Bump the pinned upstream version to 1.7.37 and document what changed in
the framework since 1.7.34:
- Logging: the 'handlers' property (default ConsoleHandler) and the
opt-in FileHandler with its pattern/limit/count/append options
(1.7.36).
- Static files: HttpServer now serves only server.static.dirs /
server.static.dir (default 'static') and rejects traversal, hidden
files and project-root files (1.7.37).
- Dual-mode wording: only Mode.DEFAULT actions are reachable from both
CLI and HTTP; actions bound to Mode.CLI or an HTTP method are rejected
from the other transport (ApplicationManager.call).
- Login example now checks credentials instead of storing a hard-coded
user id in the session.
- Red Flags rows for the new failure modes.
The ja-JP translation is updated to match. The frontmatter description
is unchanged.
@James
4f0c087661