• #720 by @bobsingor – Reworks the backend administration SDK around explicit tenant addressing and deployment API-token authentication.
  • Replaces the flat document client with cloud.tenant(tenantId), accepting exactly one root apiToken or delegated tenantToken credential.
  • Adds tenant lifecycle APIs for creating, listing, iterating, retrieving, and deleting tenants.
  • Adds tenant token APIs for issuing document or tenant JWTs and revoking them by jti.
  • Adds keyset-paginated document listing, lifecycle-state filtering, and an async document iterator.
  • Moves the SDK's shared schemas and route definitions to @cloudpdf/contract.

• #720 by @bobsingor – Introduces the complete CloudPDF backend HTTP contract, replacing the narrower @cloudpdf/admin-api package.
  • Defines a typed operation registry and Zod request/response schemas for tenant administration, document lifecycle, token delegation, deployment status, and backend-callable document-plane operations.
  • Exposes tenant-aware route builders and operation metadata shared by the admin SDK and server.
  • Adds an OpenAPI 3.1 emitter, a packaged openapi entry point, and the generated openapi.json artifact.
  • Validates operation IDs, route coverage, schema references, security declarations, and generated OpenAPI output with contract tests.

• #720 by @bobsingor – Adds the tenant-scoped backend API and root API-token workflow to the self-hosted CloudPDF server.
  • Replaces the legacy flat admin routes with contract-backed /v1/tenants/:tenantId document, tenant, token, and deployment operations.
  • Adds constant-time root API-token authentication alongside delegated tenant JWT authorization.
  • Adds tenant lifecycle and provenance tracking, keyset pagination and state filtering, and cascade deletion for tenant-owned data.
  • Adds document and tenant token issuance, revocation, and durable security-event auditing.
  • Allows API tokens on document-plane routes and supports per-request X-Document-Password authorization through HMAC proofs or non-mutating checks against the canonical PDFium session, including credential-safe open singleflight behavior.
  • Adds matching SQLite and PostgreSQL migrations plus expanded registry, authorization, password, and end-to-end coverage.

• #720 by @bobsingor – Exports wireTemplates, the canonical Fastify-style path templates for backend-callable, unversioned document-plane routes. The templates let @cloudpdf/contract and server route-conformance checks share one source of truth without exposing the viewer-only immutable URL variants.

Fix missing commits in v2.8.35

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.8.35...v2.8.36

This release focuses on streaming I/O: readers can now hand over a native stream instead of being read chunk by chunk, which removes a copy for blobs and a whole series of HTTP requests for remote archives read with range requests. It also fixes several zip64 and split-archive issues, and replaces the hand-maintained list of property names protected from minification with a derived one checked at build time.

• Reader#createReadable(options), introduced internally in 2.8.31, is now part of the documented API, with the new CreateReadableOptions type (offset, size, chunkSize). Custom readers can override it to return a stream provided natively by the underlying data source instead of relying on readUint8Array(). It also accepts a byte range, and no longer takes a diskNumberStart option: split readers now use linear disk offsets
• BlobReader now returns blob.stream(), or blob.slice(offset, end).stream() for a range, instead of reading the data in chunkSize slices through readUint8Array()
• When range requests are used, i.e. with HttpRangeReader or with the useRangeHeader and forceRangeRequests options of HttpReader, the data of an entry is now read with range requests of 16MB at most whose response bodies are streamed, instead of one range request per chunkSize bytes. Reading a 4GB entry sends 256 requests instead of 65536, and no request is ever sized after the entry. This requires fetch, the useXHR option still reads the data chunk by chunk
• Add the maximumRangeSize option to HttpReader and HttpRangeReader to tune the size of these range requests, e.g. to lower it behind a proxy closing long-lived responses
• These two changes only affect how the bytes are obtained: the chunks emitted by the platform are still normalized to chunkSize before reaching the codec, and the chunks received by writers are unchanged
• Add the closeDisk() method to SplitDataWriter to close the disk being written, the next disk being opened when more data is written
• Add the checkResourceChanges option to HttpRangeOptions and the ERR_HTTP_RESOURCE_CHANGED error constant: range requests now detect a resource modified while being read by comparing the ETag, Last-Modified and total size headers against the ones returned by the first request
• Add resetConfiguration() to restore the default configuration of zip.js

