Update dependency roosevelt to v0.33.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
roosevelt (source)	0.31.8 → 0.33.2

---

Release Notes

rooseveltframework/roosevelt (roosevelt)

v0.33.2

Compare Source

• Fixed the statics watcher rebuilding for files your app would not commit.
• Updated dependencies.

v0.33.1

Compare Source

• Fixed the --build and -b command line flags starting a server instead of only running the build. Serving a static site was added in 0.33.0 by keying off makeBuildArtifacts being staticsOnly, which is also what --build sets, so the two behaviors could not be told apart and --build began serving the app it had just built.
• Added buildOnly param, which is what --build and -b set now. What gets built and whether the app then serves it are separate questions, so they are separate params. Calling initServer (init) rather than startServer does the same thing and is the better fit for a build script that drives Roosevelt directly.
• Updated dependencies.

v0.33.0

Compare Source

• Breaking: Added watchStatics param, defaulted to true. In development mode Roosevelt now rebuilds your static files as you edit the files they are built from, then tells the browser to reload. To migrate:
  • If you use a process watcher, narrow it to your server-side files: add your statics folder to its ignore list and set its extensions to js json. Otherwise it restarts your whole app the moment a static file changes and wins the race, so the rebuild never gets to happen and you keep paying for a full restart.
  • If you use Teddy for templating, you need to upgrade to 1.2.0 for this feature to work.
  • Set watchStatics.enable to false to prefer the old behavior.
  • Added onStaticsRebuilt event, fired after a rebuild and before the browser reloads, for build work of your own that Roosevelt knows nothing about.
  • A rebuild renders only the static pages the files you edited affect. Editing a page renders that page, editing a page's model renders the page beside it, editing a template that is not a page of its own renders every page, and editing something no page is built from renders none. Mark the templates your pages include with a roosevelt-blocklist comment on their first line, which is also what keeps them from being served as pages.
    onBeforeStatics now also fires before each rebuild performed by the watchStatics feature.
• Altered startServer when makeBuildArtifacts is set to staticsOnly so that it will serve a static site the same as any other app.
• Fixed onBeforeStatics firing after the copy and symlinks.
• Fixed the static page generator only working with view engines that return their markup directly. It now renders through the Express engine contract, engine(path, options, callback), so any engine Express itself would accept can build a page.
• Fixed a page's model being loaded once and then reused for the rest of the process, so an edited model had no effect on a later build.
• Fixed a JS bundler config supplied as a file path being loaded once and then reused, so an edited config had no effect on a later build.
• Updated dependencies.

