compare changes

🚀 Enhancements

• resolveDotSegments: Add mergeSlashes option (9581407)
• session: Default session cookie to SameSite=Lax (acf8d77)
• ⚠️ Escape interpolated values in html tagged template (#1459)
• readValidatedBody: Support readBody options (#1476)
• Add onDispose hook (#1488)
• defineValidatedHandler: Support async validation (#1491)
• sse: Allow returning EventStream directly from handlers (#1508)

🔥 Performance

• Single-scan fast-path guard for resolveDotSegments (#1458)
• cookie: Avoid quadratic chunked cookie parsing and header rebuilds (#1472)
• middleware: Precompose middleware chains (#1475)
• body-limit: Stream enforcement instead of pre-buffering (#1500)

🩹 Fixes

• resolveDotSegments: Preserve trailing slash on trailing dot segments (ca7de07)
• cookie: Dedup cookies with leading-dot / mixed-case domains (#1462)
• cors: Warn on credentials with null origin (#1464)
• Decode Basic-auth credentials as UTF-8 (#1463)
• proxy: forwardHeaders must not override framing headers (#1467)
• cookie: Cap chunk count in setChunkedCookie (#1469)
• cors: Set single-valued CORS headers instead of appending (#1466)
• auth: Harden basic-auth realm handling and credential timing (#1468)
• validate: Convert malformed JSON to 400 in validated-handler path (#1465)
• base: Collapse leading-slash run in all base-stripping sites (#1471)
• html: Make raw() trust marker unforgeable and hoist escape map (#1473)
• json-rpc: Use -32600 for valid-JSON non-object bodies (#1483)
• Only discard prepared headers for error responses (#1486)
• event-stream: Correct stream teardown on close and client disconnect (#1484)
• deprecated: Correct v1 signatures in the compat shim (#1492)
• response: Do not render non-Error throws as successful responses (#1485)
• event: Keep event.context and req.context as one reference (#1499)
• response: Absorb errors thrown in onResponse hook (4a32c1b)
• response: Route synchronous prepareResponse throws through the error pipeline (#1503)
• response: Keep content-length header for Uint8Array responses (#1504)
• response: Strip HEAD body when merging prepared headers into a mutable Response (#1490)
• response: Allow status and headers staged during the first stream chunk (#1512)

💅 Refactors

• request: ⚠️ Make x-forwarded-proto trust opt-in (#1461)
• event-stream: ⚠️ Drop autoclose option (#1495)
• sse: Promote EventStream to public API, deprecate createEventStream (#1509)

📖 Documentation

• Security caveats for cors, proxy, redirect, host and static utils (#1470)
• Explain event.url.pathname decoding (3f8b5bc)

🌊 Types

• Canonical RouteRules interface (#1474)
• Remove unused StaticAssetMeta.path (0b34e24)

🏡 Chore

• Update srvx to 0.12 (5eb0a01) (release notes)
• Update undocs (ba42947)

❤️ Contributors

• Pooya Parsa (@pi0)
• N0liu (@n0liu)
• G1mn
• Sandro Circi (@sandros94)
• Max (@onmax)

compare changes

🚀 Enhancements

• Proxy improvements (#1455)

🩹 Fixes

• cors: Correct vary handling and credentialed wildcard behavior (#1456)
• session: Raise default seal PBKDF2 iterations to 8192 (#1457)

🏡 Chore

• Add missing @__PURE__ annotations (b17c451)

compare changes

🚀 Enhancements

• Add QUERY method support (#1445)
• Add requireContentType and appendAcceptQuery utils (#1446)
• Automatically match GET routes for HEAD requests (#1452)

🩹 Fixes

• json-rpc: Do not leak internal exception messages to clients (ea2f2a3)
• request: Prevent decode:true from reintroducing path separators (cd03d41)
• handleCacheHeaders: Correct conditional-request precedence and Cache-Control default (#1454)

📖 Documentation

• Fix typos in response and handler guides (#1444)
• Add QUERY method docs (#1447)
• Remove non-existent sendEventStream from createEventStream example (#1450)

❤️ Contributors

• Pooya Parsa (@pi0)
• Sueun Cho (@sueun-dev)
• Prateek Anand (@bizprat)
• Max (@maxtaran2010)

compare changes

🚀 Enhancements

• proxy: Support client aborts (#1417)
• ws: Allow optional HTTP handling in defineWebSocketHandler (#1425)
• Export resolveDotSegments as a public path utility (#1428, #1430)
• readBody: Support formdata type (#1164)

