Repository navigation
Releases
v3.0.261103-rc
📦 New builders: Bun, Rspack and Rsbuild
In addition to Rolldown, Rollup and Vite, Nitro can now build your server with three new experimental builders:
| Builder | Use it with |
|---|---|
| Bun (#4987) | bun --bun nitro build (selected automatically on Bun when rolldown/vite are not installed) |
| Rspack (#4942) | builder: "rspack" or NITRO_BUILDER=rspack |
| Rsbuild (#5011) | the nitro() plugin from nitro/rsbuild in rsbuild.config.ts |
All builders run the same Rollup-compatible plugins: Nitro's own, your buildPlugins and the ones presets add. So all Nitro features and deployment presets work with each builder.
⚡ Bun builder
bun --bun nitro buildThe Bun builder bundles with Bun.build. It works with any preset (not only bun) and with nitro dev. Pass extra options with the new bunConfig option.
🦀 Rspack builder
export default defineConfig({ builder: "rspack" });The Rspack builder bundles the server with Rspack v2.3+. Like rolldown and vite, @rspack/core is installed on demand. It is not a dependency of Nitro. Load and transform filters become native Rspack loader conditions, so less work goes through JS. There is also a new rspack template for nitro create.
🧩 nitro/rsbuild plugin
import { defineConfig } from "@rsbuild/core";
import { nitro } from "nitro/rsbuild";
export default defineConfig({
plugins: [nitro()],
});This plugin works like nitro/vite, using the environments API of Rsbuild. Client, SSR and the Nitro server compile in one Rsbuild compiler. rsbuild dev, build, build --watch and preview work with Nitro, as do SSR outlets in the HTML template, ?assets imports and services. It also works with environments from other plugins, for example TanStack Start (@tanstack/react-start/plugin/rsbuild). 👉 Rsbuild docs · examples: rsbuild-ssr-html, rsbuild-ssr-react, rsbuild-ssr-tss-react
Note
These builders are experimental: their behavior may change in minor releases. Known limits are listed in each PR. For example, emitFile only supports assets, and with Bun, library chunks are not grouped.
🔌 Shared services + fetchService() (#5023)
Services are now part of Nitro core, with the same config and runtime API for nitro/vite and nitro/rsbuild:
export default defineConfig({
services: { api: { entry: "./src/api-entry.ts" } },
});import { fetchService } from "nitro/services";
const res = await fetchService("api", "/hello");An ssr service is detected from an entry-server file. Your HTML template can render <!--ssr-outlet--> and use fetchService in its context. vite.services and fetchViteEnv() keep working as deprecated aliases.
🧱 Renderer templates compiled at build time (#5019)
The renderer template is now compiled at build time, in dev and production, with all builders. Templates are no longer evaluated at runtime (new Function), so template syntax works in dev on workerd/Cloudflare too (#5014). Syntax errors name the template file. With Vite dev, page requests no longer wait for transformIndexHtml (~306 ms → ~3 ms per page request in a benchmark with a slow HTML plugin). This release also fixes fetchViteEnv is not defined during prerendering.
⚡ Vite integration
- Built-in
?assetsimports (#5013):?assetsimports are now built into Nitro, based on the original work by Hiroshi Ogawa (@hi-ogawa).nitro/rsbuildsupports them too. - Vite
base⇄ NitrobaseURL(#5022):vite build --base /app/now serves routes and assets under/app/. Without a Vitebase, NitrobaseURLis used as the Vitebase. AbaseURLset explicitly in Nitro config always wins. - Missing hashed assets return a
no-store404 (#5020): A request for an old chunk during a deploy no longer gets the HTML page with an immutable one-year cache header.
Important
Behavior changes: Server routes under the client assetsDir (/assets/ by default) now return 404 in production builds. With only a Vite base set, dev now matches production. Set baseURL: "/" to keep the server at the root.
