[ochairo]

Summary

Linked Issue

• Closes #

Validation

List the checks you ran and the result. If a command was skipped, explain why.

pnpm validate

• pnpm validate
• pnpm test
• pnpm typecheck
• pnpm build
• Manual verification
• Not applicable

Release Notes

• User-facing summary:
• Migration or breaking-change notes:

[Copilot]

🟡 Changes recommended

Nullable bindings retain stale DOM state in both property writers, and the feature-request dropdown contains invalid non-string options.

3 open issues

• Quote Yes and No dropdown options in issue form YAML · New
• Reset non-reflected properties on nullish bindProperty updates · New
• Reset non-reflected JSX properties on nullish updates · New

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Prepares Beat 2.0.0 with stronger routing and server-rendering safeguards, updated dependencies, and standardized contribution templates.

Changes:

• Expands route guards and hardens prefetch cancellation, disposal, and error recovery.
• Adds SSR serialization checks, DOM-binding fixes, and regression tests.
• Updates release requirements, CI security settings, and contributor documentation.

File	Description
tests/​server.test.ts	Tests ARIA boolean serialization.
tests/​server-security.test.ts	Tests SSR serialization boundaries and cleanup.
tests/​router-security.test.ts	Tests route admission and asynchronous cancellation.
tests/​render.test.ts	Tests omission of undefined IDs.
tests/​dom.test.ts	Adds binding and keyed-list regression tests.
SUPPORT.md	Defines support channels and reporting guidance.
src/​server.ts	Validates serialization and guarantees cleanup after rejection.
src/​router.ts	Strengthens guards, prefetch handling, and disposal.
src/​jsx-runtime.ts	Updates property clearing, ARIA tokens, and list updates.
src/​dom.ts	Updates nullable bindings and ARIA serialization.
SECURITY.md	Defines security reporting and supported releases.
README.md	Documents migration and security boundaries.
pnpm-lock.yaml	Locks updated dependencies.
package.json	Sets version 2.0.0 and updates dependency requirements.
CONTRIBUTING.md	Documents development branches and release flow.
.gitignore	Allows tracking GitHub community templates.
.github/​workflows/​validate.yml	Pins actions and restricts validation permissions.
.github/​workflows/​publish.yml	Updates pinned actions and installation safeguards.
.github/​pull_request_template.md	Standardizes PR descriptions and validation reporting.
.github/​ISSUE_TEMPLATE/​support_request.yml	Adds a structured support form.
.github/​ISSUE_TEMPLATE/​feature_request.yml	Adds a structured feature proposal form.
.github/​ISSUE_TEMPLATE/​documentation.yml	Adds a documentation feedback form.
.github/​ISSUE_TEMPLATE/​config.yml	Routes security reports away from public issues.
.github/​ISSUE_TEMPLATE/​bug_report.yml	Adds a structured bug report form.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Non-reflected property resets and a prefetch-invalidation race remain unresolved.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Restore nullish resets for non-reflected properties

src/​dom.ts:64

Nullish updates now leave non-reflected properties unchanged unless clearProperty explicitly handles them. For example, bindProperty(video, "muted", state) leaves video.muted true when state changes from true to null or undefined: removing the attribute affects defaultMuted, not the live playback state. A custom element's existing model property likewise retains its previous object. The same regression occurs in the JSX writer in src/jsx-runtime.ts:270–291. Restore nullish resets for non-reflected properties in both writers while keeping reflected attributes such as id absent. Add regression tests for muted and a custom-element property through both binding paths; adding only muted to the allowlist would leave the general regression unresolved.

Cancel pending navigation after prefetch entry removal

src/​router.ts:977

Invalidation misses a waiting navigation after its prefetch entry has been removed but before resume runs. Register prefetched.then(() => router.invalidatePrefetch('/private')) before navigating to that pending prefetch: completion deletes the active entry and resolves the promise, then invalidation deletes the cached result but returns from abortActivePrefetch without canceling the pending navigation. resume consequently starts another loader. Global invalidation has the same gap because it only visits active entries. Cancel a matching pending navigation even when there is no active prefetch entry, and include its key when invalidating all prefetches.

3 resolved since last review

• Reset non-reflected JSX properties on nullish updates
• Reset non-reflected properties on nullish bindProperty updates
• Quote Yes and No dropdown options in issue form YAML

1 file not reviewed

• pnpm-lock.yaml: Generated file

_{Review effort: Balanced}