Update Routine updates - #41

v2.1.6

Compare Source

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v0.1.2

Compare Source

• useSignOutSession loads landingUrl with location.replace, so Back after a sign-out no longer
  returns to the page of the session that ended.

v4.3.5

Compare Source

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#​20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#​20658, #​20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#​20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#​20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#​20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#​20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#​20632)

v4.3.4

Compare Source

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#​20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#​20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#​20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#​20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#​20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#​20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#​20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#​20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#​20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#​20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#​20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#​20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#​20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#​20408)
• Drop invalid UTF-8 candidates during class detection (#​20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#​20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#​20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#​20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#​20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#​20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#​20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#​20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#​20508)
• Improve style invalidation performance of group-* and peer-* variants (#​20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#​20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#​20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#​20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#​20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#​20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#​20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#​20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#​20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#​20547, #​20572)
• Underline the correct occurrence of an unsupported data type in --value(…) warnings (#​20554)
• Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#​20540)
• Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#​20574)
• Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#​20576)
• Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#​20575)
• Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#​20577)
• Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#​20558)
• Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#​20486)
• Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#​20578)
• Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#​20582)
• Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#​20593)
• Decode single-digit hexadecimal escapes in theme variable and @utility names as the CSS spec does (e.g. @theme { --color-\0: red; } no longer registers --color-0) (#​20591)
• Don't treat !important inside strings, comments or url() in declaration values as the important flag (e.g. content: "a !important b") (#​20627)
• Parse a custom property at the end of the input when it has no trailing ; (e.g. --foo: bar as the last declaration) (#​20653)
• Keep a declaration without a ; at the end of the CSS input (e.g. color: red) (#​20655)

v5.107.1

Compare Source

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@5.107.1

v5.107.0

Compare Source

Patch Changes

• Updated dependencies [b6add89]:
  • @​tanstack/query-core@5.107.0

v5.106.1

Compare Source

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@5.106.1

v5.106.0

Compare Source

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@5.106.0

v5.105.3

Compare Source

Patch Changes

• Updated dependencies [3f4de1b, 969e580]:
  • @​tanstack/query-core@5.105.3

v5.105.2

Compare Source

Patch Changes

• #​12230 1e1caa5 - Update the observer options before subscribing so revealing an <Activity> tree whose query key changed while hidden no longer fetches the previous key.

• #​12480 8d0dc27 - Exclude status from the filters accepted by QueryClient.isMutating, useIsMutating, and injectIsMutating. These APIs always count mutations with status: 'pending'.

• Updated dependencies [2ee2fd9, 8d0dc27, e69cac6, f2215d2, 86e7957, b6576b3, af0e0ef, 05d9b6a]:

  • @​tanstack/query-core@5.105.2

v5.105.1

Compare Source

Patch Changes

• #​11373 7ccba6e - fix({react,preact,angular,solid,vue}-query/infiniteQueryOptions): correct the overload selected for a possibly-undefined 'initialData'

• #​12390 18e54bf - Exclude fetchStatus from the filters accepted by QueryClient.isFetching, useIsFetching, and injectIsFetching. These APIs always count queries with fetchStatus: 'fetching'.

• Updated dependencies [6f8a48d, 18e54bf]:

  • @​tanstack/query-core@5.105.1

v1.169.5

Compare Source

Patch Changes

• #​8863 01fab5a - The Rsbuild plugin keeps the app's server.compress setting instead of always setting it to false. Compression stays off by default: a compressed streamed page reaches the browser only once the stream ends. The optional @rsbuild/core peer is now ^2.0.5, the first version whose compression keeps SSR response headers intact.

• Updated dependencies [446ce1b, ff157f0, 01fab5a, c5320d7, 545a8d3, da8c28c, d66a84b]:

  • @​tanstack/router-utils@1.163.0
  • @​tanstack/start-plugin-core@1.171.56
  • @​tanstack/react-start-client@1.168.45
  • @​tanstack/react-start-rsc@0.1.66

v1.169.0

Compare Source

Minor Changes

• #​8855 446ce1b - Require Node ^20.19.0 || >=22.12.0 (was >=20.19), so the CommonJS builds can load ESM-only dependencies through require(esm). Node 21 and Node 22.0–22.11 do not enable it by default, so they are no longer supported.

• #​8851 d250819 - Require Vite 6 or later: the vite peer range is now >=6.0.0. Vite 5 is no longer supported.

Patch Changes

• 1ba19a0 - fix: webpack and Rspack production builds no longer put the code splitter's "will not be code-split" warning, with the route file's absolute path, into the client bundle when the build process's NODE_ENV isn't production. The bundler's mode decides, and a config without mode counts as production, as it does for webpack and Rspack. The warning still prints in the build output.

• #​8852 94f36c4 - The esbuild plugin now throws when autoCodeSplitting is enabled, and TanStackRouterCodeSplitterEsbuild throws, instead of silently bundling every route without splitting. Route generation with esbuild is unchanged.