🚀 Enhancements
- Experimental
bunbuilder (#4987) - Experimental
rspackbuilder (#4942) - Shared
servicesin core withfetchServicefromnitro/services(#5023) - Experimental
nitro/rsbuildplugin (#5011)
🩹 Fixes
- dev: Compile renderer template with workerd eval binding (#5014)
- vite: Return
no-store404 for missing hashed client assets (#5020) - vite: Use vite
baseas nitrobaseURLand vice versa (#5022)
💅 Refactors
📖 Documentation
- Remove nightly-only mentions (1d39bf2b)
Preset Changes
- vercel: Run scheduled tasks with vercel schedules (experimental) (#4756)
- vercel: Invoke path schedules with
GET(#5010)
❤️ Contributors
v3.0.261102-rc
🚀 Enhancements
- presets: Add static cors headers to public asset dirs (#4964)
- dev: Auto-reload dev error pages with every builder (#4986)
- deps: Add
deps.installoption and skip installs in CI by default (#4998)
🔥 Performance
- build: Split library chunks by the entries that load them (#4967)
- build: Normalize alias maps once before resolving (#4997)
🩹 Fixes
- presets: Skip empty route rule headers in platform configs (#4963)
- build: Write public assets in a stable order (#4975)
- vite: Reload dev error pages once the server recovers (#4976)
- Resolve the most specific alias for handler paths (#4981)
- scan: Don't treat names after a numeric order prefix as suffixes (#4995)
- vite: Resolve dev externals without the
developmentcondition (#4996) - externals: Resolve non-hoisted traced
require()ids from rolldown's__requirehelper (#4992) - preview: Load
.envbefore srvx resolves the listen port (#5004) - vite: Find the entry of a service environment marked as built (#5007)
- node: Exit when the server fails to listen (#5008)
Preset Changes
- vercel: Support node.js 26 (#4969)
❤️ Contributors
v2.13.6
🔒 Security
This release contains 3 security fixes and additional hardening for cache, proxy and redirect route rules. If you're on nitropack v2 (including Nuxt 3 and 4), please upgrade.
- GHSA-39r7-wfcx-99xg: Cached event handlers might share entries across HTTP methods or replay per-user
Set-Cookieheaders - GHSA-rhhp-7488-3qwf: Proxy route rule scope bypass via empty
//segment and prefix re-entry - GHSA-pqxc-r4h5-jc95: Open redirect via backslash and control characters in wildcard
redirectroute rules
🔥 Performance
- externals: Memoize tryResolve per importer directory in node-externals (v2) (#4800)
🩹 Fixes
- Add typeFrom support for
autoimports exports generation (#3963) - cache: Only cache
GET/HEADand never store per-user responses (9c2691d9) - route-rules: Validate final proxy/redirect target scope (353eff5c)
- route-rules: Prevent open redirect via backslash and control characters in wildcard redirects (f16a4fad)
Dependencies
- Update archiver to v8 (#4936)
Preset Changes
- vercel: Support node.js 26 (#4968)
❤️ Contributors
- Pooya Parsa (@pi0)
- Ali Smesseim (@ali-vercel)
- Liang Xu (@lx3133584)
- Octavio Araiza (@8ctavio)
- @agustin18
v3.0.261029-rc
Important
🚀 Nitro v3 Release Candidate is here! Read the announcement: nitro.build/blog/v3-rc
✨ Highlights
- 📦 Runtime mode: run servers from source with no build step (
nitro serve,builder: false,nitro fetch) - 🧩 Build plugins: one
buildPluginsoption that works with every builder and runtime mode - 🪶 5× smaller install: six direct dependencies; optional ones are installed on demand
- 🧪 Zero-config Vitest: test routes through the
nitro()Vite plugin without starting a dev server - 🔌 Server entry options: typed srvx options (port, body limits, TLS) from
server.ts - 🏷️ Custom environments: define
$envnames and select one with--envName - 🥟 Runtime-native dev server:
nitro devuses Bun and Deno built-in servers - ▲ Vercel: explicit ISR, query handling,
rou3routing and runtime frompackage.json - ☁️ Local Cloudflare: Durable Objects, Workflows and service bindings in
nitro devandvite dev - 🏁
nitro create: scaffold a new project from a template
See Upgrading from Beta for breaking changes and migration steps.
