docs(roadmap): close it out — every item shipped or a stated non-goal - #30
Merged
Conversation
The roadmap was written two days ago as a list of things nobody had decided yet. All of it is now decided, and leaving the file describing open questions that are closed makes it the kind of stale planning doc JS-012 said was worse than none. Next now carries a table of outcomes instead of a queue, plus the one named piece of work left — OkHttp's redirect hops, in parity.md — with the reason it is not stacked onto a release that already carries a breaking change, and an honest note that its residual risk is narrower than it sounds: the host allowlist and private-IP filter still hold per hop, so what gets through is the same allowlisted host on another port or scheme. Removed the CI-matrix candidate. It claimed "CI is still a single Node 22 job", which stopped being true when the runtime matrix landed — a candidate contradicting the table two sections above it. Removed the JS-demo candidate; it shipped as ssrf-guard-js-workers-demo. Candidates now holds exactly one entry, the deliberately-deferred HTTP client adapters, kept written down so the question is not re-asked from scratch. The preamble says that rather than still promising proposals. Also recorded the three dated, release-less entries in Shipped — the bilingual site, the parity audit and the demo — since work that ships without a version number is exactly what a Shipped table forgets. Also noted that AskLinq's not adopting createHonoUrlGuard is a finding, not a gap: every URL it accepts is one it must then lock to, so there is no static allowlist for a middleware to enforce.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
버전 범프 없음. 문서만 바뀝니다.
로드맵을 이틀 전에 "아직 아무도 정하지 않은 것들의 목록" 으로 썼습니다. 이제 전부 정해졌는데, 파일이 여전히 열린 질문을 서술하고 있으면 JS-012가 "없느니만 못하다"고 한 그 낡은 계획 문서가 됩니다.
바뀐 것
Next 가 대기열이 아니라 결과 표를 담습니다:
maxBytessingleHostPolicy, Hono 미들웨어/, 한국어/ko/ssrf-guard-js-workers-demo이름이 붙은 남은 작업 하나(OkHttp 리다이렉트 홉)와, 그걸 파괴적 변경을 이미 실은 릴리스에 얹지 않는 이유를 적었습니다. 그리고 정직하게: 잔여 위험이 들리는 것보다 좁습니다 — 호스트 허용 목록과 사설 IP 필터는 홉마다 여전히 작동하므로, 빠져나가는 건 허용된 같은 호스트의 다른 포트·스킴입니다.
지운 것
CI 매트릭스 후보 — "CI는 아직 Node 22 단일 잡" 이라고 주장하는데, 런타임 매트릭스가 들어오면서 사실이 아니게 됐습니다. 두 절 위의 표와 모순되는 후보였습니다.
JS 데모 후보 —
ssrf-guard-js-workers-demo로 출시됐습니다.후보에는 이제 의도적 보류인 HTTP 클라이언트 어댑터 하나만 남습니다. 같은 질문을 매번 처음부터 다시 하지 않도록 적어둡니다. 서문도 "제안을 기다린다"가 아니라 그렇게 말합니다.
추가한 것
날짜만 있고 버전이 없는 항목 3건을 Shipped에 넣었습니다 — 이중 언어 사이트, 정합성 감사, 데모. 버전 번호 없이 나간 일이야말로 Shipped 표가 잊어버리는 것이라서요.
그리고 AskLinq가
createHonoUrlGuard를 안 쓰는 건 갭이 아니라 발견이라고 적었습니다 — 그 제품이 받는 모든 URL은 곧 거기에 잠가야 할 URL이라, 미들웨어가 강제할 정적 허용 목록이 없습니다.검증
pnpm verify그린 (223 테스트 / 15파일).