[miguel-heygen]

What

Release v0.9.31: a version bump of all packages and plugin manifests, the changelog entry and releases/v0.9.31.md.

It carries the eleven changes since v0.9.30 and nothing else:

• perf(core): Safari stops a long video's clips from loading the whole file at once #7436 and fix(core): Safari keeps a small file's preload and leaves a playing clip's source alone #7498: in Safari, the clips of a long video no longer load the whole file at once; a small video file keeps its preload, and a clip that is playing keeps its source.
• fix(studio): check Host on the dev server's API routes and honor preview allowed hosts #7493: the Studio dev server checks the Host header on its API routes too, as the preview server does since 0.9.30. A tunnel, Codespaces or remote dev host that worked before can now get a 403 until it is named in HYPERFRAMES_PREVIEW_ALLOWED_HOSTS, and the notes say so.
• fix(studio-server): thumbnail origin from the server, sandbox previews from other sites #7492: thumbnail links take their origin from the server, and previews from other sites open sandboxed.
• fix(producer): a render uses the CLI's own GSAP, so the default CDN's file needs no network #7388: a render that loads the default GSAP file from the CDN uses the copy the CLI already ships, so it works with no network.
• fix(cli): only name a shadowing install whose manager can move it #7499: the message about another install shadowing this one only names an install its package manager can move.
• fix(studio): messages that count clips or keyframes say 1 clip, not 1 clips #7496: messages that count clips or keyframes say 1 clip, not 1 clips.
• fix(studio-server): a claim waits for a changing file's first copy, so its edit stays undoable #7497: when a file is still changing, a claim waits for its first copy, so the edit can still be undone.
• Release: hardened release build.
• docs(adopters): add DoneCut #5638: the adopters list adds DoneCut.

Why

Ships the Safari long video fix and its follow up, and the dev server's Host check.

Related work

Follows chore: release v0.9.30 (#7494).

How

bun run release:prepare 0.9.31 on release/v0.9.31 at main; the generated TODO summary and seven generated lines were rewritten by hand in both notes files, then the command was rerun to cut the version. The changed file list matches the v0.9.30 release commit. No tag is pushed; the release workflow tags the merge SHA.

No visible change

Version bump and changelog only. Each change was captured in its own PR.

Test plan

• Unit tests added/updated (release commit only, no code)
• Manual testing performed: diff checked to be only version strings plus the two notes files
• Documentation updated: docs/changelog.mdx and releases/v0.9.31.md, summary rewritten by hand
• Comments follow CONTRIBUTING.md "Comments"

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟢 Ready	View Preview	Nov 10, 2026, 7:26 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[jrusso1020]

Reviewed at fbadb8a46bb2c01b583616f58bc6d4ef0da7e426.

Audited: all 22 changed files; the 15 publishable packages and five plugin manifests match scripts/set-version.ts, and their only JSON change is 0.9.30 → 0.9.31. The private playground stays independent. The ten changelog entries match git log v0.9.30..HEAD.

Important: docs/changelog.mdx:34 and releases/v0.9.31.md:23: the release-hardening entries disclose implementation details beyond the neutral wording requested for this release. Replace both bullets in both files with one neutral line, e.g. “Release: Hardened release build.”, removing their commit/PR pointers. Apply the same neutral wording to the corresponding PR-description bullet so generated release copy cannot restore it.

Verification: node scripts/ci/release-only-diff.mjs --base 12d954a1fe59b9e2ffa29ab5b66536d26a5ef15e --verify returned release only: 22 files, versions and notes; JSON comparison confirmed all 20 version-only changes. No code-bearing changes or internal repository references found in the added notes. No application tests run for this mechanical release diff.

Pre-existing: bun.lock already records older workspace versions on the base; this PR leaves it unchanged and introduces no dependency drift. Refresh that metadata separately.

Need: yes, release metadata · Size: ok · Reuse: existing set-version release list · Simpler: already minimal · Structure: fine (checked scripts/set-version.ts; no split)
Risk: low - metadata and release copy only.

Verdict: REQUEST CHANGES
Reasoning: Package versions and scope check out; neutralize the release-hardening copy before publishing.

Reviewed by hf-review.

[miguel-heygen]

Fixed in 07e4722. In docs/changelog.mdx and releases/v0.9.31.md, the two release-hardening bullets are now one line, "Release: Hardened release build.", with no commit or PR links. The PR body says the same.

The branch is rebased onto main: git rev-list --count release/v0.9.31..origin/main prints 0. The docs commit merged in between (#5638) has its own notes line under Docs & Examples, so the entries match git log v0.9.30..HEAD again.

[jrusso1020]

Reviewed at 07e47227c3ba658962b96c70293a5d44903814ae (re-review of fbadb8a46bb2c01b583616f58bc6d4ef0da7e426).

The prior blocker is resolved: both notes files and the PR body now use only “Hardened release build” without pointers for that entry. No finding identifiers, exploit descriptions or internal repository references appear in the added release copy.

Audited all22 changed files and the range-diff. The release commit rebases unchanged; the follow-up neutralizes the copy and adds the DoneCut entry matching the additional merged docs change. All15 publishable packages and five plugin manifests have version-only changes to0.9.31. No code-bearing changes or new lockfile drift; the previously noted stale lock metadata remains a separate follow-up.

Validation: pytest-gate.sh node scripts/ci/release-only-diff.mjs --base 0b531bc7a4635b8ede475522f21bfc451f0c6320 --verify returned release only: 22 files, versions and notes; JSON comparisons and git log v0.9.30..HEAD confirm manifest consistency and history coverage. No application tests rerun for this metadata/copy-only diff.

Need: yes, release metadata · Size: ok · Reuse: existing set-version release list · Simpler: already minimal · Structure: fine (checked scripts/set-version.ts; no new helpers or split)
Risk: low - versions and release copy only.

Verdict: APPROVE
Reasoning: The requested copy correction is complete and the rebase preserves the release-only scope and version consistency.

Reviewed by hf-review.