commit/f20f6e75cbd20d673cb32b76f582e0199055d27d)]: + - @remote-dom/core@1.11.1 + ## 0.0.25 ### Patch Changes diff --git a/examples/getting-started/package.json b/examples/getting-started/package.json index e58a2b4e..869f1bf3 100644 --- a/examples/getting-started/package.json +++ b/examples/getting-started/package.json @@ -1,6 +1,6 @@ { "name": "example-getting-started", - "version": "0.0.25", + "version": "0.0.26", "type": "module", "private": true, "scripts": { diff --git a/examples/kitchen-sink/CHANGELOG.md b/examples/kitchen-sink/CHANGELOG.md index 11d41927..090cc808 100644 --- a/examples/kitchen-sink/CHANGELOG.md +++ b/examples/kitchen-sink/CHANGELOG.md @@ -1,5 +1,13 @@ # example-kitchen-sink +## 0.0.33 + +### Patch Changes + +- Updated dependencies [[`f20f6e7`](https://github.com/Shopify/remote-dom/commit/f20f6e75cbd20d673cb32b76f582e0199055d27d)]: + - @remote-dom/signals@2.1.1 + - @remote-dom/core@1.11.1 + ## 0.0.32 ### Patch Changes diff --git a/examples/kitchen-sink/package.json b/examples/kitchen-sink/package.json index dc4f78db..3c66f6d2 100644 --- a/examples/kitchen-sink/package.json +++ b/examples/kitchen-sink/package.json @@ -2,7 +2,7 @@ "name": "example-kitchen-sink", "type": "module", "private": true, - "version": "0.0.32", + "version": "0.0.33", "scripts": { "start": "vite" }, diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index 2eaa6439..a50f30f2 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,19 @@ # @remote-dom/core +## 1.11.1 + +### Patch Changes + +- [#611](https://github.com/Shopify/remote-dom/pull/611) [`f20f6e7`](https://github.com/Shopify/remote-dom/commit/f20f6e75cbd20d673cb32b76f582e0199055d27d) Thanks [@eddiechan](https://github.com/eddiechan)! - Guard receivers against late mutations on detached nodes + + `RemoteReceiver` and `SignalRemoteReceiver` now drop `insertChild`, `removeChild`, `updateProperty`, and `updateText` mutations whose target node is no longer in the receiver's `attached` map, instead of throwing a `TypeError` while dereferencing the missing node. + + This race surfaces in production as unhandled promise rejections such as `TypeError: undefined is not an object (evaluating 'x.properties')` (Safari) / `TypeError: Cannot read properties of undefined (reading 'properties')` (V8) when a remote sender dispatches a mutation for a node whose host-side state has just been removed (for example, a `removeChild` for an ancestor was processed earlier in the same batch, or arrived first from a separate batched payload). + + PR #533 previously added a similar guard to `removeChild` for the case where the _child slot_ at a given index was empty, but did not handle the case where the _parent itself_ was missing, and did not touch `updateProperty` or `updateText`. This change applies the same defensive pattern uniformly to every connection callback that dereferences `attached.get(id)`. + + Late mutations targeting a detached subtree are by definition no-ops — there is nothing left to mutate. + ## 1.11.0 ### Minor Changes diff --git a/packages/core/package.json b/packages/core/package.json index f91849eb..521b0310 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -7,7 +7,7 @@ "access": "public", "@remote-dom/registry": "https://registry.npmjs.org" }, - "version": "1.11.0", + "version": "1.11.1", "engines": { "node": ">=14.0.0" }, diff --git a/packages/signals/CHANGELOG.md b/packages/signals/CHANGELOG.md index 33a2f173..08984730 100644 --- a/packages/signals/CHANGELOG.md +++ b/packages/signals/CHANGELOG.md @@ -1,5 +1,22 @@ # @remote-dom/signals +## 2.1.1 + +### Patch Changes + +- [#611](https://github.com/Shopify/remote-dom/pull/611) [`f20f6e7`](https://github.com/Shopify/remote-dom/commit/f20f6e75cbd20d673cb32b76f582e0199055d27d) Thanks [@eddiechan](https://github.com/eddiechan)! - Guard receivers against late mutations on detached nodes + + `RemoteReceiver` and `SignalRemoteReceiver` now drop `insertChild`, `removeChild`, `updateProperty`, and `updateText` mutations whose target node is no longer in the receiver's `attached` map, instead of throwing a `TypeError` while dereferencing the missing node. + + This race surfaces in production as unhandled promise rejections such as `TypeError: undefined is not an object (evaluating 'x.properties')` (Safari) / `TypeError: Cannot read properties of undefined (reading 'properties')` (V8) when a remote sender dispatches a mutation for a node whose host-side state has just been removed (for example, a `removeChild` for an ancestor was processed earlier in the same batch, or arrived first from a separate batched payload). + + PR #533 previously added a similar guard to `removeChild` for the case where the _child slot_ at a given index was empty, but did not handle the case where the _parent itself_ was missing, and did not touch `updateProperty` or `updateText`. This change applies the same defensive pattern uniformly to every connection callback that dereferences `attached.get(id)`. + + Late mutations targeting a detached subtree are by definition no-ops — there is nothing left to mutate. + +- Updated dependencies [[`f20f6e7`](https://github.com/Shopify/remote-dom/commit/f20f6e75cbd20d673cb32b76f582e0199055d27d)]: + - @remote-dom/core@1.11.1 + ## 2.1.0 ### Minor Changes diff --git a/packages/signals/package.json b/packages/signals/package.json index 286218b8..752fad65 100644 --- a/packages/signals/package.json +++ b/packages/signals/package.json @@ -6,7 +6,7 @@ "access": "public", "@remote-dom/registry": "https://registry.npmjs.org" }, - "version": "2.1.0", + "version": "2.1.1", "engines": { "node": ">=14.0.0" }, @@ -43,6 +43,6 @@ "defaults and not dead" ], "dependencies": { - "@remote-dom/core": "workspace:^1.7.0" + "@remote-dom/core": "workspace:^1.11.1" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c4b8fe4d..8f90b71d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -216,7 +216,7 @@ importers: packages/signals: dependencies: '@remote-dom/core': - specifier: workspace:^1.7.0 + specifier: workspace:^1.11.1 version: link:../core devDependencies: '@preact/signals-core':