🚀 Enhancements
- scan: Support
QUERYmethod suffix for file-based routes (#4594) - builder: Expose
startPreviewanddeploy(#4619) - Pass server entry options to
srvx(#4620) - vite: Add
vite:compile:beforehook (#4440) - dev: Minimal error page (#4699)
- Experimental
builder: false(#4686) - cache: Decouple cache storage from kv with
cacheconfig (#4709) - Install
unenvon demand (#4710) - Add unified
buildPluginsoption (#4715) - dev: Serve chrome
devtools.jsonfor automatic workspace folders (#4747) - vite: Vitest support (#4748)
- config: Expose resolved config layers as
nitro.options.layers(#4813) - Respond with 405 for routes matched only by other methods (#4811)
- vite:
⚠️ Moveexperimental.viteoptions toviteconfig (#4827) - dev: Use runtime-native server for dev listener (#4832)
- Install
unstorage,db0andocacheon demand (#4764) - runtime: Support async plugins (#4840)
- scan:
⚠️ Reserve dotted suffixes in scanned file names (#4845) - On-demand dependency manifest and
depsoption (#4839) - cli: Add
nitro serve(#4849) - cli: Add
nitro createcommand (#4878) - Resolve tsconfig
pathsaliases with all builders (#4879) - tracing: Trace
db0queries (#4909) - Enable
srvxFastResponseglobally for node builds (#4910) - prerender: Add
ignoreStatusCodesoption (#4922) - dev: Add
devServer.drainoption (#4916) - Emit files referenced with
new URL(..., import.meta.url)(#4932) - Add
import.meta.envNameand--envNamecli flag (#4934) - cli: Add
nitro fetchcommand (#4958) - prerender: Support
rou3patterns inprerender.ignore(#4961)
🔥 Performance
- runtime: Skip static middleware work for non-asset requests (#4854)
- unbundled: Synchronous built-in plugin hooks (#4862)
- cli: Run
nitro servein-process withoutbuildPlugins(#4865) - build: Skip gzip for
node_modulesfiles in the size report (#4926) - build: Skip unchanged sourcemaps (#4925)
- build: Add a
codehook filter to the replace plugin (#4946)
🩹 Fixes
- static: Respond with 404 when a public asset is missing on disk (#4588)
- Resolve driver lib deps from the project only (#4589)
- vite: Run
closehooks when the dev server shuts down (#4593) - dev: Degrade gracefully when reaching system file watcher limit (#4616)
- config: Load
.envfiles when resolving non-dev config (#4607) - scan: Only auto-register
modules/*andmodules/*/indexfiles (#4595) - externals: Trace deps required from bundled commonjs packages (#4598)
- routing: Normalize route patterns like
h3(#4600) - vite: Start dev runner lazily and harden dev server routing (#4633)
- vite: Allow providing the vite package path (#4637)
- vite: Skip websocket upgrade listener in middleware mode (#4647)
- Only pass known safe server entry options to
srvx(#4654) - vite: Throw a descriptive error when a service entry has no
fetchhandler (#4656) - runtime: Use
node:pathin dev error handler (db7a719c) - vite: Pass renderer template path to
transformIndexHtml(#4672) - dev: Read renderer template on host when the runner has no fs access (#4676)
- build: Ignore
MODULE_LEVEL_DIRECTIVEwarnings (#4696) - vite: Wait for environment registration before dispatching dev requests (#4703)
- dev: Show cwd-relative paths in the error page on Windows (#4705)
- vite: Ignore errors after client disconnect (#4708)
- dev: Use the websocket adapter of the runtime the dev worker runs in (#4711)
- build: Reject output cleanup that deletes public assets (#4685)
- tasks: Stop scheduled tasks on runtime close (#4416)
- build: Select Nitro server entry from multiple chunks (#4668)
- dev: Proxy websocket upgrades for
devProxyroutes withws(#4480) - build: Set
debugNamefor rolldown lib chunks group (#4729) - vite: Route dev handlers + proxies before vite base rewrite (#4734)
- prerender: Only refuse
..as a whole path segment (#4738) - vite: Keep no-fallthrough public dir base and HEAD in sync with dev app routes (#4737)
