Skip to content

Releases

v3.0.261103-rc

Choose a tag to compare

@github-actions github-actions released this 03 Nov 18:16

📦 New builders: Bun, Rspack and Rsbuild

In addition to Rolldown, Rollup and Vite, Nitro can now build your server with three new experimental builders:

Builder Use it with
Bun (#4987) bun --bun nitro build (selected automatically on Bun when rolldown/vite are not installed)
Rspack (#4942) builder: "rspack" or NITRO_BUILDER=rspack
Rsbuild (#5011) the nitro() plugin from nitro/rsbuild in rsbuild.config.ts

All builders run the same Rollup-compatible plugins: Nitro's own, your buildPlugins and the ones presets add. So all Nitro features and deployment presets work with each builder.

⚡ Bun builder

bun --bun nitro build

The Bun builder bundles with Bun.build. It works with any preset (not only bun) and with nitro dev. Pass extra options with the new bunConfig option.

🦀 Rspack builder

export default defineConfig({ builder: "rspack" });

The Rspack builder bundles the server with Rspack v2.3+. Like rolldown and vite, @rspack/core is installed on demand. It is not a dependency of Nitro. Load and transform filters become native Rspack loader conditions, so less work goes through JS. There is also a new rspack template for nitro create.

🧩 nitro/rsbuild plugin

import { defineConfig } from "@rsbuild/core";
import { nitro } from "nitro/rsbuild";

export default defineConfig({
  plugins: [nitro()],
});

This plugin works like nitro/vite, using the environments API of Rsbuild. Client, SSR and the Nitro server compile in one Rsbuild compiler. rsbuild dev, build, build --watch and preview work with Nitro, as do SSR outlets in the HTML template, ?assets imports and services. It also works with environments from other plugins, for example TanStack Start (@tanstack/react-start/plugin/rsbuild). 👉 Rsbuild docs · examples: rsbuild-ssr-html, rsbuild-ssr-react, rsbuild-ssr-tss-react

Note

These builders are experimental: their behavior may change in minor releases. Known limits are listed in each PR. For example, emitFile only supports assets, and with Bun, library chunks are not grouped.

🔌 Shared services + fetchService() (#5023)

Services are now part of Nitro core, with the same config and runtime API for nitro/vite and nitro/rsbuild:

export default defineConfig({
  services: { api: { entry: "./src/api-entry.ts" } },
});
import { fetchService } from "nitro/services";

const res = await fetchService("api", "/hello");

An ssr service is detected from an entry-server file. Your HTML template can render <!--ssr-outlet--> and use fetchService in its context. vite.services and fetchViteEnv() keep working as deprecated aliases.

🧱 Renderer templates compiled at build time (#5019)

The renderer template is now compiled at build time, in dev and production, with all builders. Templates are no longer evaluated at runtime (new Function), so template syntax works in dev on workerd/Cloudflare too (#5014). Syntax errors name the template file. With Vite dev, page requests no longer wait for transformIndexHtml (~306 ms → ~3 ms per page request in a benchmark with a slow HTML plugin). This release also fixes fetchViteEnv is not defined during prerendering.

⚡ Vite integration

  • Built-in ?assets imports (#5013): ?assets imports are now built into Nitro, based on the original work by Hiroshi Ogawa (@hi-ogawa). nitro/rsbuild supports them too.
  • Vite base ⇄ Nitro baseURL (#5022): vite build --base /app/ now serves routes and assets under /app/. Without a Vite base, Nitro baseURL is used as the Vite base. A baseURL set explicitly in Nitro config always wins.
  • Missing hashed assets return a no-store 404 (#5020): A request for an old chunk during a deploy no longer gets the HTML page with an immutable one-year cache header.

