reflex-site-shared@0.0.38

Automated release for reflex-site-shared v0.0.38

reflex-site-shared@0.0.37

Automated release for reflex-site-shared v0.0.37

v0.9.7

reflex v0.9.7 ships alongside reflex-base 0.9.7, reflex-components-core 0.9.7, reflex-components-radix 0.9.6, and reflex-docgen 0.9.3.

Features

• ArrayVar gained map, filter, reduce, and flat_map for transforming array vars directly on the frontend. (#6701)
• rx.Config gained default_color_mode ("system", "light", or "dark", also settable via REFLEX_DEFAULT_COLOR_MODE), letting apps set the initial color mode — and use the built-in color-mode switcher and rx.color_mode_cond — without pulling in the large Radix themes CSS. It drives both the compiled ThemeProvider default and the pre-hydration preload script, so there's no flash of the wrong theme on first paint; an explicit rx.theme(appearance=...) still takes precedence. (#6716)
• rx.Config gained frozen_lockfile (default True, also settable via REFLEX_FROZEN_LOCKFILE). When enabled, bun's initial install runs with --frozen-lockfile so a lockfile out of sync with package.json fails fast; set it to False to let the lockfile update in place. (npm has no equivalent install flag, so it's a no-op there.) (#6763)
• @rx.memo accepts a wrapper= argument controlling the JS function that wraps the compiled component: React's memo (the default), a custom function Var whose imports ride along into the generated module, or wrapper=None to emit the bare function component. (#6730)

Bug Fixes

• Fixed stateful pages being evaluated twice in one process (forked production workers, and same-process export+serve), which created duplicate ComponentState classes and broke frontend hydration (TypeError: d is not a function). (#6710)
• Custom attributes are now preserved in more places — on a Field when the state metaclass rebuilds it (#6726), and on event handlers and computed vars inherited from a state mixin, along with their keyword-only defaults (#6725).
• RedisTokenManager now closes its redis client and cancels its pub/sub tasks on shutdown, fixing leaked redis connections (ResourceWarning: unclosed Connection) when the server stops. (#6724)
• Fixed _get_all_hooks_internal mutating each component's cached hooks with its descendants' hooks, which made memo tag hashes order-dependent and duplicated hooks into memo bodies. (#6741)
• The disk state manager resets its write-queue task after close. (#6715)
• reflex-docgen no longer misinterprets meta_description/description frontmatter keys as component preview lambdas. (#6704)

Performance

• Telemetry now runs on a dedicated background thread instead of inline on the asyncio event loop, so its blocking syscalls, subprocess calls, and synchronous HTTP request no longer stall the loop — notably when reporting backend errors at a high rate. Delivery is best-effort and failures are suppressed, so telemetry can never affect the running app. (#6626)
• Event chaining (yield OtherState.handler(rows)) no longer deep-copies payload values that aren't attached to any state — only state-bound MutableProxy subtrees are copied, making proxy-free payloads ~5x faster to chain. (#6739)
• Var.to() and Var.guess_type() use cached registry lookups instead of scanning the full registry with safe_issubclass on every call (~70% of the cost of constructing a var operation). (#6742)
• console.deprecate caches framework-path checks in its call-stack walk, making repeat calls ~150x faster — deprecated attributes on hot paths (like RouterData.page) no longer cost milliseconds per access. (#6736)

Deprecations

• ArrayVar.foreach is deprecated in favor of ArrayVar.map. (#6701)

Full Changelog: v0.9.6...v0.9.7

v0.9.6.post2

hot fix: Add frozen_lockfile config to control bun lockfile enforcement (#6763)

v0.9.6.post1

hot fix: ENG-9923: Add REFLEX_EXTRA_PLUGINS env var to append to plugin list (#6685)

v0.9.6

reflex v0.9.6 ships alongside reflex-base 0.9.6, reflex-components-core 0.9.6, reflex-components-moment 0.9.2, and reflex-components-plotly 0.9.3.

Features

• rx._x.hybrid_property now works on dataclasses, Pydantic models, and SQLAlchemy models, not just State classes. Accessed through an object var on the frontend (e.g. State.info.a_b), it renders as a var using the same code as the backend — and now raises a clear error if the frontend logic reads a backend (underscore-prefixed) var instead of silently baking in the server-side default. (#6617, #6621)
• Auto-memoized (rx.memo) components now compile to per-module output paths. Each emits to a .web/app_components/ path mirroring its defining Python module instead of a single shared components.jsx, so identically-rendered subtrees in different modules no longer overwrite each other and same-named memos across modules can coexist on one page. (#6457)
• reflex init now writes a managed AGENTS.md section (preserving your surrounding content) and bridges it to Claude Code via a CLAUDE.md that imports @AGENTS.md. (#6620)
• StringVar gained lstrip and rstrip, and strip now accepts an optional chars argument, matching Python's str API. (#5417)
• rx.plotly accepts a locale prop to localize number/date formatting and modebar labels; the matching plotly.js-locales data is resolved and merged automatically per chart. (#6428)
• package.json generation accepts extra keys. package_json_template takes **additional_keys (e.g. name, packageManager, engines), and reflex.lock/package.json is now synced to .web/package.json before install so the manifest and lockfile stay aligned. (#6658)

