Bump @quilted/threads from 3.0.0 to 4.1.0

[dependabot]

Bumps @quilted/threads from 3.0.0 to 4.1.0.

Release notes

Sourced from @​quilted/threads's releases.

@​quilted/threads@​4.1.0

Minor Changes

• #968 b17b028 Thanks @​lemonmade! - ThreadWindow's targetOrigin option now also validates the origin of incoming messages, and gained an 'ancestor' mode.

  Previously targetOrigin only set the origin for outgoing postMessage() calls; inbound messages were accepted from any origin as long as they came from the expected window. It is now also used to reject messages whose origin does not match, so a concrete targetOrigin authenticates both directions:

  const thread = ThreadWindow.iframe(iframe, {
    targetOrigin: 'https://embed.my-app.com',
    exports: {
      /* ... */
    },
  });

  The default remains '*' (post to, and accept from, any origin), so existing behaviour is unchanged.

  You can also pass targetOrigin: 'ancestor' to pin to the origin that framed the current window — read from location.ancestorOrigins, falling back to the origin of the first received message on platforms without that API (e.g. Firefox), buffering outgoing messages until it is known. This is convenient inside an iframe that trusts its embedder but doesn't know the embedder's origin ahead of time:

  const thread = ThreadWindow.parent({targetOrigin: 'ancestor'});

@​quilted/threads@​4.0.3

Patch Changes

• #950 2267309 Thanks @​lemonmade! - Upgraded the Preact and Hono dependency ecosystems to their current releases: preact 10.29.2, preact-render-to-string 6.7.0, @​preact/signals 2.9, @​preact/signals-core 1.14.2, @​prefresh/vite 3, hono 4.12, and @​hono/node-server 2. These are bumped together, and pinned to a single version tree-wide (via pnpm overrides), because mixing Preact copies crashes server rendering.

• Updated dependencies [2267309]:

  • @​quilted/events@​2.1.5

Changelog

Sourced from @​quilted/threads's changelog.

4.1.0

Minor Changes

• #968 b17b028 Thanks @​lemonmade! - ThreadWindow's targetOrigin option now also validates the origin of incoming messages, and gained an 'ancestor' mode.

  Previously targetOrigin only set the origin for outgoing postMessage() calls; inbound messages were accepted from any origin as long as they came from the expected window. It is now also used to reject messages whose origin does not match, so a concrete targetOrigin authenticates both directions:

  const thread = ThreadWindow.iframe(iframe, {
    targetOrigin: 'https://embed.my-app.com',
    exports: {
      /* ... */
    },
  });

  The default remains '*' (post to, and accept from, any origin), so existing behaviour is unchanged.

  You can also pass targetOrigin: 'ancestor' to pin to the origin that framed the current window — read from location.ancestorOrigins, falling back to the origin of the first received message on platforms without that API (e.g. Firefox), buffering outgoing messages until it is known. This is convenient inside an iframe that trusts its embedder but doesn't know the embedder's origin ahead of time:

  const thread = ThreadWindow.parent({targetOrigin: 'ancestor'});

4.0.3

Patch Changes

• #950 2267309 Thanks @​lemonmade! - Upgraded the Preact and Hono dependency ecosystems to their current releases: preact 10.29.2, preact-render-to-string 6.7.0, @​preact/signals 2.9, @​preact/signals-core 1.14.2, @​prefresh/vite 3, hono 4.12, and @​hono/node-server 2. These are bumped together, and pinned to a single version tree-wide (via pnpm overrides), because mixing Preact copies crashes server rendering.

• Updated dependencies [2267309]:

  • @​quilted/events@​2.1.5

4.0.2

Patch Changes

• e6fa47e Thanks @​lemonmade! - Update Preact and Signal dependencies

• Updated dependencies [e6fa47e]:

  • @​quilted/events@​2.1.4

4.0.1

Patch Changes

• df5f9d3 Thanks @​lemonmade! - Fix thread creation typescript types

4.0.0

... (truncated)

Commits

• e2d615b Publish packages (#969)
• b17b028 [threads] Validate message origin in ThreadWindow, add "ancestor" mode (#968)
• f1ade77 Publish packages 🚀 (#952)
• 2267309 deps: TypeScript 6, dependency refresh, and the Preact/Hono ecosystems (#950)
• b66448a Publish packages (#896)
• e6fa47e Update Preact dependencies
• 2081966 Publish packages (#869)
• df5f9d3 Fix thread creation typescript types
• 0c8fd1b Publish packages (#868)
• 766bb4d Try another E2E test fix
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​quilted/threads since your current version.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.