Important

Behavior changes: Server routes under the client assetsDir (/assets/ by default) now return 404 in production builds. With only a Vite base set, dev now matches production. Set baseURL: "/" to keep the server at the root.


compare changes

🚀 Enhancements

  • Experimental bun builder (#4987)
  • Experimental rspack builder (#4942)
  • Shared services in core with fetchService from nitro/services (#5023)
  • Experimental nitro/rsbuild plugin (#5011)

🩹 Fixes

  • dev: Compile renderer template with workerd eval binding (#5014)
  • vite: Return no-store 404 for missing hashed client assets (#5020)
  • vite: Use vite base as nitro baseURL and vice versa (#5022)

💅 Refactors

  • vite: Built-in ?assets imports (#5013)
  • Compile renderer template at build time in core (#5019)

📖 Documentation

  • Remove nightly-only mentions (1d39bf2b)

Preset Changes

  • vercel: Run scheduled tasks with vercel schedules (experimental) (#4756)
  • vercel: Invoke path schedules with GET (#5010)

❤️ Contributors

v3.0.261102-rc

Choose a tag to compare

@github-actions github-actions released this 02 Nov 18:03

compare changes

🚀 Enhancements

  • presets: Add static cors headers to public asset dirs (#4964)
  • dev: Auto-reload dev error pages with every builder (#4986)
  • deps: Add deps.install option and skip installs in CI by default (#4998)

🔥 Performance

  • build: Split library chunks by the entries that load them (#4967)
  • build: Normalize alias maps once before resolving (#4997)

🩹 Fixes

  • presets: Skip empty route rule headers in platform configs (#4963)
  • build: Write public assets in a stable order (#4975)
  • vite: Reload dev error pages once the server recovers (#4976)
  • Resolve the most specific alias for handler paths (#4981)
  • scan: Don't treat names after a numeric order prefix as suffixes (#4995)
  • vite: Resolve dev externals without the development condition (#4996)
  • externals: Resolve non-hoisted traced require() ids from rolldown's __require helper (#4992)
  • preview: Load .env before srvx resolves the listen port (#5004)
  • vite: Find the entry of a service environment marked as built (#5007)
  • node: Exit when the server fails to listen (#5008)

Preset Changes

  • vercel: Support node.js 26 (#4969)

❤️ Contributors

v2.13.6

Choose a tag to compare

@pi0 pi0 released this 02 Nov 17:10

compare changes

🔒 Security

This release contains 3 security fixes and additional hardening for cache, proxy and redirect route rules. If you're on nitropack v2 (including Nuxt 3 and 4), please upgrade.

  • GHSA-39r7-wfcx-99xg: Cached event handlers might share entries across HTTP methods or replay per-user Set-Cookie headers
  • GHSA-rhhp-7488-3qwf: Proxy route rule scope bypass via empty // segment and prefix re-entry
  • GHSA-pqxc-r4h5-jc95: Open redirect via backslash and control characters in wildcard redirect route rules

🔥 Performance

  • externals: Memoize tryResolve per importer directory in node-externals (v2) (#4800)

🩹 Fixes

  • Add typeFrom support for autoimports exports generation (#3963)
  • cache: Only cache GET/HEAD and never store per-user responses (9c2691d9)
  • route-rules: Validate final proxy/redirect target scope (353eff5c)
  • route-rules: Prevent open redirect via backslash and control characters in wildcard redirects (f16a4fad)

Dependencies

  • Update archiver to v8 (#4936)

Preset Changes

  • vercel: Support node.js 26 (#4968)

❤️ Contributors

v3.0.261029-rc

Choose a tag to compare

@github-actions github-actions released this 29 Oct 11:58

Important

🚀 Nitro v3 Release Candidate is here! Read the announcement: nitro.build/blog/v3-rc