- externals: Keep per-version ids for traced externals imported from bundled code (#4740)
- vite: Register service environments only after they are constructed (#4743)
- vite: Wait longer for slow dev reloads and add
NITRO_DEV_RELOAD_TIMEOUT(#4745) - externals: Externalize a package's own entry as its bare name (#4683)
- externals: Normalize bare package name on windows (9ca3af06)
- static: Handle weighted accept-encoding values (#4470)
- vite: Suppress aborted errors on HTTP/2 client disconnect (#4773)
- vite: Exclude virtual modules from vitest fs module cache (bf4a8287)
- config: Merge preset and user hooks instead of overriding (#4809)
- routing: Match base path for named catch-all routes (#4812)
- runtime: Serve HEAD requests with GET routes (#4817)
- cli: Avoid double prerender with vite builder (#4833)
- build: Compress late-written public assets ([#4818](https://github.com/nitro...
v2.13.5
Preset Changes
- aws-amplify: Support node.js 22 and 24 runtimes (#4244)
- cloudflare: Prefer source path rather than #imports (#4247)
- vercel: Add framework info to build output config (#4475)
- vercel: Add support for node@24 (v2) (#4628)
✅ Tests
- Fix windows path handling in new tests (f6bcc4f4)
- Use memory cache storage in dev fixture to avoid flaky cache test (e98dced6)
🩹 Fixes
- types: Only strip extensions that ts retries (f3a57737)
- types: Emit auto-import paths as files, not directories (#4334)
- Respect h3 url in swr handler (#4386)
- Preserve sourcemap mappings for chunks containing user code (#4450)
- build: Count each output file once in the size report (#4569)
- vercel: Mark header-only route entries as continue (#4651)
- cloudflare: Guard nodejs_compat flag by compatibility date (#4663)
- cloudflare: Detect implicit nodejs_compat when deployConfig is false (#4667)
- cloudflare: Warn only about conflicting asset overrides (#4690)
- externals: Match string rules against windows ids (#4732)
- externals: Normalize resolved paths on windows (#4752)
- rollup: Keep import attributes in the build output (#4519)
- dev: Close upgraded sockets and resolve on worker shutdown timeout (#4671)
- openapi: Only filter undefined from array nodes (#3895)
- dev: Proxy websocket upgrades for devProxy routes with ws (#4788)
- vercel: Strip trailing slash from prerendered route overrides (#4791)
- vercel: Use SameSite=Lax for skew protection cookie (#4789)
- static: Respond with 404 when a public asset is missing on disk (#4787)
- bun: Support NITRO_BUN_IDLE_TIMEOUT=0 (#4190)
- vercel: Enable ISR passQuery when allowQuery is set (#4790)
- prepare: Keep public assets inside output dir when cleaning (#4798)
- task: Support dev worker listening on a unix socket or named pipe (#4797)
- node, deno: Support PORT=0 for random port assignment (#4796)
- bun: Use hostname option for Bun.serve (#4795)
- prerender: Only refuse .. as a whole path segment (#4794)
- cloudflare: Fix baseURL traversal for wrangler assets dir (#4793)
- cloudflare: Use pathe for POSIX relative paths in wrangler.json (v2) (#4801)
📖 Documentation
- Workaround for search-and-replace issues (#3078)
📦 Build
- Resolve subpath types under nodenext (#4757)
🌊 Types
- Widen RollupConfig.plugins to accept rolldown-typed plugins (#4484)
- Add missing wrangler observability types (#4742)
🔥 Performance
- dev: Cache sourcemap consumer per bundle in error handler (#4786)
❤️ Contributors
- Liang Xu
- Pooya Parsa (@pi0)
- Ilya Semenov (@IlyaSemenov)
- Kricsleo (@kricsleo)
- Nestor Vera
- Daniel Roe (@danielroe)
- Leonid G. agantelin@gmail.com
- Rocky
- Paul
- Harlan Wilton
- Agustin18
- Rihan Arfan (@RihanArfan)
- Jonas Thelemann
- Maxim Lepekha
- Adrien Foulon
- Abdul Rauf (@armujahid)
v3.0.260903-beta
Note
Thi release focuses on security hardenings, bug fixes, better observability, and a more reliable development experience.
