release: v0.1.1232

[kojiwakayama]

Routine version bump from 0.1.1231 to 0.1.1232.

The commit touches exactly the three version files — deno.json, src/utils/version-constant.ts, and src/html/hydration-script-builder/hydration-runtime.generated.ts. Cut with --no-build, so deno task generate was run separately and amended in; without it the generated hydration runtime stays pinned to the previous version while the other two advance.

No tag is pushed. CI's version-check job creates it against the squashed merge commit.

What this release carries

Security — gates that blocked callers structurally unable to satisfy them. A project enabling security.csrf or security.auth could not deploy: the platform's own signed control-plane dispatch was rejected by the project's own policy, and the failure surfaced 120s later as a timeout naming neither.

• fix(security): stop a project's CSRF policy blocking its own release asset build #3641 — CSRF no longer blocks the release-asset build dispatch
• fix(security): stop a project's auth policy 401ing the control plane's own dispatch #3645 — security.auth no longer 401s the control plane's own dispatch
• fix(runtime): stop a project's own middleware blocking its release asset build #3646 — a project's middleware.ts no longer blocks its release-asset build
• fix(security): stop a project's CSRF policy blocking its own channel dispatch #3647 — CSRF no longer blocks POST /channels/invoke
• fix(security): close the cross-cutting gaps in the signed-dispatch exemptions #3649 — the cross-cutting gaps none of the above could see alone, plus a matrix test (every dispatch type × every gate) and a handler-ordering invariant test

Production defect. #3648 — the proxy→renderer WebSocket bridge now carries the identity the renderer guard requires. Preview HMR on *.preview.veryfront.com was failing 1,000–5,000 times per hour, silently retried, with nothing surfacing to the user.

Developer experience.

• fix(chat): send the double-submit CSRF token on attachment uploads #3640 — chat attachment uploads send the CSRF double-submit token (the chat turn itself was fixed in fix(chat): send the CSRF double-submit token from useChat #3611)
• fix(dev): probe both loopback families for port availability, and de-flake its test #3650 — dev-server port probing checks both loopback families; a port held on IPv6 no longer reads as free
• fix(css): print a CSS-optimizer hint a reader can actually run #3597 — the CSS-optimizer hint names a file the reader can actually act on
• fix: omit temperature for Opus 5 #3642 — omit temperature for Opus 5

CI reliability. #3643 — an upstream fetch blip no longer ejects PRs from the merge queue. Measured before the fix: 17% of runs and 25% of merge-queue attempts failing on infrastructure.

Docs. #3630 — RFC 29's blanket status banner replaced with a linted per-symbol ledger.

[coderabbitai]

Warning

Review limit reached

@kojiwakayama, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8557f827-2bda-4b3d-b847-f51d67575e7a

📥 Commits

Reviewing files that changed from the base of the PR and between d5a0383 and 32ae03d.

⛔ Files ignored due to path filters (1)

• src/html/hydration-script-builder/hydration-runtime.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing (2)

• deno.json
• src/utils/version-constant.ts

---

_{Comment @coderabbitai help to get the list of available commands.}