✨ Highlights

  • 📦 Runtime mode: run servers from source with no build step (nitro serve, builder: false, nitro fetch)
  • 🧩 Build plugins: one buildPlugins option that works with every builder and runtime mode
  • 🪶 5× smaller install: six direct dependencies; optional ones are installed on demand
  • 🧪 Zero-config Vitest: test routes through the nitro() Vite plugin without starting a dev server
  • 🔌 Server entry options: typed srvx options (port, body limits, TLS) from server.ts
  • 🏷️ Custom environments: define $env names and select one with --envName
  • 🥟 Runtime-native dev server: nitro dev uses Bun and Deno built-in servers
  • ▲ Vercel: explicit ISR, query handling, rou3 routing and runtime from package.json
  • ☁️ Local Cloudflare: Durable Objects, Workflows and service bindings in nitro dev and vite dev
  • 🏁 nitro create: scaffold a new project from a template

See Upgrading from Beta for breaking changes and migration steps.

compare changes

🚀 Enhancements

  • scan: Support QUERY method suffix for file-based routes (#4594)
  • builder: Expose startPreview and deploy (#4619)
  • Pass server entry options to srvx (#4620)
  • vite: Add vite:compile:before hook (#4440)
  • dev: Minimal error page (#4699)
  • Experimental builder: false (#4686)
  • cache: Decouple cache storage from kv with cache config (#4709)
  • Install unenv on demand (#4710)
  • Add unified buildPlugins option (#4715)
  • dev: Serve chrome devtools.json for automatic workspace folders (#4747)
  • vite: Vitest support (#4748)
  • config: Expose resolved config layers as nitro.options.layers (#4813)
  • Respond with 405 for routes matched only by other methods (#4811)
  • vite: ⚠️ Move experimental.vite options to vite config (#4827)
  • dev: Use runtime-native server for dev listener (#4832)
  • Install unstorage, db0 and ocache on demand (#4764)
  • runtime: Support async plugins (#4840)
  • scan: ⚠️ Reserve dotted suffixes in scanned file names (#4845)
  • On-demand dependency manifest and deps option (#4839)
  • cli: Add nitro serve (#4849)
  • cli: Add nitro create command (#4878)
  • Resolve tsconfig paths aliases with all builders (#4879)
  • tracing: Trace db0 queries (#4909)
  • Enable srvx FastResponse globally for node builds (#4910)
  • prerender: Add ignoreStatusCodes option (#4922)
  • dev: Add devServer.drain option (#4916)
  • Emit files referenced with new URL(..., import.meta.url) (#4932)
  • Add import.meta.envName and --envName cli flag (#4934)
  • cli: Add nitro fetch command (#4958)
  • prerender: Support rou3 patterns in prerender.ignore (#4961)

🔥 Performance

  • runtime: Skip static middleware work for non-asset requests (#4854)
  • unbundled: Synchronous built-in plugin hooks (#4862)
  • cli: Run nitro serve in-process without buildPlugins (#4865)
  • build: Skip gzip for node_modules files in the size report (#4926)
  • build: Skip unchanged sourcemaps (#4925)
  • build: Add a code hook filter to the replace plugin (#4946)

