Publish packages 🚀

packages/threads/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @quilted/threads
 
+## 4.1.0
+
+### Minor Changes
+
+- [#968](https://github.com/lemonmade/quilt/pull/968) [`b17b028`](https://github.com/lemonmade/quilt/commit/b17b028af8a8bf239f0e6b2ab76c4bf1fa78db84) Thanks [@lemonmade](https://github.com/lemonmade)! - `ThreadWindow`'s `targetOrigin` option now also validates the `origin` of incoming messages, and gained an `'ancestor'` mode.
+
+  Previously `targetOrigin` only set the origin for outgoing `postMessage()` calls; inbound messages were accepted from any origin as long as they came from the expected window. It is now also used to reject messages whose `origin` does not match, so a concrete `targetOrigin` authenticates both directions:
+
+  ```ts
+  const thread = ThreadWindow.iframe(iframe, {
+    targetOrigin: 'https://embed.my-app.com',
+    exports: {
+      /* ... */
+    },
+  });
+  ```
+
+  The default remains `'*'` (post to, and accept from, any origin), so existing behaviour is unchanged.
+
+  You can also pass `targetOrigin: 'ancestor'` to pin to the origin that framed the current window — read from `location.ancestorOrigins`, falling back to the origin of the first received message on platforms without that API (e.g. Firefox), buffering outgoing messages until it is known. This is convenient inside an `iframe` that trusts its embedder but doesn't know the embedder's origin ahead of time:
+
+  ```ts
+  const thread = ThreadWindow.parent({targetOrigin: 'ancestor'});
+  ```
+
 ## 4.0.3
 
 ### Patch Changes

packages/threads/package.json

@@ -2,7 +2,7 @@
   "name": "@quilted/threads",
   "description": "Helpers for communicating between JavaScript environments using message passing.",
   "type": "module",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "license": "MIT",
   "engines": {
     "node": ">=14.0.0"