• checkResourceChanges defaults to true, so reading an HTTP resource that changes mid-read now throws ERR_HTTP_RESOURCE_CHANGED instead of silently producing corrupt data. Headers missing from the responses are ignored; note that Access-Control-Expose-Headers must include them when the resource is fetched cross-origin
• Entries requiring no codec work at all, i.e. no compression, no CRC-32 and no encryption, now always bypass web workers. They previously went through a worker when transferStreams was enabled, i.e. by default. In practice this covers reading stored entries without the checkSignature option, and passThrough transfers; entries needing the CRC-32, which includes every entry written by add() without passThrough, still go through a worker
• Writers always receive a Uint8Array that owns its entire buffer, so chunk.buffer inside a custom writeUint8Array() implementation is the chunk and nothing more
• Non-split writers no longer get diskNumber, diskOffset, availableSize and maxSize properties assigned on them by ZipWriter
• The chunkSize option of createReadable() defaults to the chunkSize value of the global configuration instead of a hardcoded 64KB. It only applies to the default implementation, the readers overriding it emit chunks sized by the platform

• Fix configure({ transferStreams }) being silently ignored: the option was documented and honored per entry, but absent from the list of configurable properties, so it could not be set globally. It is now a global option defaulting to true
• Fix the chunkSize option being ignored when the codec runs without a web worker: the codec output is now rechunked in that path too
• Fix reading zip64 archives whose end of central directory record is not on the last disk: the disk number is now read from the zip64 end of central directory locator instead of being assumed
• Fix prependZip() writing a wrong zip64 offset flag and leaking the disk numbers of the source archive into the central directory of the new archive
• Fix createSyncAccessHandle being mangled away in the minified builds, which broke createOPFSTempStream() in dist/*.min.js, index.min.js and index-native.min.js
• Make the error message reported for uncaught errors more informative
• Fix the web worker configuration of the test suite in dist mode
• Fix the build-dev configuration, broken by the removal of mini-lz

• Make ChunkStream accumulate a queue of pending chunks instead of concatenating into a growing buffer, which removes the copies that the iterative rechunking introduced in 2.8.27 still made on every incoming chunk
• Copy a chunk sent through the web worker message protocol only when it is a partial view of its buffer, and stop copying chunks received from a worker
• Return the cached data view instead of a copy when an HTTP read is served from the buffer
• Remove the redundant copies made when reading extra fields
• Initialize the reader lazily when prepending a zip file, so nothing is read if no entry is added
• Let rollup drop the default configuration table from the web worker bundles

• Derive the property names reserved from minification instead of maintaining them by hand: they are now collected from the lib.dom/lib.webworker TypeScript declarations, the export table of the WASM module, index.d.ts, and an explicit list of the names crossing postMessage
• Fail the build when the set of mangled property names changes, so a name newly exposed at a boundary has to be audited instead of being silently renamed in one bundle only
• Add a test recording every property name crossing postMessage during worker round trips (deflate, signed, AES-256, AES-128, ZipCrypto, raw password, with and without transferStreams) and asserting each one is declared
• Do not publish the .github folder on NPM and JSR

• Add tests for zip64 split boundaries, HTTP range requests, HTTP resource changes, exact chunks passed to writers, and SplitDataWriter edge cases
• Reset the configuration between tests
• Make the Deno MessagePort leak repro runnable with deno test (still reproduced with Deno 2.9.5)

• Centralize the array helpers in a util/array.js module

• Add a bundle size section to the README documenting tree-shaking and the smaller entry points
• Clarify the meaning of the native suffix in the dist README: every bundle uses the native CompressionStream/DecompressionStream APIs when available, the suffix names the implementation embedded for everything else
• Clarify the comment describing the Blob.slice() workaround in BlobReader