🩹 Fixes

  • static: Respond with 404 when a public asset is missing on disk (#4588)
  • Resolve driver lib deps from the project only (#4589)
  • vite: Run close hooks when the dev server shuts down (#4593)
  • dev: Degrade gracefully when reaching system file watcher limit (#4616)
  • config: Load .env files when resolving non-dev config (#4607)
  • scan: Only auto-register modules/* and modules/*/index files (#4595)
  • externals: Trace deps required from bundled commonjs packages (#4598)
  • routing: Normalize route patterns like h3 (#4600)
  • vite: Start dev runner lazily and harden dev server routing (#4633)
  • vite: Allow providing the vite package path (#4637)
  • vite: Skip websocket upgrade listener in middleware mode (#4647)
  • Only pass known safe server entry options to srvx (#4654)
  • vite: Throw a descriptive error when a service entry has no fetch handler (#4656)
  • runtime: Use node:path in dev error handler (db7a719c)
  • vite: Pass renderer template path to transformIndexHtml (#4672)
  • dev: Read renderer template on host when the runner has no fs access (#4676)
  • build: Ignore MODULE_LEVEL_DIRECTIVE warnings (#4696)
  • vite: Wait for environment registration before dispatching dev requests (#4703)
  • dev: Show cwd-relative paths in the error page on Windows (#4705)
  • vite: Ignore errors after client disconnect (#4708)
  • dev: Use the websocket adapter of the runtime the dev worker runs in (#4711)
  • build: Reject output cleanup that deletes public assets (#4685)
  • tasks: Stop scheduled tasks on runtime close (#4416)
  • build: Select Nitro server entry from multiple chunks (#4668)
  • dev: Proxy websocket upgrades for devProxy routes with ws (#4480)
  • build: Set debugName for rolldown lib chunks group (#4729)
  • vite: Route dev handlers + proxies before vite base rewrite (#4734)
  • prerender: Only refuse .. as a whole path segment (#4738)
  • vite: Keep no-fallthrough public dir base and HEAD in sync with dev app routes (#4737)
  • externals: Keep per-version ids for traced externals imported from bundled code (#4740)
  • vite: Register service environments only after they are constructed (#4743)
  • vite: Wait longer for slow dev reloads and add NITRO_DEV_RELOAD_TIMEOUT (#4745)
  • externals: Externalize a package's own entry as its bare name (#4683)
  • externals: Normalize bare package name on windows (9ca3af06)
  • static: Handle weighted accept-encoding values (#4470)
  • vite: Suppress aborted errors on HTTP/2 client disconnect (#4773)
  • vite: Exclude virtual modules from vitest fs module cache (bf4a8287)
  • config: Merge preset and user hooks instead of overriding (#4809)
  • routing: Match base path for named catch-all routes (#4812)
  • runtime: Serve HEAD requests with GET routes (#4817)
  • cli: Avoid double prerender with vite builder (#4833)
  • build: Compress late-written public assets ([#4818](https://github.com/nitro...
Read more

v2.13.5

Choose a tag to compare

@pi0 pi0 released this 19 Oct 03:25

compare changes

Preset Changes

  • aws-amplify: Support node.js 22 and 24 runtimes (#4244)
  • cloudflare: Prefer source path rather than #imports (#4247)
  • vercel: Add framework info to build output config (#4475)
  • vercel: Add support for node@24 (v2) (#4628)

✅ Tests

  • Fix windows path handling in new tests (f6bcc4f4)
  • Use memory cache storage in dev fixture to avoid flaky cache test (e98dced6)

🩹 Fixes

  • types: Only strip extensions that ts retries (f3a57737)
  • types: Emit auto-import paths as files, not directories (#4334)
  • Respect h3 url in swr handler (#4386)
  • Preserve sourcemap mappings for chunks containing user code (#4450)
  • build: Count each output file once in the size report (#4569)
  • vercel: Mark header-only route entries as continue (#4651)
  • cloudflare: Guard nodejs_compat flag by compatibility date (#4663)
  • cloudflare: Detect implicit nodejs_compat when deployConfig is false (#4667)
  • cloudflare: Warn only about conflicting asset overrides (#4690)
  • externals: Match string rules against windows ids (#4732)
  • externals: Normalize resolved paths on windows (#4752)
  • rollup: Keep import attributes in the build output (#4519)
  • dev: Close upgraded sockets and resolve on worker shutdown timeout (#4671)
  • openapi: Only filter undefined from array nodes (#3895)
  • dev: Proxy websocket upgrades for devProxy routes with ws (#4788)
  • vercel: Strip trailing slash from prerendered route overrides (#4791)
  • vercel: Use SameSite=Lax for skew protection cookie (#4789)
  • static: Respond with 404 when a public asset is missing on disk (#4787)
  • bun: Support NITRO_BUN_IDLE_TIMEOUT=0 (#4190)
  • vercel: Enable ISR passQuery when allowQuery is set (#4790)
  • prepare: Keep public assets inside output dir when cleaning (#4798)
  • task: Support dev worker listening on a unix socket or named pipe (#4797)
  • node, deno: Support PORT=0 for random port assignment (#4796)
  • bun: Use hostname option for Bun.serve (#4795)
  • prerender: Only refuse .. as a whole path segment (#4794)
  • cloudflare: Fix baseURL traversal for wrangler assets dir (#4793)
  • cloudflare: Use pathe for POSIX relative paths in wrangler.json (v2) (#4801)

