CHANGELOG.md

@cloudflare/quick-edit

0.4.7

Patch Changes

• #14314 5c3bb11 Thanks @harryzcy! - Bump esbuild to 0.28.1

  This update includes several bug fixes from esbuild versions 0.27.3 through 0.28.1. See the esbuild changelog for details.

0.4.6

Patch Changes

• #12823 784c5cb Thanks @petebacondarwin! - Add frame-ancestors CSP and postMessage origin validation to quick-edit

  Mitigate postMessage origin bypass:

  • Add Content-Security-Policy frame-ancestors header to quick-edit Worker responses, restricting which origins can embed the editor iframe
  • Add client-side origin validation to the window.onmessage handler in workbench.ts, rejecting PORT messages from untrusted origins
  • Inject allowed parent origins from server into HTML for client-side use
  • Localhost origins are conditionally included when running via wrangler dev

0.4.5

Patch Changes

• #12154 e36c0c9 Thanks @petebacondarwin! - Use X-Forwarded-Host header for extension authority when behind a proxy

  When Quick Edit is accessed through a proxy, the X-Forwarded-Host header is now used to determine the authority for loading builtin extensions. This ensures extensions load correctly when the Worker is behind a reverse proxy. The header value is only used if it matches *.devprod.cloudflare.dev for security.

0.4.4

Patch Changes

• #11878 e84e8fa Thanks @dario-piotrowicz! - Fix relative path computation when the root folder name appears multiple times in a path

  Previously, the logic assumed the root folder appeared exactly once in the path. When the root folder name appeared more than once, file modifications were not correctly detected.

  For example, if the root folder is my-worker, a path like /my-worker/my-worker/util.js would incorrectly return / instead of /my-worker/util.js.

0.4.3

Patch Changes

• #11448 2b4813b Thanks @edmundhung! - Builds package with esbuild v0.27.0

0.4.2

Patch Changes

• #10347 2e5b880 Thanks @petebacondarwin! - bump the quick editor version to trigger a release

0.4.1

Patch Changes

• #10338 d419fd8 Thanks @CarmenPopoviciu! - Dummy changeset

0.4.0

Minor Changes

• #10047 a4c4c5b Thanks @penalosa! - Bump base VSCode version for Quick Edit & Playground to 1.102.1

0.3.3

Patch Changes

• #9649 ec9b417 Thanks @petebacondarwin! - patch release to trigger a test release

0.3.2

Patch Changes

• #7040 44c954b Thanks @penalosa! - Try and ensure the d.ts types are definitely the ones loaded in quick-edit-extension

0.3.1

Patch Changes

• #6998 720a91d Thanks @edmundhung! - chore: fix build config

0.3.0

Minor Changes

• #6962 a204747 Thanks @edmundhung! - feat: lower autosave delay to 200ms

0.2.3

Patch Changes

• #6850 ce41da5 Thanks @penalosa! - fix: Re-release Quick Edit to update included workers-types

0.2.2

Patch Changes

• #6806 4db75e1 Thanks @penalosa! - chore: Revert "fix(quick-edit): disable autosave"

0.2.1

Patch Changes

• #6738 d818634 Thanks @edmundhung! - fix: set readOnly property when writing files

0.2.0

Minor Changes

• #6708 31bfd37 Thanks @penalosa! - chore: Trigger a re-deploy

0.1.1

Patch Changes

• #6624 66f5b25 Thanks @edmundhung! - fix: quick editor deploy script setup

0.1.0

Minor Changes

• #6546 addb210 Thanks @edmundhung! - feat: hide wrangler.toml and package.json with search.exclude support added

0.0.2

Patch Changes

• #6558 2a5b648 Thanks @edmundhung! - fix: disable autosave on quick editor to avoid context reset without explicit user action

0.0.1

Patch Changes

• #6029 f5ad1d3 Thanks @threepointone! - chore: Normalize some dependencies in workers-sdk

  This is the first of a few expected patches that normalize dependency versions, This normalizes undici, concurrently, @types/node, react, react-dom, @types/react, @types/react-dom, eslint, typescript. There are no functional code changes (but there are a couple of typecheck fixes).