v1.1.0

PocketStack v1.1.0 is a correctness, honesty, and hardening release. The browser-native product boundary is unchanged; this release makes the analyzer handle more real-world Compose files correctly and makes generated demos fail honestly instead of silently.

Analyzer fixes

• Port ranges such as 3000-3005:3000-3005 no longer abort analysis. The first port of the range is used.
• Registry-qualified and Docker Hub official image names now resolve to the right adapter. docker.io/library/postgres:16 and library/postgres are recognized the same as postgres; registry hosts like ghcr.io/... are normalized away while plain namespaces (nginxinc/...) are preserved.
• Services gated behind profiles: are skipped, matching what a default docker compose up starts. They no longer count toward or block browser readiness, and the analysis warns when services are skipped.
• extends: is now reported as an explicit, actionable blocker instead of a confusing per-field rejection, with a suggestion to flatten the service.
• pocketstack analyze now prints project-level warnings (COOP/COEP, network access, skipped profile services) in its default human-readable output, not only in --json.

Generated demo / runtime

• Security: the demo dashboard escapes service names and OpenAPI route data before rendering, preventing HTML/script injection from untrusted Compose or spec input. PocketStack Studio sandboxes its uploaded-HTML preview iframe.
• Honest failures: frontend demos now fail fast with a clear COOP/COEP message when the host is not cross-origin isolated; mock-http and database demos explain that they need http(s) hosting rather than file://; and CDN load failures report which package and URL could not be reached.
• Browser runtime packages loaded from public CDNs (WebContainer, PGlite, sql.js, Wasmer) are version-pinned so previously generated demos do not break when an upstream package ships a new major.
• WASI fd_write now concatenates iovecs before decoding, fixing corruption of multi-byte UTF-8 output split across buffer boundaries.
• The PGlite query panel and demo query bridge now run multi-statement SQL via exec, matching the SQLite adapter so the same insert …; select …; input works in both.

Tooling & docs

• The GitHub Pages build skips missing demos and media with a warning instead of failing the whole build when run outside make pages.
• New "Compose Features" documentation describes how profiles, extends, port ranges, image normalization, and orchestration directives are handled.
• SECURITY.md now lists supported versions and a private vulnerability reporting channel.
• Added CLI tests plus regression tests for port ranges, image normalization, profile skipping, extends, and the WASI UTF-8 fix.

Known constraints

• PocketStack remains browser-native only. It does not run arbitrary Docker containers, Docker builds, Linux daemons, or real container networking in the browser.
• extends and multi-file Compose overrides are not resolved; flatten or merge before analyzing.
• Unsupported services should be converted to static assets, frontend projects, WASI modules, OpenAPI mocks, SQLite, PGlite, or in-browser state when that is honest for the demo.

---

← v1.0.3 · Release notes index · v1.1.1 →