📖 Documentation

  • Workaround for search-and-replace issues (#3078)

📦 Build

  • Resolve subpath types under nodenext (#4757)

🌊 Types

  • Widen RollupConfig.plugins to accept rolldown-typed plugins (#4484)
  • Add missing wrangler observability types (#4742)

🔥 Performance

  • dev: Cache sourcemap consumer per bundle in error handler (#4786)

❤️ Contributors

v3.0.260903-beta

Choose a tag to compare

@github-actions github-actions released this 03 Sep 22:55

Note

Thi release focuses on security hardenings, bug fixes, better observability, and a more reliable development experience.

Many of new improvements are from major dependency upgrades (h3, srvx, rou3, ocache, db0, env-runner, unctx and unwasm) plus the work in Nitro to adopt them. The sections below group the changes by what they mean for your app.

🚀 What’s new

🧭 Routing and route rules

Nitro migrated to the new route rules engine from h3, backed by rou3 v0.9. See the Nitro routing guide and h3 route rules guide. (#4411)

  • Rules are matched on the canonical path, with sibling routes ordered by specificity. (#4396)
  • GET routes automatically answer HEAD requests.
  • New cors rule replaces manual CORS wiring: { "/api/**": { cors: true } }.
  • basicAuth route rules are replaced by middleware (see After you upgrade).

💾 Caching

defineCachedHandler, defineCachedFunction and cache route rules now run on ocache v0.3 (up from 0.1), which brings safer defaults, bounded memory and several new capabilities. Please review your caching configuration — defaults changed. See Review your caching configuration and the Nitro caching guide.

🗄️ Database

Nitro now uses db0 v0.4. Database client libraries are passed explicitly to connectors; Nitro handles this for configured connectors and prompts to install what is missing. New in this line: neon, prisma and libsql-core connectors, Kysely integration, database capabilities metadata, and tracing channel support. See the Nitro database guide, db0 connectors, and db0 integrations.

🔌 WebSockets

WebSocket support moves to crossws 0.4.12 (from 0.4.6), which adds a batch of features usable from Nitro WebSocket handlers. See the Nitro WebSocket guide.

  • Liveness: universal idleTimeout to detect half-open connections, application-level ping/pong hooks and peer.ping(). (#201, #202)
  • Backpressure: peer.bufferedAmount (docs) and opt-in subprotocol negotiation. (#195, #203)
  • Pub/sub: a sync backplane to share channels across instances (docs), plus auth and context support. (#192, #112)

🔭 Observability and tracing

🔒 Security

  • h3 has undergone several rounds of security hardening audits (path normalization, forwarded headers, host header handling, cookies, CORS, basic auth, JSON-RPC, session sealing).
  • Development task endpoints (/_nitro/tasks and /_nitro/tasks/:name) now accept only local requests. This prevents remote clients with access to the dev server from listing or invoking tasks. (#4389)
  • Cached responses no longer replay cookies by default.
  • Better static file responses: conditional requests with ETag and Last-Modified, byte ranges, optional Cache-Control, and additional path-traversal hardening.

⚡ Faster and more reliable

  • Improved alias resolution, development sourcemaps, request middleware, and logging.
  • Development worker reloads are serialized and cleanly awaited, stale module caches are cleared, (vite) aliases apply in the correct order, base paths are respected, and ?import requests remain handled by Vite.
  • Static presets no longer create an unnecessary server bundle.