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.8.34...v2.8.35

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/create-rari-app@0.5.20...create-rari-app@0.5.21

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/rari@0.15.8...rari@0.15.9

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/@rari/use-cache@0.15.8...@rari/use-cache@0.15.9

This release focuses on streaming I/O: readers can now hand over a native stream instead of being read chunk by chunk, which removes a copy for blobs and a whole series of HTTP requests for remote archives read with range requests. It also fixes several zip64 and split-archive issues, and replaces the hand-maintained list of property names protected from minification with a derived one checked at build time.

• Reader#createReadable(options), introduced internally in 2.8.31, is now part of the documented API, with the new CreateReadableOptions type (offset, size, chunkSize). Custom readers can override it to return a stream provided natively by the underlying data source instead of relying on readUint8Array(). It also accepts a byte range, and no longer takes a diskNumberStart option: split readers now use linear disk offsets
• BlobReader now returns blob.stream(), or blob.slice(offset, end).stream() for a range, instead of reading the data in chunkSize slices through readUint8Array()
• When range requests are used, i.e. with HttpRangeReader or with the useRangeHeader and forceRangeRequests options of HttpReader, the data of an entry is now read with range requests of 16MB at most whose response bodies are streamed, instead of one range request per chunkSize bytes. Reading a 4GB entry sends 256 requests instead of 65536, and no request is ever sized after the entry. This requires fetch, the useXHR option still reads the data chunk by chunk
• Add the maximumRangeSize option to HttpReader and HttpRangeReader to tune the size of these range requests, e.g. to lower it behind a proxy closing long-lived responses
• These two changes only affect how the bytes are obtained: the chunks emitted by the platform are still normalized to chunkSize before reaching the codec, and the chunks received by writers are unchanged
• Add the closeDisk() method to SplitDataWriter to close the disk being written, the next disk being opened when more data is written
• Add the checkResourceChanges option to HttpRangeOptions and the ERR_HTTP_RESOURCE_CHANGED error constant: range requests now detect a resource modified while being read by comparing the ETag, Last-Modified and total size headers against the ones returned by the first request
• Add resetConfiguration() to restore the default configuration of zip.js

• checkResourceChanges defaults to true, so reading an HTTP resource that changes mid-read now throws ERR_HTTP_RESOURCE_CHANGED instead of silently producing corrupt data. Headers missing from the responses are ignored; note that Access-Control-Expose-Headers must include them when the resource is fetched cross-origin
• Entries requiring no codec work at all, i.e. no compression, no CRC-32 and no encryption, now always bypass web workers. They previously went through a worker when transferStreams was enabled, i.e. by default. In practice this covers reading stored entries without the checkSignature option, and passThrough transfers; entries needing the CRC-32, which includes every entry written by add() without passThrough, still go through a worker
• Writers always receive a Uint8Array that owns its entire buffer, so chunk.buffer inside a custom writeUint8Array() implementation is the chunk and nothing more
• Non-split writers no longer get diskNumber, diskOffset, availableSize and maxSize properties assigned on them by ZipWriter
• The chunkSize option of createReadable() defaults to the chunkSize value of the global configuration instead of a hardcoded 64KB. It only applies to the default implementation, the readers overriding it emit chunks sized by the platform

• Fix configure({ transferStreams }) being silently ignored: the option was documented and honored per entry, but absent from the list of configurable properties, so it could not be set globally. It is now a global option defaulting to true
• Fix the chunkSize option being ignored when the codec runs without a web worker: the codec output is now rechunked in that path too
• Fix reading zip64 archives whose end of central directory record is not on the last disk: the disk number is now read from the zip64 end of central directory locator instead of being assumed
• Fix prependZip() writing a wrong zip64 offset flag and leaking the disk numbers of the source archive into the central directory of the new archive
• Fix createSyncAccessHandle being mangled away in the minified builds, which broke createOPFSTempStream() in dist/*.min.js, index.min.js and index-native.min.js
• Make the error message reported for uncaught errors more informative
• Fix the web worker configuration of the test suite in dist mode
• Fix the build-dev configuration, broken by the removal of mini-lz

