Bump version to v5.0.6

README.md

@@ -1,4 +1,4 @@
-**v5.0.5**
+**v5.0.6**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 ![Unit Tests](https://github.com/GEOLYTIX/xyz/actions/workflows/unit_tests.yml/badge.svg)

apps/mapp/lib/mapp.mjs

@@ -52,5 +52,5 @@ globalThis.mapp = {
   Mapview,
   plugins,
   utils,
-  version: '5.0.5',
+  version: '5.0.6',
 };

package.json

@@ -1,6 +1,6 @@
 {
   "name": "xyz",
-  "version": "v5.0.5",
+  "version": "v5.0.6",
   "type": "module",
   "repository": {
     "type": "git",

release-notes/v5.0.6.md

@@ -0,0 +1,55 @@
+## What's Changed
+
+### Database Queries
+
+- **Database queries now have a 10 second default timeout, and connection retries release clients correctly.**
+  Previously queries had no statement timeout unless `STATEMENT_TIMEOUT` or a `statement_timeout` request parameter was set. A failed `pool.connect()` during a retry could also release the previous attempt's client a second time.
+
+  `STATEMENT_TIMEOUT` now defaults to `10000` ms. A query uses the template's `statement_timeout` first, then the environment variable, then the default. Setting `STATEMENT_TIMEOUT` to `0` removes the limit. The `statement_timeout` request parameter is no longer read, so a long-running query must set the timeout on its template or rely on the environment variable.
+
+  Each retry attempt now uses its own client and releases it exactly once, before the backoff wait. Only error codes listed in `RETRY_CODES` are retried. A `RETRY_LIMIT` of `0` or an invalid value still makes one attempt instead of returning nothing. Pools for `DBS_` keys that contain underscores, such as `DBS_MY_DB`, now get their full name instead of being cut to `MY`. Idle pool clients are closed after 10 seconds instead of 30.
+
+  Nonblocking query templates now wait until the query is sent to the database. They return `202` once it is sent and `503` when the connection fails; previously they returned `202` straight away and connection failures went unreported. Postgres log inserts are now nonblocking and are not retried. Add `dbs_retry` to `LOGS` to log each retry and the point where retries run out. Thanks @dbauszus-glx! [#2967](https://github.com/GEOLYTIX/xyz/pull/2967)
+
+### Legends and Symbols
+
+- **Legends now draw only the categories present in the layer data, and switching themes no longer stacks legend callbacks.**
+  Previously each theme switch added another legend function to `layer.showCallbacks`, and none were ever removed. Distributed and graduated legends could also draw before the layer data was processed, creating an icon for every category in the theme config, which could run to thousands.
+
+  A single `mapp.ui.layers.drawLegend` function is now registered once per layer and resolves the current theme when called. Legends that depend on the data distribution wait until the data has been processed, so they can appear slightly later. Distributed legends draw only categories that have values in the data and redraw when that set changes. Theme `setLabel` and `setHover` are applied before the style panel is built. Thanks @dbauszus-glx! [#2961](https://github.com/GEOLYTIX/xyz/pull/2961)
+
+- **A failed SVG template fetch no longer breaks MAPP initialisation.**
+  Previously a rejected `svgTemplates` fetch, such as one caused by a temporary SSL error, rejected MAPP initialisation and the mapview failed to load. A bad `src` that returned an HTML error page was stored as if it were an SVG template.
+
+  Each template is now checked: failed requests, non-OK responses, and responses that do not parse as an `svg` document log a console warning and are skipped. The mapview loads, and only the affected icons are missing. Thanks @dbauszus-glx! [#2964](https://github.com/GEOLYTIX/xyz/pull/2964)
+
+### Filter and Dropdown Fixes
+
+- **The filter panel no longer re-queries the location count on every pan or zoom.**
+  Previously the `location_count` query ran on every viewport change for layers, such as MVT layers, without the `viewport` flag on their filter. With an unchanged filter it requested the same large number each time.
+
+  The count is now cached against the current filter and only re-queried when the filter changes. Layers with `filter.viewport`, `params.viewport`, or `queryparams.viewport` still query on every viewport change. Features loaded for the viewport are counted in the client, except for cluster layers, which always query. Failed counts are not cached. Thanks @dbauszus-glx! [#2963](https://github.com/GEOLYTIX/xyz/pull/2963)
+
+- **Typing into a dropdown search no longer selects an entry before the value is finished.**
+  Previously every keystroke in a searchable dropdown was checked against the entry titles, so typing `1` selected the value `1` immediately and `10` could not be typed. In `multi` dropdowns, the browser's type-ahead also toggled the first option starting with the pressed key.
+
+  Search input now selects an entry only when an option is picked from the list. In `multi` dropdowns, printable keys no longer trigger type-ahead; the space key and Ctrl, Meta, and Alt shortcuts still work. Single-select dropdowns are unchanged. Thanks @dbauszus-glx! [#2966](https://github.com/GEOLYTIX/xyz/pull/2966)
+
+### Location Entry Fixes
+
+- **Cloudinary uploads are now available on mobile.**
+  The upload zone for cloudinary image and document entries had the `mobile-display-none` class, so users on small screens could not upload files from an editable location. The class has been removed, and phone users can now upload images and documents, including photos taken with the camera. Thanks @dbauszus-glx! [#2962](https://github.com/GEOLYTIX/xyz/pull/2962)
+
+### Login and Deployment
+
+- **`SECRET_KEY` now accepts an inline PEM private key.**
+  Previously `SECRET_KEY` was always treated as a file path, so deployments had to write the RS256 private key to a `*.pem` file and ship it in the bundle. Deployments that keep the key in a secret manager could not pass it directly as an environment variable.
+
+  When the value of `SECRET_KEY` starts with `-----BEGIN` (leading whitespace is ignored), it is now used as the PEM key directly. Any other value is still read as a file path relative to `XYZ_CWD` or the workspace root, so existing setups are unchanged. An inline key does not need a `*.pem` entry in the Vercel `includeFiles` config. The `login-public-key` script now derives the public key from the same resolved secret, so it works with both forms. `DEPLOYMENT.md` and `SETUP.md` document both options. Thanks @RobAndrewHurst! [#2968](https://github.com/GEOLYTIX/xyz/pull/2968)
+
+### Maintenance
+
+- **Added a `review-pr` Claude skill.**
+  The new skill reviews a pull request, branch, or uncommitted changes in XYZ/MAPP and reports to the terminal. It reads each touched method in full and checks listener and callback registration, changes that spread across too many modules, test coverage for touched modules, and JSDoc conformance with `DOCUMENTATION.md`. Thanks @anush-933! [#2959](https://github.com/GEOLYTIX/xyz/pull/2959)
+
+**Full changelog:** [v5.0.5...v5.0.6](https://github.com/GEOLYTIX/xyz/compare/v5.0.5...v5.0.6)