📁 Import any file as bytes or text

In server bundle: (#4431)

  import logo from "./logo.png" with { type: "bytes" }; // Uint8Array
  import readme from "./README.md" with { type: "text" }; // string

📦 No more peer dependencies

Nitro no longer has any peer dependencies. Features that need an extra package (a builder, a preset, a storage driver, a database connector) resolve it from your project, and Nitro prompts to install anything missing. In CI, missing packages are installed automatically. Existing projects need no changes when the required packages are already installed. (#4542, #4543)

Nitro also validates the version of what it finds and warns when an installed package is outside the supported range. Supported builders are vite@^7 || ^8, rollup@^4 and rolldown@>=1.0.0. (87219b2)

Leaner install

Alongside dropping peer dependencies, several packages were removed from Nitro entirely: tsconfck (replaced by get-tsconfig), magic-string, uncrypto, serve-placeholder, edge-runtime, @types/http-proxy and @types/node-fetch. ofetch is no longer a runtime dependency, and rou3 is now a direct dependency instead of being pulled in indirectly.

☁️ Presets

  • Cloudflare: local development now uses Miniflare/workerd directly, with bindings available on the request event. Nitro offers to install miniflare when first needed. See the Nitro Cloudflare guide. (#4338)
  • Vercel: set vercel.immutableStaticFiles: true to emit content-hashed static files with immutable caching. See the Nitro Vercel guide. (#4432)
  • Netlify Edge: keeps dynamic imports lazy, reducing cold-start work for lazy handlers and deferred WASM initialization. (#4525)

⚠️ Migration

Routing

  • Replace basicAuth route rules with middleware.

    import { defineHandler } from "nitro";
    import { basicAuth } from "nitro/h3";
    
    export default defineHandler({
      middleware: [basicAuth({ username: "admin", password: "supersecret" })],
      handler: (event) => `Hello, ${event.context.basicAuth?.username}!`,
    });

    To protect multiple routes, register route-scoped middleware or add it under middleware/.

  • Use the new cors rule where needed: { "/api/**": { cors: true } }.

  • Update renamed types when convenient: NitroRouteConfig and NitroRouteRules are deprecated aliases for RouteRuleConfig and NormalizedRouteRules. The old names are still exported from nitro/types.

Review your caching configuration

The upgrade from ocache 0.1 to 0.3 introduces safer defaults for defineCachedHandler, defineCachedFunction, and cache route rules:

  • swr now defaults to false, so expired entries are refreshed before returning. Set swr: true to keep background revalidation. The swr route-rule shortcut already does this.
  • Query parameters are ignored by default. Set allowQuery: true or list the parameters that should affect the cache key.
  • Cookies are removed from cached requests and responses unless listed in allowCookies; responses containing Set-Cookie are not cached.
  • GET and HEAD now use separate cache entries.
  • Cache keys now include the request authority, and undeclared request headers are hidden from handlers.
  • Cache resolution has a new 30-second timeout (maxResolveTime), and memory storage is limited by bytes.

See the ocache migration guide for details.


📦 Major dependency updates

Package From To Release notes
h3 2.0.1-rc.22 ^2.0.1-rc.29 rc.23 … rc.29
srvx ^0.11.16 ^0.12.7 v0.12.0
rou3 ^0.8.1 ^0.9.2 v0.9.0
db0 ^0.3.4 ^0.4.0 v0.4.0
env-runner ^0.1.12 ^0.2.0 v0.2.0
ocache ^0.1.5 ^0.3.0 v0.2.0, v0.3.0 — crosses two lines
unctx ^2.5.0 ^3.0.1 v3.0.0
unwasm ^0.5.3 ^0.6.0 v0.6.0

h3

  • **New ...
Read more

v3.0.260610-beta

Choose a tag to compare

@github-actions github-actions released this 10 Jun 22:00

compare changes

🚀 Enhancements

  • prerender: Run prerenderer in isolate worker (#4326)
  • vite: Use explicit module graph for service entries (#4327)