Many of new improvements are from major dependency upgrades (h3, srvx, rou3, ocache, db0, env-runner, unctx and unwasm) plus the work in Nitro to adopt them. The sections below group the changes by what they mean for your app.
🚀 What’s new
🧭 Routing and route rules
Nitro migrated to the new route rules engine from h3, backed by rou3 v0.9. See the Nitro routing guide and h3 route rules guide. (#4411)
- Rules are matched on the canonical path, with sibling routes ordered by specificity. (#4396)
GETroutes automatically answerHEADrequests.- New
corsrule replaces manual CORS wiring:{ "/api/**": { cors: true } }. basicAuthroute rules are replaced by middleware (see After you upgrade).
💾 Caching
defineCachedHandler, defineCachedFunction and cache route rules now run on ocache v0.3 (up from 0.1), which brings safer defaults, bounded memory and several new capabilities. Please review your caching configuration — defaults changed. See Review your caching configuration and the Nitro caching guide.
🗄️ Database
Nitro now uses db0 v0.4. Database client libraries are passed explicitly to connectors; Nitro handles this for configured connectors and prompts to install what is missing. New in this line: neon, prisma and libsql-core connectors, Kysely integration, database capabilities metadata, and tracing channel support. See the Nitro database guide, db0 connectors, and db0 integrations.
🔌 WebSockets
WebSocket support moves to crossws 0.4.12 (from 0.4.6), which adds a batch of features usable from Nitro WebSocket handlers. See the Nitro WebSocket guide.
- Liveness: universal
idleTimeoutto detect half-open connections, application-level ping/pong hooks andpeer.ping(). (#201, #202) - Backpressure:
peer.bufferedAmount(docs) and opt-in subprotocol negotiation. (#195, #203) - Pub/sub: a sync backplane to share channels across instances (docs), plus auth and context support. (#192, #112)
🔭 Observability and tracing
- Native platform traces: Nitro sends spans to Vercel session traces and Cloudflare Workers Observability without bundling the OpenTelemetry SDK. (#4355, #4413)
- Built-in tracing logger: enable
tracingChannelandexperimental.tracingLoggerto log completed h3, srvx, unstorage, db0 and other spans in development and production — without additional dependencies. (#4406)
🔒 Security
- h3 has undergone several rounds of security hardening audits (path normalization, forwarded headers, host header handling, cookies, CORS, basic auth, JSON-RPC, session sealing).
- Development task endpoints (
/_nitro/tasksand/_nitro/tasks/:name) now accept only local requests. This prevents remote clients with access to the dev server from listing or invoking tasks. (#4389) - Cached responses no longer replay cookies by default.
- Better static file responses: conditional requests with
ETagandLast-Modified, byte ranges, optionalCache-Control, and additional path-traversal hardening.
⚡ Faster and more reliable
- Improved alias resolution, development sourcemaps, request middleware, and logging.
