| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-10-22 | 1.9 kB | |
| v7.0.0 source code.tar.gz | 2026-10-22 | 1.9 MB | |
| v7.0.0 source code.zip | 2026-10-22 | 1.9 MB | |
| Totals: 3 Items | 3.8 MB | 0 | |
- https://github.com/share/sharedb/pull/725 — 💥 BREAKING: Reject json0 ops that
ot-json0can only apply- A json0 op that isn't an array of components (eg a bare
{p: ['x'], oi: 1}) used to commit as a silent no-op, and crashed servers using$fixup(). It's now rejected withERR_OT_OP_BADLY_FORMED. doc.submitOp()is unaffected, since it already normalizes ops. Code callingbackend.submit()directly should wrap bare components in an array:[{p: ['x'], oi: 1}]doc.submitOp()now calls back with an error instead of throwing if the type throws while normalizing the op
- A json0 op that isn't an array of components (eg a bare
- https://github.com/share/sharedb/security/advisories/GHSA-94fr-2wj7-v4vj, https://github.com/share/sharedb/security/advisories/GHSA-4fp7-5cq7-7mr6 — Type-check the versions, ids and collections clients send
- Fixes an issue where a message with an unconvertible value (eg
{toString: 1}) could crash a ShareDB server process - Fixes an issue where a non-string query collection name could let a client bypass access checks in
queryandreadSnapshotsmiddleware - Thanks to @shreyanshj10 for the original crash fix in #742, and to @dawidreedsy for reporting the middleware bypass!
- Fixes an issue where a message with an unconvertible value (eg
- https://github.com/share/sharedb/pull/743 — Stop a failed
subscribeBulk()orphaning in-flight streams - https://github.com/share/sharedb/pull/745 — Stop stale remote presence catch-up looping forever
- https://github.com/share/sharedb/pull/750 — Ignore
pollIntervalandpollDebouncefrom clients- Set these on the database adapter instead, or map your own option onto
context.optionsinquerymiddleware
- Set these on the database adapter instead, or map your own option onto
- https://github.com/share/sharedb/pull/753 — Only call
_subscribe()once for concurrent subscribes to a channel - https://github.com/share/sharedb/pull/754 — Document how to stop clients spoofing op
src
