• types: reexport hammerjs types from @egjs/hammerjs (#2116) (3948038)

更新内容请查看CHANGELOG。 Please refer to CHANGELOG for details.

• #748 by @bobsingor – Derives the connected usage-reporting credential from the license key, so a connected deployment is configured with CLOUDPDF_LICENSE_KEY alone.

  • Computes the reporting credential as cpr_v1_ + base64url(HMAC-SHA256) over a domain-separated message that binds the signed cloudpdfLicenseId license metadata, so the wire credential is one-way (it can never reveal the license key) and never authenticates another license record.
  • Retires CLOUDPDF_LICENSE_REPORTING_TOKEN. A deployment that still sets it boots normally; the variable is ignored and the server logs a warning asking for its removal.
  • Existing connected deployments upgrade by removing the retired variable. During the coordinated verifier cutover on the CloudPDF side a usage report may answer 401; reports retry every five minutes with cumulative counters, so no usage is lost and license validation is unaffected.
  • Air-gapped deployments are unchanged and continue to send no telemetry.
  • Pins fixed cross-runtime derivation test vectors shared with the CloudPDF control plane.

• #746 by @bobsingor – Fixes presigned-upload materialization and makes commit-time sha verification single-read and constant-memory.

  • Fixes the range materializer crashing with EBADF whenever an object carried no SHA metadata — the shape of every presigned browser upload. The failure was silent: commits still reached ready while the security probe recorded unknown and thumbnail warming recorded failed. The hash fallback now closes the write-only handle and streams the finished partial from disk, guards against short positional writes, and rejects a metadata/expected-sha disagreement before paying for the download.
  • Replaces the S3 and FS getSha256 fallbacks that buffered whole objects in RAM with streaming hashes — constant memory regardless of document size.
  • Commit now verifies uploaded bytes with a single object-store read when a base-file cache is wired (DocumentLifecycleOptions.fileCache): the upload is materialized into the cache, hashed on the way down, and reused by the security probe instead of being downloaded a second time. LocalFileHandle.sourceKey reports which object key materialized a content-addressed entry, so a cross-key cache hit still triggers a direct verification of the committing document's own object.
  • Adds a typed ShaMismatchError (exported) thrown by all materializeLocal implementations, letting callers distinguish declared-hash mismatches from retryable transport failures.
  • Surfaces previously swallowed failures: DocumentSecurityProbeOptions.onError, DerivedRenderServiceOptions.onWarmError, and base-file-cache materialize-error events are now wired to the server log.

• Fix debug build paths Pages Router support entries: #93529

• Restore the live headers() view of the incoming request: #97166
• [test] Compile the middleware redirect routes up front in dev: #97190
• Update gh-stack skill guidance: #97163
• [test] Unflake use-cache-custom-handler-dev tests: #97187
• Forward a build-container pin to deploy-test deployments: #97191
• Fix unset crossOrigin in Turbopack manifests: #97164
• Allow literal exports in 'use cache' files: #97181
• Fix shared Turbopack runtime initialization race: #97215
• Fix stale data after navigation despite revalidation: #95439
• [turbopack] Only use the shared runtime by default on canary: #97208

Huge thanks to @unstubbable, @timneutkens, @Stanzilla, @gnoff, @gaearon, and @sampoder for helping!

Please refer to CHANGELOG.md for details.

Release 2026-08-12 09:19

• react-router: useMatchRoute w/ React Compiler (changeset) (#8047) (b0817f50cc) by @Sheraff
• react-router: useMatchRoute w/ React Compiler (#8015) (31355ae92c) by @Sheraff

• @tanstack/react-router@1.170.27
• @tanstack/react-start@1.168.44
• @tanstack/react-start-client@1.168.25
• @tanstack/react-start-rsc@0.1.43
• @tanstack/react-start-server@1.167.32

• Updated dependencies [b0817f5]:
  • @tanstack/react-router@1.170.27

• Updated dependencies [b0817f5]:
  • @tanstack/react-router@1.170.27

• Updated dependencies [b0817f5]:
  • @tanstack/react-router@1.170.27
  • @tanstack/react-start-client@1.168.25
  • @tanstack/react-start-rsc@0.1.43
  • @tanstack/react-start-server@1.167.32

• Updated dependencies [b0817f5]:
  • @tanstack/react-router@1.170.27