Preset Changes

  • vercel: Support websocket upgrades (internal testing) (#4317)

🩹 Fixes

  • Try to resolve server entry also from server dir (#4313)
  • runtime: Avoid std-env in warning stub (#4296)
  • vite: Force resolve nitro/ imports from service envs (#4324)
  • vite: Inherit renderer for prerender build (#4325)
  • vite, prerender: Use shared virtuals (#4328)
  • build: Add buildDir to noExternals if inside node_modules (#4329)
  • types: Emit auto-import paths as files, not directories (#4333)
  • vite: Propagate service fetch errors in dev to match production (#4335)

📖 Documentation

  • Fix inline escaing (#4312)

❤️ Contributors

v3.0.260603-beta

Choose a tag to compare

@github-actions github-actions released this 03 Jun 17:24

compare changes

🚀 Enhancements

  • build: Support custom framework preview/deploy commands (#4293)
  • config: Add defaultPreset to customize the fallback preset (#4299)

🩹 Fixes

  • types: Only strip extensions that ts retries (#4297)

📖 Documentation

  • Fix quick-start preview image (#4307)
  • Fix typo in path to H3 v2 docs (#4301)

❤️ Contributors

v3.0.260522-beta

Choose a tag to compare

@github-actions github-actions released this 22 May 16:18

compare changes

🚀 Enhancements

  • Wrap route handlers with tracing at build time (#4240)
  • vercel: Support queues in local dev (#4264)

🔥 Performance

  • Use VFS for nitro app dynamic code (#4251)

🩹 Fixes

  • vite: Route extensionless URLs matching a nitro route to nitro under asset sec-fetch-dest (7d49dcae)
  • vite: Ignore query-string extensions when detecting asset requests (08f2ec69)
  • build: Externalize packages with import-only exports (d7a34477)
  • vite: Pass correct root config in builder (6c9007c0)
  • vite: Resolve vite dep from user dir (e770268d)
  • vite: Allow global prod builds with npx (#4260)
  • vite: Route asset-extensioned URLs matching explicit routes to nitro (#4272)

💅 Refactors

  • Replace inlined types with upstream deps (#4239)

📖 Documentation

  • Correct tsconfig paths alias in vite-ssr-tsr-react example (#4271)

Preset Changes

  • aws-amplify: Support node.js 24 runtime (#4245)

❤️ Contributors

v3.0.260429-beta

Choose a tag to compare

@github-actions github-actions released this 29 Apr 15:47

compare changes

Important

This release patches two medium-severity vulnerabilities in proxy and redirect route rules. Users relying on either are strongly encouraged to upgrade. See GHSA-5w89-w975-hf9q and GHSA-9phm-9p8f-hw5m for details.

🚀 Enhancements

  • tracing: Enable tracing channels for unstorage (#4226)

🩹 Fixes

  • Accept ipv4-mapped ipv6 loopback in vfs handler (#4212)
  • route-rules: Reject out-of-scope requests (#4222)
  • route-rules: Prevent open redirect via protocol-relative url bypass (#4236)
  • vite: Route browser asset loads to vite when sec-fetch-dest is absent (#4238)

💅 Refactors

  • Use built-in escapeRegExp util (#4109)

📖 Documentation

  • cache: Add invalidation usage (#4216)
  • Improve jsdocs (#4199)

📦 Build

  • Shim oxc-parser via rolldown/utils (#4237)

🌊 Types

  • vite: Make experimental.vite type optional (#4225)

Preset Changes

  • cloudflare: Add missing types for cloudflare.wrangler.observability.traces (#4220)
  • vercel: Enable shouldAddSourcemapSupport when sourcemap is enabled (#4232)

❤️ Contributors