0.6.0 removes 13 exports (incl. `secure`) with no changelog entry; README still documents them

[stevensacks]

0.6.0's changelog covers the instrument overhaul in detail, but it doesn't mention that a number of exports were removed. Diffing dist/index.d.ts between 0.5.42 and 0.6.0, these 13 are gone:

secure, areFiberEqual, fiberIdMap, hotSwapFiberType, injectOverrideMethods, INSTALL_ERROR, mountFiberRecursively, shouldFilterFiber, traverseFiberAsync, traverseFiberSync, unmountFiber, unmountFiberChildrenRecursively, updateFiberRecursively

Two things make me think this wasn't entirely intentional:

1. The README still documents secure as the primary usage pattern. It's in the API list ("secure to wrap your handlers in a try/catch and determine if handlers are safe to run") and in the main instrument(secure({...})) example, plus three further code samples.
2. The 0.6.0 patch notes describe optimizing shouldFilterFiber internals ("compare symbol descriptions instead of stringifying symbols in shouldFilterFiber") in the same release where its export was dropped.

Why it matters for us

secure is the one blocker. We use bippy for a Playwright-driven render-profiling harness that's injected before React initializes:

instrument(
  secure(
    {
      name: 'react-perf',
      onActive() { /* ... */ },
      onCommitFiberRoot(_rendererID, root) {
        traverseRenderedFibers(root, onRender);
      },
    },
    {
      dangerouslyRunInProduction: false,
      installCheckTimeout: 5000,
      minReactMajorVersion: 19,
      onError: recordError,
    }
  )
);

Those four options are doing real work for us: the production gate (timings are meaningless in a prod build), the install-check timeout, and a non-throwing onError so a bad commit handler can't take down the page under test. Without secure, upgrading to 0.6.0 means reimplementing all four by hand.

secure was the only removed export we import, so everything else in our usage still resolves on 0.6.0.

Questions

• Is secure's removal intended? If so, what's the recommended replacement for the production gate, install-check timeout, and error isolation it provided?
• If it isn't intended, would restoring the export in a patch release be possible?

Either way, it'd help to have the removals listed in the changelog, and the README examples updated if they're staying removed.

[aidenybai]

the removal was intentional, but the changelog and readme should have reflected it. the current api can reproduce the production gate, version check, timeout, and error isolation:

let canProfile = false;

const guard = <Arguments extends unknown[]>(
  handler: (...arguments_: Arguments) => void,
) => (...arguments_: Arguments): void => {
  if (!canProfile) return;
  try {
    handler(...arguments_);
  } catch (error) {
    recordError(error);
  }
};

const timeout = window.setTimeout(() => {
  if (isInstrumentationActive()) return;
  recordError(new Error("bippy did not attach within 5s"));
  window.stop();
}, 5_000);

instrument({
  name: "react-perf",
  onActive() {
    window.clearTimeout(timeout);
    canProfile = Array.from(getRDTHook().renderers.values()).every(
      (renderer) =>
        Number.parseInt(renderer.version, 10) >= 19 &&
        detectReactBuildType(renderer) === "development",
    );
  },
  onCommitFiberRoot: guard((_rendererID, root) => {
    traverseRenderedFibers(root, onRender);
  }),
});

lmk if this fixes it. happy to iterate if it doesn’t!

[stevensacks]

Thank you! I’ll dive into this tonight and let you know.