From 76d788821ac1e6aaa3b8fb4bf2c824938cc6920a Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Thu, 15 Oct 2026 23:14:08 +0200 Subject: [PATCH] docs: decide to release the 19.3 gap closure as v0.2.0 --- .planning/notes/2026-10-15-release-v0-2-0.md | 21 ++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .planning/notes/2026-10-15-release-v0-2-0.md diff --git a/.planning/notes/2026-10-15-release-v0-2-0.md b/.planning/notes/2026-10-15-release-v0-2-0.md new file mode 100644 index 0000000..53bf48d --- /dev/null +++ b/.planning/notes/2026-10-15-release-v0-2-0.md @@ -0,0 +1,21 @@ +# Release the 19.3 gap closure as v0.2.0, not v0.1.28 + +**Date:** 2026-10-15 +**Decision:** The next framework tag after v0.1.27 is **v0.2.0**. + +## Why + +The 19.3-06 review fixes include changes that can make an app that boots on v0.1.27 refuse to boot after the upgrade: + +- WR-05: in production, a token cookie whose `Secure` is inferred as false (http or empty `app.url`) is refused at boot. +- WR-04: credentialed CORS refuses wildcard-host and unanchored origin patterns at boot. + +Smaller behaviour changes ride along: site-cache purges run queued after commit (WR-01), protected uploads into a `public_url` bucket are refused (WR-07), Journal's old purge keys are deprecated aliases. + +In a v0.x Go module the minor version is the signal for "check your config before upgrading". Consumers pin exact versions, so the bump costs nothing technically. + +## Consequences + +- Plugins and apps move with `go get git.golem15.com/golem15/summercms@v0.2.0`. +- The docs and the release notes carry an "Upgrading to 0.2" section naming the two boot refusals and the config that fixes each. +- From here, the minor version is bumped when an upgrade can refuse a previously valid config or changes a documented behaviour; patch versions stay safe to take without reading.