v0.32.0

Compare Source

• Breaking: Raised the minimum supported Node.js version to 22.20. A specific patch release is named because several of the Node.js APIs Roosevelt uses in place of third party packages were not marked stable until partway through the Node.js 22 line, so claiming support for anything earlier would mean claiming support for versions where those APIs are experimental or absent.
• Breaking: Made Express a peer dependency rather than something Roosevelt bundles. Your app will need to install Express itself, which lets you pick and upgrade the exact version you want without waiting on a Roosevelt release or reaching for npm overrides. Roosevelt supports Express 4 and Express 5, and its test suite runs against both. To migrate:
  • Add Express to your app's dependencies.
  • Remove the expressVersion param from your Roosevelt config if it is present.
• Breaking: Moved the Roosevelt config from JSON to JavaScript. Your config now lives in rooseveltConfig.js rather than rooseveltConfig.json, which means it can hold comments, real numbers and booleans instead of strings that get converted, and code, which matters because some config options might need to contain things JSON cannot express which before could only be done by overriding the config in your app in Roosevelt's constructor. To migrate, run npx roosevelt-migrate-config in your app directory, then delete the old file.
• Breaking: Disabled CSRF tokens by default. This was done because CSRF protection no longer requires tokens by default in most circumstances due to a new feature that has been added: Roosevelt now asks the browser where each request came from and refuses any request that changes data unless the browser says it came from your own site, which newer browsers report themselves and page scripts cannot forge.
  • To migrate to the new API: Either remove CSRF tokens from your app since they are no longer needed in most circumstances or if you want to keep sending CSRF tokens, set csrfProtection.requireTokens to true to keep them working.
  • When you might still need CSRF tokens: Keep requireTokens set to true if anything untrusted is hosted on a subdomain you share. That is the only way to stop an untrusted request coming from another subdomain of your own site, because browsers report those the same way they report your own pages.
  • Consider new exemptions: Requests that arrive without the browser saying where they came from are now refused. Anything that is not a browser, such as a mobile app or another server, does not send that information, so add those routes to csrfProtection.exemptions.
  • Set csrfProtection.requireTokens to "whenHeaderMissing" if you need to support browsers too old to report where a request came from, since they are otherwise refused.
  • Set csrfProtection.trustedOrigins to allow another site you expect requests from, such as a payment provider posting back to your app.
  • Asking the browser where each request came from is controlled by csrfProtection.blockCrossSiteRequests, which defaults to true. Set it to false to stop asking, which leaves your app protected only by whatever requireTokens is set to.
  • Added a warning at startup when a supplied expressSession config does not set cookie.sameSite, since that setting is one of the protections against another site making requests as your logged in users.
• Breaking: Reworked the JS bundler so it names the bundler you want the same way the CSS preprocessor names your preprocessor, and added native support for more of them. Roosevelt now drives webpack, rspack, esbuild, and rollup, and installs none of them: you add the one you want to your own dependencies, exactly as you already did for webpack and for CSS preprocessors. To migrate:
  • Replace js.webpack with js.bundler, which takes enable and module. For example "bundler": { "enable": true, "module": "webpack" }.
  • Move your bundles from js.webpack.bundles or js.customBundler.bundles up to js.bundles.
  • Replace js.webpack.customBundlerFunction or js.customBundler.customBundlerFunction with js.customBundlerFunction. There is now one place to supply your own bundler rather than two.
  • The js.customBundler param was removed. Choosing a bundler and supplying your own are no longer separate settings.
  • Your own bundler function can now return an object with outputs and sources listing the files it wrote and read. Do that and Roosevelt will skip the bundle on the next start when none of those files changed, which previously only worked with webpack.
• Breaking: Stopped shipping terser-webpack-plugin. If you want to use it, you will need to add it as a dependency if your app.
• Breaking: Upgraded better-sqlite3 to 13.x. That release no longer ships prebuilt binaries, so it is compiled when you install it, which needs Python and a C++ compiler whatever you develop on. See getting started docs for info on how to install that on your system.
• Breaking: Removed ! support from wildcard rules, such as the ones in csrfProtection.exemptions and frontendReload.exceptionRoutes. They no longer read a leading ! as meaning "everything except this." A rule written that way now matches nothing instead of nearly everything, so any route that was being skipped because of one will start being checked again.
• Breaking: Fixed unused sessions piling up in the session store. This was accomplished by making sessions expire after 3 months of inactivity, which is now configurable via expressSessionStore.maxInactivity. This will probably be seen more as a bug fix than a breaking change for most apps, but if you prefer or your app depends on sessions pretty much never expiring, you may want to set expressSessionStore.maxInactivity to 11 years to restore the old behavior and to match the expressSession.cookie.maxAge default.
• Breaking: Removed expressSessionStore.presetOptions.ttl and expressSessionStore.presetOptions.max. Neither was ever read by the session store Roosevelt ships, so removing them changes no behavior; delete them from your config. Use expressSessionStore.maxInactivity to say how long an abandoned session is kept.