🩹 Fixes

• sanitizeStatusCode: Return default for non-numeric input instead of NaN (#1420)
• auth: Reject Basic credentials with no colon separator (#1393)
• sse: Ignore pushes after stream close (#1411)
• proxy: Ignore incoming accept-encoding header (#1423)
• cache: handleCacheHeaders ignores multi-value If-None-Match header (#1395)
• serve-static: Compare if-modified-since at whole-second precision (#1394)
• request: Parse first entry of comma-list x-forwarded-proto header (#1413)
• serve-static: Check the response (not request) for an existing content-length (#1391)
• cors: Merge Vary headers when both origin and allow-headers emit vary (#1396)
• writeEarlyHints: Normalize Link key to prevent hanging with Node.js (#1385)
• event: Return 400 for malformed percent-encoded request URLs (#1424)
• mount: Restore pathname on error with try/finally (#1319)
• serve-static: Decode the resolved id before lookup (#1431)
• request: Shadow parsed _url in requestWithURL proxy (d21d93c)
• event: Clone URL for pathname normalization instead of mutating shared _url (a1cf066)
• adapters: Sync raw node req.url with event.url in fromNodeHandler (#1433)

💅 Refactors

• validate: Drop always-true if (validate.body) guard in body proxy (#1392)

📖 Documentation

• proxy: Add note about reading body (7eb018e)
• Fix decode function name in router param helpers (#1419)
• session: Note secure cookie limitation over local HTTP (#1409)
• Document the session name option for multiple sessions (#1405)
• Add arkstack framework to community section (#1382)
• ws: Use zero-config crossws server plugin (#1427)

🌊 Types

• Expose .crossws on defineWebSocketHandler return type (#1435)

✅ Tests

• Cover zod schema query validation types (#1404)
• Cover cloned pipeable node responses (#1414)
• iron-crypto: Accept getRandomValues length error for invalid salt bits (dae12fe)
• event: Cover shared \_url normalization semantics (4a218a8)
• event: Assert req.url reflects normalization per runtime (8410ec9)

❤️ Contributors

• Pooya Parsa (@pi0)
• Huseeiin (@huseeiin)
• M.M (@momomuchu)
• Wind (@productdevbook)
• Iain Sproat (@iainsproat)
• Frank Johnston
• Mixelburg (@mixelburg)
• Legacy (@3m1n3nc3)
• Shaurya Singh (@LeSingh1)
• Pupuking723
• Harsh Agarwal
• Aimee (@Aimee1608)
• Alan747271363-art
• Greymoth
• Patrick Wehbe (@patrickwehbe)
• Shawn
• Alexander Kireyev (@chatman-media)

compare changes

🚀 Enhancements

• tracing: Export wrapHandlerWithTracing for manual handler wrapping (#1369)

🩹 Fixes

• toEventHandler: Validate h3 subapp instance to pick .handler (a94b7fb)

💅 Refactors

• Split plugin definition (40bddff)

📦 Build

• Simplify chunk names (07c118d)

❤️ Contributors

• Pooya Parsa (@pi0)
• Abdelrahman Awad (@logaretm)

compare changes

🚀 Enhancements

• Coerce thrown number/string to HTTPError (#1372)

🩹 Fixes

• setCookie: Handle encode and stringify serialize options (#1377)
• event-stream: Do not emit unhandled rejection when readable side is canceled (#1376)
• withoutBase: Collapse leading slashes (64acfe6)

📖 Documentation

• Fix typo in error handling (#1364)

❤️ Contributors

• Pooya Parsa (@pi0)
• Max (@onmax)
• Drackin Best (@Drackin)
• Kevin Dyes (@dyeske61283)
• Daniel Roe (@danielroe)

compare changes

🏡 Chore

• Update defu to 6.1.6 (6125485)
• Update deps (4998dd8)
• Update cookie-es (d166186)

compare changes

💅 Refactors

• Pass single obj to serializeCookie (a0761e9)
• Mark new TextEncoder as pure (9e4e64e)

📦 Build

• Upgrade mdzilla to 0.2 (2907555)
• Update cookie-es (84bc9bc)

compare changes

🩹 Fixes

• body: Enforce stream-based body size check regardless of content-length header (708a3aa)

💅 Refactors

• Upgrade cookie-es to v3 (9d244a7)

📖 Documentation

• Remove await-thenable lint rule and fix invalid await usage (#1353)

📦 Build

• Move docs to dist (e87ceca)

❤️ Contributors

• Pooya Parsa (@pi0)
• Nick Spaargaren (@nickspaargaren)

compare changes

🩹 Fixes

• Preserve percent-encoded req.url in app event handler (#1355)

❤️ Contributors

• Sergio Azócar (@sergioazoc)