serve.zone/onebox
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 82 Wiki Activity

82 Releases 305 Tags

RSS Feed
  • v33.10.0 a3a1624b03
    Compare

    Onebox v33.10.0
    Release / build-and-release (push) Failing after 38m44s
    Details
    Stable

    philkunz released this 2026-10-06 20:08:25 +00:00 | 40 commits to main since this release

    2026-10-06 - 33.10.0

    Features

    • Bundle the Cloudly App Store template 1.23.0 for Cloudly 33.15.3 through @serve.zone/appstore 32.23.0, moved from 32.21.0 in package.json, pnpm-lock.yaml and the binary's deno.lock, so this release also brings template 1.22.0 for Cloudly 33.15.2. Onebox reads the App Store from the catalog this package bundles, so onebox appstore upgrade cloudly --version 1.23.0 needs this release. The template pins the Cloudly 33.15.3 image index code.foss.global/serve.zone/cloudly@sha256:7b761031eb3910deeff7eb3511b9ebaa8dd18dbdb3632326d3534883cbbe7687 and keeps minOneboxVersion 33.8.0, so Onebox 33.7.0 and earlier still refuse the upgrade with App requires Onebox >= 33.8.0; current version is <version>. 1.23.0 differs from 1.22.0, and 1.22.0 from 1.21.0, only in the image and changelog. Cloudly 33.15.3 keeps the data version 0.25.0, so an upgrade from 1.22.0, 1.21.0 or 1.20.0 runs no data step; an upgrade from 1.19.0 or earlier still runs the forward-only step runtime-log-attempts at Cloudly's first start, which every Cloudly before 33.15.0 refuses (DOWNGRADE_NOT_SUPPORTED), so stop Cloudly and take a verified backup (onebox backup create cloudly) before upgrading, and a rollback is onebox backup restore <backup-id> of that backup. Cloudly 33.15.3 serves a promoted route, which under 33.15.2 still never reached CoreTraffic: a route's identity carried the service's runtime write fence runtimeAuthorityFenceGeneration, which every runtime write of the service advances, the route join's own workload lease read in a Pallet-born cluster included, so the route plan read after the cluster ingress's certificate fetch never matched and every refresh that fetched a certificate withdrew the cluster's whole route table. A route's identity now carries only the versions that change with its authority (the route intent, the runtime policy revision, and per endpoint its assignment, its node's session and its target), so a revoked route is still withdrawn by name. A withdrawn table names its withdrawal as the reason the cluster ingress serves none of its routes, which a failing route verification states; that reason states facts about its own route only, since one table carries the routes of several organizations, and a source-read failure keeps its error in the operator log. From 1.21.0 or earlier the Cloudly 33.15.2 changes apply too: a route's identity carries the route intent version routeIntentGeneration instead of the whole-document routeStateGeneration, so the status writes during the certificate fetch no longer change it, and a plan change during the fetch withdraws the route table only when it revokes a route the table is about to serve, naming the change by route and input. A cluster ingress flow that a compensated promotion withdrew and a later promotion wants again no longer stalls the node's network projection: Cloudly holds that flow back visibly with its withdrawal carried and signs the rest of the node's network, while a workload or router grant wanted again while withdrawn withholds the node's projection as withdrawn-grant-reissued and any other contract refusal as projection-rejected, each naming what it holds. Known limit: a held flow is granted again only once the target or CoreTraffic runs under a new lease. Onebox enforces only minOneboxVersion; the other flags and the template changelog are the operator's. The App Store upgrade test now prepares the 1.23.0 upgrade from installs of 1.2.1 through 1.22.0 on Onebox 33.8.0, checks that 1.23.0 differs from 1.22.0 only in its image and changelog, and checks that Onebox 33.7.0 refuses it from 1.19.0 with that exact message. App Store 32.23.0 keeps @serve.zone/interfaces 32.42.0, so no other serve.zone package moves. deno.lock was re-resolved from https://registry.npmjs.org/ after a build and changes only the App Store entry, pinned by SHA-512. In pnpm-lock.yaml only the App Store entry changes, pinned by SHA-512.

    Maintenance

    • Release tooling: @git.zone/tsbundle 3.1.3 → 3.1.4, @git.zone/tswatch 6.0.1 → 7.0.0 (its breaking changes concern applications that embed TsWatch; the tswatch CLI and this project's watch configuration are unchanged). pnpm stays at 12.8.1 and @types/node at 26.6.3 until their newer releases are seven days old; @git.zone/tsdeno stays on 1.x (the 2.0 lockfile model is its own lane).
    Downloads