• Breaking: Changed the default CSS preprocessor from Less to Sass, so that enabling the preprocessor without naming one gives you the same preprocessor the app generator scaffolds. If your app enabled css.compiler without setting css.compiler.module, set it to "less" to keep what you had.
• Fixed clientControllers.defaultBundle defaulting to views.js, which is the same filename the views bundler defaults to, so an app that turned on exposeAll for both without naming its bundles had them written to the same file. It now defaults to controllers.js, as the documentation always said.
• Fixed params like logging, formidable, and bodyParser.urlEncoded losing their other defaults when an app supplied only part of one. Setting logging.methods.info to false used to leave logging.methods.http unset, which switched off HTTP logging for an app that never asked for that. Roosevelt now fills in whatever you left out, matching how params such as css and http already behaved, and options it knows nothing about are still passed through untouched.
• Added trustProxy param, which tells Roosevelt how many web servers sit in front of your app so it can work out who is really calling. It defaults to "auto", which means Roosevelt picks: 1 in production-proxy mode, which is the mode that says a web server sits in front of your app, and false everywhere else. With it set, req.ip is the visitor rather than your own web server, and Roosevelt can tell that a visitor arrived over HTTPS even though the app itself was handed a plain HTTP request.
• Session cookies are now marked HTTPS only whenever the visitor is actually on HTTPS, worked out per request rather than decided once at startup. Previously it was decided solely by whether the app itself was serving HTTPS, so an app that let the web server in front handle the encryption for it left the cookie unmarked even though visitors reached it over HTTPS. Apps running HTTP everywhere, including behind a web server that does not serve HTTPS, keep working as before and now get a warning explaining the risk.
• Added command line tools that work in any app depending on Roosevelt, without needing a scripts entry in your package.json: npx roosevelt-generate-certs, npx roosevelt-generate-secrets, npx roosevelt-generate-session-secret, and npx roosevelt-migrate-config. You can delete the matching scripts entries from your app.
• Added logging.quieterStartup param which shows notices that repeat on every start at most once a day rather than every time, to cut down on console noise while developing. Off by default. Notices that report an actual problem always print. Can also be set with the --quieter-startup or -q command line flags or the QUIETER_STARTUP environment variable.
• Added feature to skip regenerating a static file when none of the source files it was built from have changed. To disable this, set incrementalBuilds param. Set to false to rebuild everything on every start.
• Improved HTML validation of static pages. When a page fails validation, Roosevelt now lists each error along with the line and column it occurred on, instead of only reporting that the file failed and suggesting you upload it elsewhere.
• Fixed a bug that caused the expired.clear option of the SQLite session store to be ignored, making it impossible to switch off the clearing of expired sessions.
• Fixed a crash when bundling with newer versions of Webpack. Webpack stopped listing terser-webpack-plugin among its own dependencies, and Roosevelt was loading that plugin directly to configure minification. Roosevelt no longer loads it at all, because Webpack minifies in production on its own.
• Fixed a bug that caused Roosevelt to claim your file system does not support symlinks when it does. The check that tests whether symlinks can be made wrote to a fixed file name in the current working directory, so two apps started from the same directory would delete that file out from under each other and one of them would report the failure. The check now runs inside the app's own build folder, which also stops it leaving a testIfSymlinksWork file behind in your project.
• Fixed a bug that caused the JS bundler to report writing a file every time the app started, even when the bundler had left the file untouched.
• Fixed a bug that made it impossible to use your own JS bundler. Roosevelt took the Webpack path no matter how bundling was configured, so a bundler you supplied yourself never ran. Supplying your own now works, and is configured with js.customBundlerFunction.
• Fixed a bug that caused Roosevelt to crash rather than warn when the html.folderPerPage param was set to an improperly formatted string, or to a value that is neither a boolean nor a string. Such values now fall back to the default destination.
• Fixed the feature that lets you override Roosevelt's recognized command line flags, which had been non-functional for several releases.
• Fixed a bug that caused an environment variable that is present but empty to be sourced as an empty value instead of being treated as unset.
• Fixed a bug that caused an empty NODE_PORT environment variable to blank out the configured HTTP port.
• Fixed a bug that caused a memory leak when starting and stopping multiple Roosevelt apps from within a parent process.
• Fixed a bug that caused the test suite to leave build artifacts behind in the test directory.
• Fixed the default 404 page not being served on Express 4, because Roosevelt registered its catch-all route using the Express 5 spelling.
• Fixed the deprecation checker incorrectly running in production mode.
• Fixed the deprecation checker silently stopping at the first check that fails.
• Improved performance of test suite considerably.
• Expanded test coverage considerably.
• Updated dependencies.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.