GOWDK v0.12.3

Experimental 0.x Release: GOWDK v0.12.3

GOWDK v0.12.3 is an experimental 0.x compiler/runtime release.

Not production-ready. Public syntax, generated output, runtime packages, and tooling contracts may change before 1.0.

0.12.3 (2026-07-07)

Bug Fixes

• clean up example fragment markup and smoke inventory (#795) (8f7e36a)
• generated-output: publish artifacts transactionally (#796) (5217095)

Artifact Verification

Download the CLI artifact for your platform and checksums.txt from this GitHub release.

grep ' <artifact>$' checksums.txt | sha256sum -c -

On macOS, use:

shasum -a 256 <artifact>

Verify GitHub artifact attestations:

gh attestation verify <artifact> -R cssbruno/GOWDK

GOWDK v0.12.2

Experimental 0.x Release: GOWDK v0.12.2

GOWDK v0.12.2 is an experimental 0.x compiler/runtime release.

Not production-ready. Public syntax, generated output, runtime packages, and tooling contracts may change before 1.0.

0.12.2 (2026-06-27)

Bug Fixes

• app: do not trust Host alone for local trace viewer access (#783) (0492260)
• app: skip csrf injection for off-origin post forms (#785) (7adb9ef)
• compiler: align generated apps and typed IR (#787) (c2cf66c)
• realtime: scope sse streams by authorized route (#786) (419ed3f)
• trace: redact browser trace URL query data (#784) (ab24801)

Artifact Verification

Download the CLI artifact for your platform and checksums.txt from this GitHub release.

grep ' <artifact>$' checksums.txt | sha256sum -c -

On macOS, use:

shasum -a 256 <artifact>

Verify GitHub artifact attestations:

gh attestation verify <artifact> -R cssbruno/GOWDK

GOWDK v0.12.1

Experimental 0.x Release: GOWDK v0.12.1

GOWDK v0.12.1 is an experimental 0.x compiler/runtime release.

Not production-ready. Public syntax, generated output, runtime packages, and tooling contracts may change before 1.0.

0.12.1 (2026-06-27)

Bug Fixes

• config: harden CORS, addons, CSS, and artifact scans (#756) (0ffab59)
• examples: harden runnable example flows (#770) (d3b8c78)
• gowdkcmd: preserve delegated helper source paths (#750) (935d9ae)
• release: require conventional PR titles (#757) (58e99ef)
• support config helper source checkout builds (#746) (15a52b7)

Artifact Verification

Download the CLI artifact for your platform and checksums.txt from this GitHub release.

grep ' <artifact>$' checksums.txt | sha256sum -c -

On macOS, use:

shasum -a 256 <artifact>

Verify GitHub artifact attestations:

gh attestation verify <artifact> -R cssbruno/GOWDK

GOWDK v0.12.0

Experimental 0.x Release: GOWDK v0.12.0

GOWDK v0.12.0 is an experimental 0.x compiler/runtime release.

Not production-ready. Public syntax, generated output, runtime packages, and tooling contracts may change before 1.0.

0.12.0 (2026-06-26)

Features

• compiler: complete API, hybrid, and realtime contracts (#710) (c6fbc57)
• contracts: generate worker and cron role binaries (#690) (945e611)
• security: harden auth sessions and release inputs (#691) (3f5010d)

Bug Fixes

• automate release changelog notes (#741) (3809963)
• tooling: harden validation and development HTTP paths (#699) (bab0e50)

Artifact Verification

Download the CLI artifact for your platform and checksums.txt from this GitHub release.

grep ' <artifact>$' checksums.txt | sha256sum -c -

On macOS, use:

shasum -a 256 <artifact>

Verify GitHub artifact attestations:

gh attestation verify <artifact> -R cssbruno/GOWDK

v0.11.0

0.11.0 (2026-06-24)

Features

• contracts: generate worker and cron role binaries (#690) (945e611)
• security: harden auth sessions and release inputs (#691) (3f5010d)

Bug Fixes

• tooling: harden validation and development HTTP paths (#699) (bab0e50)

