0.34.0

[kethinov]

• Breaking: Changed the default ports to 11637 for HTTP and 11437 for HTTPS, from 43763 and 43711. The old ones sat inside the range operating systems hand out for outbound connections, so any process on the machine could borrow one first and leave your app failing to start with a message about a port nothing appears to be listening on. Linux hands out 32768-60999 and macOS and Windows 49152-65535, so both new ports are below all of them. An app that names its ports is unaffected; one that relies on the defaults now serves on the new ones.
• Added support for the PORT environment variable, which is the name most hosting platforms and local HTTPS proxies set. It applies to the HTTPS port when HTTPS is enabled and to the HTTP port when it is not. NODE_PORT, HTTP_PORT, and HTTPS_PORT all outrank it, since PORT is a common enough name to already mean something else in an app's environment.
• Added support for signing development certificates with mkcert when it is installed. When mkcert is on your PATH, Roosevelt signs with it and the certificate is trusted by your operating system, Chrome, Firefox, and Safari; when it is not, Roosevelt signs with an authority of its own as before. An app already carrying a Roosevelt signed certificate moves onto mkcert on its next start, and Roosevelt says which authority signed whenever it writes one.
• Added a startup warning for when the certificate your app serves is signed by an authority this machine does not trust, which is the state that makes a browser complain about it. It names the commands to install mkcert for the platform you are on, says to run mkcert -install, and says to restart your browser and your app afterwards. Set https.autoCertWarning to false to suppress this warning or set logging.quieterStartup to hold the warning back to once a day rather than silencing it.
• Added clientModels param. When enabled, Roosevelt writes a frontend counterpart for each of your models, so an isomorphic controller can require the same model name on both sides without your app needing a hand-written frontend equivalent for every model. You can also specify the default behavior of frontend models as well, which will be shared across any frontend model you do not manually define.
• Altered autoCert to replace a certificate it signed once that certificate is within thirty days of expiring, or is signed by an authority that is no longer there. Certificates used to be generated only when absent, so one that expired left the app failing to start with nothing to explain why. A certificate you supply yourself is never touched, expired or not.
• Fixed the error shown when the HTTPS cert is missing telling you to run npm run generate-secrets, which is not a script generated apps have anymore. It now names npx roosevelt-generate-certs, which is the command that exists and the one the deprecation checker already pointed at.
• Fixed the development certificate autoCert generates being issued for example.org with no subject alternative name, which is the placeholder the library it uses fills in when it is not told what to issue for. Browsers stopped reading the common name for hostname matching years ago and go by the subject alternative name instead, so those certificates were refused for the wrong host whether or not they had been trusted, and no amount of adding them to a trust store would have helped. They are now issued for localhost with localhost, *.localhost, 127.0.0.1, and ::1 named, along with the key usage and extended key usage extensions that supplying an extensions list had been replacing rather than adding to. Delete your existing cert.pem and key.pem to get a new one.
• Updated dependencies.