- Development worker reloads are serialized and cleanly awaited, stale module caches are cleared, (vite) aliases apply in the correct order, base paths are respected, and
?importrequests remain handled by Vite. - Static presets no longer create an unnecessary server bundle.
📁 Import any file as bytes or text
In server bundle: (#4431)
import logo from "./logo.png" with { type: "bytes" }; // Uint8Array
import readme from "./README.md" with { type: "text" }; // string📦 No more peer dependencies
Nitro no longer has any peer dependencies. Features that need an extra package (a builder, a preset, a storage driver, a database connector) resolve it from your project, and Nitro prompts to install anything missing. In CI, missing packages are installed automatically. Existing projects need no changes when the required packages are already installed. (#4542, #4543)
Nitro also validates the version of what it finds and warns when an installed package is outside the supported range. Supported builders are vite@^7 || ^8, rollup@^4 and rolldown@>=1.0.0. (87219b2)
Leaner install
Alongside dropping peer dependencies, several packages were removed from Nitro entirely: tsconfck (replaced by get-tsconfig), magic-string, uncrypto, serve-placeholder, edge-runtime, @types/http-proxy and @types/node-fetch. ofetch is no longer a runtime dependency, and rou3 is now a direct dependency instead of being pulled in indirectly.
☁️ Presets
- Cloudflare: local development now uses Miniflare/
workerddirectly, with bindings available on the request event. Nitro offers to installminiflarewhen first needed. See the Nitro Cloudflare guide. (#4338) - Vercel: set
vercel.immutableStaticFiles: trueto emit content-hashed static files with immutable caching. See the Nitro Vercel guide. (#4432) - Netlify Edge: keeps dynamic imports lazy, reducing cold-start work for lazy handlers and deferred WASM initialization. (#4525)
⚠️ Migration
Routing
-
Replace
basicAuthroute rules with middleware.import { defineHandler } from "nitro"; import { basicAuth } from "nitro/h3"; export default defineHandler({ middleware: [basicAuth({ username: "admin", password: "supersecret" })], handler: (event) => `Hello, ${event.context.basicAuth?.username}!`, });
To protect multiple routes, register route-scoped middleware or add it under
middleware/. -
Use the new
corsrule where needed:{ "/api/**": { cors: true } }. -
Update renamed types when convenient:
NitroRouteConfigandNitroRouteRulesare deprecated aliases forRouteRuleConfigandNormalizedRouteRules. The old names are still exported fromnitro/types.
Review your caching configuration
The upgrade from ocache 0.1 to 0.3 introduces safer defaults for defineCachedHandler, defineCachedFunction, and cache route rules:
swrnow defaults tofalse, so expired entries are refreshed before returning. Setswr: trueto keep background revalidation. Theswrroute-rule shortcut already does this.- Query parameters are ignored by default. Set
allowQuery: trueor list the parameters that should affect the cache key. - Cookies are removed from cached requests and responses unless listed in
allowCookies; responses containingSet-Cookieare not cached. GETandHEADnow use separate cache entries.- Cache keys now include the request authority, and undeclared request headers are hidden from handlers.
- Cache resolution has a new 30-second timeout (
maxResolveTime), and memory storage is limited by bytes.
See the ocache migration guide for details.
📦 Major dependency updates
| Package | From | To | Release notes |
|---|---|---|---|
h3 |
2.0.1-rc.22 |
^2.0.1-rc.29 |
rc.23 … rc.29 |
srvx |
^0.11.16 |
^0.12.7 |
v0.12.0 |
rou3 |
^0.8.1 |
^0.9.2 |
v0.9.0 |
db0 |
^0.3.4 |
^0.4.0 |
v0.4.0 |
env-runner |
^0.1.12 |
^0.2.0 |
v0.2.0 |
ocache |
^0.1.5 |
^0.3.0 |
v0.2.0, v0.3.0 — crosses two lines |
unctx |
^2.5.0 |
^3.0.1 |
v3.0.0 |
unwasm |
^0.5.3 |
^0.6.0 |
v0.6.0 |
h3
- **New ...