GOWDK v0.10.0

What's Changed

• [codex] add gowdk test and runtime race lane by @cssbruno in #662
• feat(compiler): remove action render mode by @cssbruno in #680
• [codex] complete #631 #637 #643 #644 by @cssbruno in #682
• chore(main): release 0.10.0 by @cssbruno in #681

Full Changelog: v0.9.0...v0.10.0

GOWDK v0.9.0

What's Changed

• feat(audit): CI-native audit output (JSON Schema, SARIF, fingerprints, diff, waivers) by @cssbruno in #629
• chore(main): release 0.9.0 by @cssbruno in #630

Full Changelog: v0.8.0...v0.9.0

GOWDK v0.8.0

What's Changed

• [codex] remove obsolete docs by @cssbruno in #500
• chore: complete GOWDK hardening issue sweep by @cssbruno in #513
• fix(compiler): give g:for row-body diagnostics exact source ranges by @cssbruno in #516
• refactor(view): split renderer and share client expression spec by @cssbruno in #521
• feat(fmt): move gowdk fmt to parser-backed formatting by @cssbruno in #530
• feat(dev): surface runtime overlay and exact client ranges by @cssbruno in #522
• chore: remove dead CLI wrappers and a stale manifest reference by @cssbruno in #533
• Fix runtime hardening follow-ups by @cssbruno in #534
• chore(docs-site): import documentation site into the monorepo by @cssbruno in #523
• fix: security & correctness hardening batch (#535-#545) by @cssbruno in #547
• [codex] add bounded await blocks by @cssbruno in #548
• feat(docs-site): deploy as a Go binary on Render by @cssbruno in #546
• fix(docs-site): deploy docs site as a Go web service via root Blueprint by @cssbruno in #572
• fix(docs-site): root the Render service at the repo root, not docs-site by @cssbruno in #573
• [codex] Add bounded markup motion hooks by @cssbruno in #574
• [codex] Move docs-site Render blueprint into docs-site by @cssbruno in #596
• [codex] Avoid docs-site generated output embed by @cssbruno in #597
• [codex] Check in docs-site generated output by @cssbruno in #598
• [codex] docs: clarify SSR contract client runtime output by @cssbruno in #600
• [codex] fix runtime hardening gaps by @cssbruno in #599
• feat(api): add CORS policy for generated endpoints by @cssbruno in #601
• [Client] switch/match expressions and helper locals by @cssbruno in #603
• fix(audit): enrich security audit posture by @cssbruno in #602
• feat(actions): add multipart action uploads by @cssbruno in #604
• feat(compiler): add typed SSR load result accessors by @cssbruno in #606
• [i18n] Add localization route contract by @cssbruno in #605
• fix(dev): hold the runtime port instead of probe-then-reuse by @cssbruno in #609
• feat(ssr): add typed and layout error boundaries by @cssbruno in #607
• Harden tracing surfaces and constrain audit --run by @cssbruno in #608
• docs: fix server-lane terminology, addon/status drift, and Current-Limit framing after v0.6.0 by @cssbruno in #610
• feat(audit): effective request/header/raw-HTML/CORS posture + baseline alignment (#586–#590) by @cssbruno in #611
• [Contracts] cover nil registry edge cases by @cssbruno in #614
• [codex] cover contract error redaction by @cssbruno in #612
• feat(compiler): bounded build-time iteration and transforms (#511) by @cssbruno in #613
• fix(audit): harden audit tests and trace ingestion by @cssbruno in #619
• docs(architecture): client interactivity & communication model plan (#520) by @cssbruno in #618
• [Runtime] cover hardening bug batch by @cssbruno in #620
• feat(client): deterministic formatting, date/time, and selection builtins (#512) by @cssbruno in #615
• fix(compiler): address build-time iteration review feedback (#511) by @cssbruno in #621
• fix: harden trace context propagation and collector ingest by @cssbruno in #622
• docs(architecture): decide pure Go helpers from the bounded client (ADR 0016, #519) by @cssbruno in #616
• docs(architecture): callback props + scoped cells for parent-child (ADR 0017, #518) by @cssbruno in #617
• fix: scope realtime fanout and observability health by @cssbruno in #623
• feat(audit): evidence classification, explicit waivers, stale-test detection, OTLP primitives by @cssbruno in #624
• feat(audit): CI-native output — JSON Schema, SARIF, fingerprints, diff, exit codes by @cssbruno in #625
• ci(release): release-please auto-versioning + PR labeler by @cssbruno in #626
• docs(release): version-agnostic install snippets + drift guardrail by @cssbruno in #628
• chore(main): release 0.8.0 by @cssbruno in #627