• Make ChunkStream accumulate a queue of pending chunks instead of concatenating into a growing buffer, which removes the copies that the iterative rechunking introduced in 2.8.27 still made on every incoming chunk
• Copy a chunk sent through the web worker message protocol only when it is a partial view of its buffer, and stop copying chunks received from a worker
• Return the cached data view instead of a copy when an HTTP read is served from the buffer
• Remove the redundant copies made when reading extra fields
• Initialize the reader lazily when prepending a zip file, so nothing is read if no entry is added
• Let rollup drop the default configuration table from the web worker bundles

• Derive the property names reserved from minification instead of maintaining them by hand: they are now collected from the lib.dom/lib.webworker TypeScript declarations, the export table of the WASM module, index.d.ts, and an explicit list of the names crossing postMessage
• Fail the build when the set of mangled property names changes, so a name newly exposed at a boundary has to be audited instead of being silently renamed in one bundle only
• Add a test recording every property name crossing postMessage during worker round trips (deflate, signed, AES-256, AES-128, ZipCrypto, raw password, with and without transferStreams) and asserting each one is declared
• Do not publish the .github folder on NPM and JSR

• Add tests for zip64 split boundaries, HTTP range requests, HTTP resource changes, exact chunks passed to writers, and SplitDataWriter edge cases
• Reset the configuration between tests
• Make the Deno MessagePort leak repro runnable with deno test (still reproduced with Deno 2.9.5)

• Centralize the array helpers in a util/array.js module

• Add a bundle size section to the README documenting tree-shaking and the smaller entry points
• Clarify the meaning of the native suffix in the dist README: every bundle uses the native CompressionStream/DecompressionStream APIs when available, the suffix names the implementation embedded for everything else
• Clarify the comment describing the Blob.slice() workaround in BlobReader

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.8.34...v2.8.35

• prevent prototype pollution in settings (#4260) (0adf7e7)

• #6092 4231105d Thanks @12joan! - Deeply compare nested data structures inside array properties on nodes for the purpose of merging identical text nodes. Previously, items in array properties were shallowly compared using ===.

• Flush pending revalidations for forwarded action error responses: #96945
• Handle Server Actions on dynamic PPR fallback routes: #96932
• Turbopack: Improve how DiskWatcher is configured and fix polling watcher bugs: #96440
• Turbopack: Allow DiskWatcher to use a mocked DiskFileSystem, add a small unit test: #96353
• [turbopack] Add e2e test that uses component chunks + workers: #96556
• [turbopack] Support experimental.serverMinification & expand experimental.turbopackMinify: #96578
• Add a turbopackChunking documentation page for pages router: #96698
• [turbopack] Don't run Webpack tests on Turbopack-only changes: #96656
• [turbopack] Enable the shared runtime by default: #96778
• [turbopack] Enable CJS tree shaking by default: #96779
• [ci] Default deploy e2e tests to the repo next version: #96895
• refactor: clean up places that needlessly list all RenderStages: #96907
• Fix the documented invocation for generating tests non-interactively: #96896
• Make NextConfigComplete typing more accurate: #96700
• Upgrade to swc 75: #96702
• docs: link View Transitions skill on skills.sh and clarify the example prompt: #96863
• [ci] Reset the turbopack deploy test project in the weekly cron: #96822
• docs: add authentication with Cache Components guide and iron-session example: #95802

Huge thanks to @ztanner, @bgw, @sampoder, @eps1lon, @lubieowoce, @unstubbable, @mischnic, @aurorascharff, and @icyJoseph for helping!

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/@rari/lint@0.1.0...@rari/lint@0.1.1