v3.0.260610-beta
🚀 Enhancements
- prerender: Run prerenderer in isolate worker (#4326)
- vite: Use explicit module graph for service entries (#4327)
Preset Changes
- vercel: Support websocket upgrades (internal testing) (#4317)
🩹 Fixes
- Try to resolve server entry also from server dir (#4313)
- runtime: Avoid std-env in warning stub (#4296)
- vite: Force resolve
nitro/imports from service envs (#4324) - vite: Inherit renderer for prerender build (#4325)
- vite, prerender: Use shared virtuals (#4328)
- build: Add
buildDirtonoExternalsif insidenode_modules(#4329) - types: Emit auto-import paths as files, not directories (#4333)
- vite: Propagate service fetch errors in dev to match production (#4335)
📖 Documentation
- Fix inline escaing (#4312)
❤️ Contributors
- Pooya Parsa (@pi0)
- Daniel Roe (@danielroe)
- Andrew Barba (@AndrewBarba)
- Max (@onmax)
- Eduardo San Martin Morote (@posva)
v3.0.260603-beta
🚀 Enhancements
- build: Support custom framework preview/deploy commands (#4293)
- config: Add
defaultPresetto customize the fallback preset (#4299)
🩹 Fixes
- types: Only strip extensions that ts retries (#4297)
📖 Documentation
❤️ Contributors
- Pooya Parsa (@pi0)
- Matvey (@matrv)
- Ulrich Stark (@ulrichstark)
- Daniel Roe (@danielroe)
v3.0.260522-beta
🚀 Enhancements
🔥 Performance
- Use VFS for nitro app dynamic code (#4251)
🩹 Fixes
- vite: Route extensionless URLs matching a nitro route to nitro under asset
sec-fetch-dest(7d49dcae) - vite: Ignore query-string extensions when detecting asset requests (08f2ec69)
- build: Externalize packages with import-only exports (d7a34477)
- vite: Pass correct
rootconfig in builder (6c9007c0) - vite: Resolve vite dep from user dir (e770268d)
- vite: Allow global prod builds with npx (#4260)
- vite: Route asset-extensioned URLs matching explicit routes to nitro (#4272)
💅 Refactors
- Replace inlined types with upstream deps (#4239)
📖 Documentation
- Correct tsconfig paths alias in
vite-ssr-tsr-reactexample (#4271)
Preset Changes
- aws-amplify: Support node.js 24 runtime (#4245)
❤️ Contributors
- Rihan Arfan (@RihanArfan)
- Pooya Parsa (@pi0)
- Sihan (Echo) Zhang (@ZDSJdeJT)
- Abdelrahman Awad (@logaretm)
- Abdul Rauf (@armujahid)
v3.0.260429-beta
Important
This release patches two medium-severity vulnerabilities in proxy and redirect route rules. Users relying on either are strongly encouraged to upgrade. See GHSA-5w89-w975-hf9q and GHSA-9phm-9p8f-hw5m for details.
🚀 Enhancements
- tracing: Enable tracing channels for unstorage (#4226)
🩹 Fixes
- Accept ipv4-mapped ipv6 loopback in vfs handler (#4212)
- route-rules: Reject out-of-scope requests (#4222)
- route-rules: Prevent open redirect via protocol-relative url bypass (#4236)
- vite: Route browser asset loads to vite when
sec-fetch-destis absent (#4238)
💅 Refactors
- Use built-in
escapeRegExputil (#4109)
📖 Documentation
📦 Build
- Shim oxc-parser via rolldown/utils (#4237)
🌊 Types
- vite: Make
experimental.vitetype optional (#4225)
Preset Changes
- cloudflare: Add missing types for cloudflare.wrangler.observability.traces (#4220)
- vercel: Enable
shouldAddSourcemapSupportwhen sourcemap is enabled (#4232)