Full Changelog: v0.7.0...v0.8.0

GOWDK v0.7.0

What's Changed

• feat(cli): add env file loading by @cssbruno in #470
• refactor(runtime): split addon runtime helpers by @cssbruno in #469
• chore(release): bump to 0.6.1 by @cssbruno in #471
• [codex] Conclude parser spine and adapter hardening by @cssbruno in #476
• [codex] Fix routing matrix and request-time layout wiring by @cssbruno in #477
• [codex] fix routes endpoint visibility by @cssbruno in #483
• fix related route diagnostics by @cssbruno in #487
• fix(ssr): ship client runtime on request-time pages + warn on g:command write forms (#484) by @cssbruno in #490
• [codex] fix auth addon guard wiring and fmt nesting by @cssbruno in #494
• feat(contracts): single-flight g:command client write path (#491) by @cssbruno in #492
• feat(contracts): true HTML-embedded single-flight for g:command (#493) by @cssbruno in #496
• [codex] add generated binary lifecycle services by @cssbruno in #495
• [codex] implement route params tracing and wasm stores by @cssbruno in #497
• [codex] Fix inspector schemas, head metadata, and diagnostics by @cssbruno in #498
• chore(release): bump to 0.7.0 by @cssbruno in #499

Full Changelog: v0.6.0...v0.7.0

GOWDK v0.6.0

Experimental 0.x release: GOWDK v0.6

GOWDK v0.6 continues the 0.x line.

Not production-ready. Public syntax, generated output, runtime packages, and
tooling contracts may change before 1.0.

Breaking

• The lane model. GOWDK's three execution lanes — build-time, request-time
  on the server, and the browser — are now named consistently, and g:for/g:if
  infer their lane from the data they touch.

  • load {} → server {} and go ssr {} → go server {} (the request-time
    server lane). go build {} is the explicit form of the default go {}.
  • A server {} block implies request-time rendering (no separate render mode).
  • g:each → g:for and g:when → g:if. Over a server {} field they render
    server-side; over client state/store they bind a reactive island. A
    top-level server g:if accepts a full bool expression
    (g:if={count > 0 && status == "open"}) evaluated at request time.
  • The removed keywords (load, go ssr, g:each, g:when) parse to a precise
    migration nudge — no silent aliases.
  • Internal SSR naming (the addons/ssr package, the "ssr" addon, the
    gowdk.SSR render mode, ssr.LoadContext, and the Load<PageID> handler
    convention) is unchanged. SSR remains the rendering technique that powers the
    server lane.

  Migration: rename load {}→server {}, go ssr {}→go server {},
  g:each={x in xs}→g:for={x in xs}, and g:when={f}→g:if={f}. See
  CHANGELOG.md and docs/language/ssr.md for the full contract.

• g:html → g:unsafe-html. The raw-HTML escape hatch is renamed so its XSS
  surface is explicit at every call site; the old name parses to a nudge.

Changed

• gowdk version and the VS Code extension metadata report 0.6.0.

Implemented

• OS-level playground sandbox for gowdk playground run --allow-hosted-execution
  (namespaced, pivot_rooted, no network, fails closed when unavailable).
• Addon lifecycle contract documentation and a computed addon version handshake.
• A real-world Go interop example delegating behavior to the standard library.

Partial / Planned

• Compound server g:if is supported at the top level; inside a server row a
  conditional is a single field. Function calls are not evaluated server-side
  (compute in Go and expose a field).
• The 0.x hardening checklist in docs/engineering/release-plan.md still governs
  what is implemented, partial, and planned. No minor version is a
  production-readiness target.

Intentionally out of scope

• No production-readiness claim. The compiler, generated runtime, and docs
  continue through the 0.x line.