• #​8856 533ca27 - Remove the undocumented plugin.hmr.style option and the HmrOptions type. Each bundler entry now picks its own HMR runtime: the webpack and Rspack entries already forced 'webpack', and on Vite, 'webpack' broke route HMR.

• #​8853 13b6256 - Remove internal code-splitter APIs: the codeSplittingOptions.compilerPlugins option, and the root-entry exports unpluginRouterCodeSplitterFactory, getObjectPropertyKeyName, CodeSplitCompilerPlugin, ReferenceRouteCompilerPlugin, ReferenceRouteCompilerPluginContext and VirtualRouteSplitNodeCompilerPluginContext.

• #​8860 b5e2ac9 - Source maps of split routes now point at the route file. On webpack and Rspack (including Rsbuild), a split component or shared code mapped to the wrong line, because unplugin's loader dropped the router plugin's map; unplugin now requires ^3.5.0, which keeps it. The maps of split and shared modules also name the route file itself instead of its ?tsr-split / ?tsr-shared module id, so debuggers bind breakpoints set in the route file.

• #​8870 f420d4a - Vite route HMR now writes import.meta.hot.accept( out instead of calling it through a hot alias. Vite only treats a module as a hot boundary when the call is spelled out, so an edit of a route file no framework plugin accepts (a .ts route file, or an app without @vitejs/plugin-react) reloaded the page instead of updating the route in place. With React HMR, a route file that declares its own top-level hot binding no longer fails to compile with Duplicate declaration "hot".

• Updated dependencies [446ce1b, ad5b3b7, ff157f0]:

  • @​tanstack/router-generator@1.168.0
  • @​tanstack/router-utils@1.163.0

v6.2.1

Compare Source

Fix refreshInclude and refreshExclude options not working (#​1543)

Fix mistake from #​1516

v6.2.0

Compare Source

Add refreshInclude and refreshExclude options (#​1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#​1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#​1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

v1.49.0

• New npx convex plugins install command, which installs the Convex plugin for
  Claude Code and Codex on macOS and Linux. It works with the terminal CLIs, the
  desktop apps and the VS Code extensions. Running it again upgrades the plugin
  to the latest version.
• This version drops support for Node.js 20. Please update to Node.js 22 or
  newer.
• Adds the v.function({ fnType, args, returns }) validator, which validates
  that a value is a well-formed function handle. You can specify fnType,
  args, and returns for TypeScript typechecking and including type
  signatures in codegen, but they are not checked when running functions or
  writing to a table at runtime. The inferred type of v.function() is
  FunctionHandle_future, which has the same type semantics as
  FunctionReference_future. When incorporating v.function() into your
  codebase, existing code that uses the FunctionHandle type may need to be
  updated to use FunctionHandle_future.
• Security fixes for
  GHSA-qw8j-4xj7-6f28
  and
  GHSA-9mw5-7p28-rvv4.

v4.13.17

Compare Source

What's Changed

• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in #​5608
• fix(utils/url): do not match a query key across separators in #​5607
• fix(etag,pretty-json): cancel the discarded response body in #​5606
• fix(client): detect the JSON media type with whitespace before a parameter in #​5609
• fix(timing): honor a precision of 0 in setMetric in #​5363
• fix(utils/mime,ssg): match media types case-insensitively in #​5449
• fix(timing): escape double quotes and backslashes in Server-Timing descriptions in #​5478
• fix(etag): preserve commas within quoted entity tags in #​5353
• fix(accepts): preserve exact media type quality over subtype wildcards in #​5427
• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in #​5611
• fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in #​5430
• fix(ssg): do not reuse created directories across toSSG runs in #​5381
• fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in #​5483
• fix(jsx): escape element and object attribute values in #​5512
• fix(jsx): do not render ref objects as attributes in #​5615
• fix(factory): keep independent return types for nine handlers in #​5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Compare Source

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in #​5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

Compare Source

What's Changed

• fix(auth): escape backslashes in the WWW-Authenticate realm by @​yusukebe in #​5590
• docs(contributing): drop the note about linking a fork branch by @​yusukebe in #​5593
• fix(context): allow c.header() after the response body is consumed by @​yusukebe in #​5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v10.7.6

Compare Source

Full Changelog: beaugunderson/ip-address@v10.7.5...v10.7.6

v1.70.0: Version 1.70.0

Compare Source

What's Changed

• fix(site): fix vercel.json redirects that land on 404 by @​ericfennis in #​5157
• feat(icons): added square-dashed-search icon by @​domarku in #​5119
• fix(lucide-react-native): emit runtime files for alias icon subpaths by @​tlq5l in #​5055
• feat(icons): added moped icon by @​jamiemlaw in #​3373
• feat(icons): added user-exclamation-point, user-round-exclamation-point icons by [@​ericfennis](https:/

[!IMPORTANT]
✂ PR body was truncated to here.