fix: refuse a function in form action=, it leaked server action source - #1167

Merged

vivek7405 merged 38 commits into

mainfrom

feat/form-action-unification

Jul 29, 2026

Commits on Jul 28, 2026

fix: refuse a function in form action=, it leaked server source
vivek7405
committed
fix: close the same form-action leak in the streaming renderer
vivek7405
committed
refactor: drop the unreleased form-binding machinery from this branch
vivek7405
committed
refactor: keep isFormActionAttr internal to the guard module
vivek7405
committed
fix: guard the .action property binding, the third leak path
vivek7405
committed
docs: cover the form-action throw on the docs site, fix the action= advice
vivek7405
committed
fix: close four bypasses that walked straight past the action guard
vivek7405
committed
test: prove the action guard refuses identically on Node and Bun
vivek7405
committed
fix: stop the guard crashing on a cyclic array and refusing event bindings
vivek7405
committed

Commits on Jul 29, 2026