Pulp Engine v0.48.1 — Release Notes
Patch release that fixes the Docker build failure that blocked v0.48.0 publication, adds editor auth and preview hardening, and aligns compose files with the real published GHCR namespace.
What changed
1. Docker build fix (critical)
Two noImplicitAny TypeScript errors in the API package caused pnpm build to
fail inside Dockerfile.worker, which failed the CI Docker smoke test job,
which caused the release workflow’s CI gate to reject the v0.48.0 tag push.
apps/api/src/scripts/migrate-file-to-db.ts— added missingPrismaimport and typed the$transactioncallback parameterapps/api/src/storage/postgres/postgres-template.store.ts— added explicit type annotation on the.map()callback parameter
2. Editor SPA public route
The bundled editor path (/editor, /editor/*) now bypasses API key auth so the
login form can load without credentials. The SPA handles authentication via
POST /auth/editor-token after the user enters their key. Two new tests in
auth-scopes.test.ts verify the bypass.
3. Preview panel non-object JSON validation
PreviewPanel.tsx now rejects non-object JSON values (arrays, null, numbers,
strings, booleans) before sending a render request. Empty or whitespace-only
input is treated as {}. Seven new test cases cover all rejection paths plus
error-clearing behavior.
4. Compose namespace alignment
All three compose files (compose.yaml, compose.postgres.yaml,
compose.container.yaml) now default to ghcr.io/troycoderboy/pulp-engine:latest
instead of the non-existent ghcr.io/pulp-engine/pulp-engine namespace. Hardcoded
version tags replaced with vX.Y.Z placeholders. Container-mode compose updated
to build controller from source by default (controller/worker images require
local builds until published).
5. Documentation
- New evaluator quick-start guide (
docs/evaluator-guide.md) - HTTPS reverse-proxy example added to deployment guide
- Validation script usage documented with recommended first-deployment sequence
- SQL Server deployment parity note added
- Release checklist gains verification evidence recording guidance
- Runbook adds
jqas a prerequisite (required bysmoke-test.sh) - README links evaluator guide and fixes image namespace in pin example
- v0.48.0 release notes updated with structured validation evidence
6. Infrastructure
.dockerignoreexcludes.claudedirectory from Docker build contextsmoke-test.shadds pre-flight check forcurlandjqEditorShell.lazy.test.tsxrefactored tovi.hoisted()mock pattern
Validation
CI-verified — all CI jobs passed on the release commit:
ci (postgres), test-file-mode, test-sqlserver, test-e2e, test-e2e-auth, docker-build-smoke.
Locally verified:
node scripts/check-version.mjs— passedbash scripts/check-encoding.sh— no corruption detectedbash scripts/verify-release.sh— all steps passed (version, encoding, lint, build, postgres tests, file-mode tests)docker build -t pulp-engine:test .— succeededdocker build -f Dockerfile.worker -t pulp-engine-worker:test .— succeeded (this was the exact failure in v0.48.0)docker build -f Dockerfile.controller -t pulp-engine-controller:test .— succeeded
Not verified:
- SQL Server storage path — no local instance; CI-covered by
test-sqlserverjob - E2E suites — CI-covered by
test-e2eandtest-e2e-authjobs
Upgrade
No breaking API, auth, or storage changes. Drop-in replacement for v0.47.0 (or the unpublished v0.48.0 source).
docker pull ghcr.io/troycoderboy/pulp-engine:v0.48.1
docker pull ghcr.io/troycoderboy/pulp-engine-worker:v0.48.1
docker pull ghcr.io/troycoderboy/pulp-engine-controller:v0.48.1