Bug Fixes

• 🔒 Security — minimum dependency versions raised (#6665):
  • starlette >= 1.3.1 — Host-header path poisoning, request.form() DoS, and UNC-path SSRF
  • python-multipart >= 0.0.32 — querystring DoS, unbounded header field size, and negative Content-Length buffering in parse_form
  • granian >= 2.7.4 — WSGI and WebSocket header-panic DoS
  • bundled vite → 8.0.16 — server.fs.deny bypass on Windows alternate paths (CVE-2026-53571)
• Bound arguments now pass through to upload handlers, so on_drop=State.handle_upload(rx.upload_files(...), field) forwards field to the backend instead of raising a missing-argument error. (#5290)
• rx.cond preserves literal string types, so rx.cond(State.flag, "green", "red") infers Var[Literal["green", "red"]] instead of widening to Var[str] — fixing Pyright errors on props like Radix color_scheme. (#6545)
• rx.debounce_input no longer crashes with ReferenceError: input is not defined when wrapping a native DOM element such as rx.el.input or rx.el.textarea. (#6637)
• rx.moment pins moment-timezone to exactly 0.6.2 (instead of a caret range) for reproducible frontend installs. (#6649)
• modify_state rebinds the event token correctly, so delta resolution and computed vars in shared-state fan-out tasks observe the right client token. (#6673)
• Avoid re-entering config loading when a State subclass is defined in rxconfig.py. (#6662)

Miscellaneous

• pyi_hashes.json entries are now computed from the final .pyi content (after ruff format / ruff check --fix), so formatting-only generator changes no longer flag spurious hash changes.

Full Changelog: v0.9.5.post2...reflex-components-core-v0.9.6

reflex-hosting-cli@0.1.67

Features

• Added a --service-account flag to reflex deploy --gcp, letting Cloud Run services run as a least-privilege per-service service account instead of the project's default compute SA. (#6556)
• Added --max-instances, --allow-unauthenticated/--no-allow-unauthenticated, --env KEY=VALUE, and --envfile flags to reflex deploy --gcp, letting you cap Cloud Run autoscaling, deploy a private service, and set environment variables at deploy time. (#6557)
• Added reflex cloud scan, which uploads your app source for a Reflex-aware security review and reports security and logic flaws. Supports --json output and a --fail-on severity gate for CI. (#6632)

v0.9.5.post2

A patch on top of v0.9.5.post1 (reflex-base 0.9.5.post2 released in lockstep, no separate changes).

Bug Fixes

• Allow access to State from app_wrap components. (#6651)

Full Changelog: v0.9.5.post1...v0.9.5.post2

v0.9.5.post1

A compatibility patch on top of v0.9.5 (reflex-base 0.9.5.post1 released in lockstep, no separate changes).

Bug Fixes

• Bumped the minimum reflex-components-core dependency to 0.9.5 for compatibility.

Full Changelog: v0.9.5...v0.9.5.post1

v0.9.5

reflex v0.9.5 ships alongside reflex-base 0.9.5, reflex-components-core 0.9.5, reflex-components-radix 0.9.5, and reflex-components-lucide 1.0.2.

Features

• Typed form submissions. rx.form's on_submit handler can now annotate its form-data parameter with a TypedDict (including typing_extensions.NotRequired fields). At build time the form statically validates that its controls supply every required field — raising EventHandlerValueError with the missing/present field names — and input/select/textarea plus the Radix form controls (checkbox, checkbox group, radio group, radio cards, select, switch, and both sliders) are recognized as field contributors. Validation is skipped when the form sets an id or any control identifier is a dynamic Var. (#6301)
• Event handlers on out-of-scope JSX literals now dispatch. Handlers attached to JSX built outside a component's render scope — e.g. an ErrorBoundary's onError — can now dispatch events; the state and event-loop providers are injected around the app root by the compiler rather than depending on a hoisted hook. (#6447)
• App.hydrate_fallback renders a component during the page's hydration window (React Router's HydrateFallback) instead of a blank white page. Also configurable without code via the hydrate_fallback config / REFLEX_HYDRATE_FALLBACK env var. (#6630)
• REFLEX_HOT_RELOAD_OVERRIDE_PATHS env var fully replaces the paths watched for hot reload in dev mode. (#6639)

Bug Fixes

• State.router.url no longer reflects a stale query string after the URL is changed via window.history.replaceState/pushState (e.g. from rx.call_script); query and hash are now read from the live window.location. (#6625)
• Frontend-only events from middleware preprocess now fire. rx.toast/rx.redirect returned from a middleware's preprocess are emitted to the client instead of being enqueued on the backend and raising KeyError. (#6644)
• State.get_var_value() raises instead of returning a wrong value when passed a Var operation such as State.a + State.b or State.items[0] — now UnretrievableVarValueError. (#6633)
• Anonymous telemetry identifiers are now UUID strings, not 128-bit integers that PostHog truncated to floats (risking distinct installs being correlated as one); a one-time $create_alias preserves history. (#6611)
• Underscore-prefixed props are no longer emitted into generated .pyi files. (#6628)

Performance

• rx.icon no longer pulls in the entire ~1700-icon library. Static-name icons now emit deep per-icon imports (lucide-react/dist/esm/icons/<name>.mjs), so once an app's module graph also contains lucide-react/dynamic.mjs (e.g. the connection overlay) pages no longer fetch every icon chunk. (#6628)
• ~3–4× faster reads of mutable state vars (lists, dicts, dataclasses) through MutableProxy. (#6600)
• Faster component creation via lazy field-default resolution, cached event triggers, and a memoized to_camel_case. (#6576)

Miscellaneous

• Anonymous telemetry now reports the versions of the first-party Reflex subpackages (reflex-base, the reflex-components-* family, reflex-hosting-cli) via a new reflex_package_version field. (#6610)
• pyi_hashes.json maintenance hardened: scripts/make_pyi.py is now a proper CLI (--force, --check, merge-not-prune), and the build-hook entrypoint no longer wipes the hash registry when building a single package. (#6614)

Full Changelog: v0.9.4...v0.9.5