v4.63.4
2026-09-19
- Ensure meta information of the cached module is exposed in
shouldTransformCachedModule(#6442) - Do not create invalid code if import attribute values contain special characters (#6502)
- #6429: ci: collect Rust coverage from JS tests in dedicated job (@lukastaegert)
- #6442: fix: expose cached module meta during cache checks (@ychampion, @lukastaegert)
- #6496: docs: name the parameter runHook actually takes (@darkdi, @lukastaegert)
- #6502: Escape quotes and backslashes in import attribute values (@dylanpulver, @lukastaegert)
- #6517: Improve agent instructions (@lukastaegert)
- #6518: fix(deps): update minor/patch updates (@renovate[bot])
- #6519: Request Copilot code review via workflow (@lukastaegert)
Release 2026-09-19
- #10261: Add
getDocumentRevision(document), a counter the store bumps on every write to a document. A consumer caching a derivation of a schema node can validate the entry against it in constant time, instead of walking the subtree to see whether anything moved. It reads the same from any view of the document, including one with the reactive and detect-changes proxies stripped for reads, and returns 0 for a document no store tracks. - #10261: Type the result of
resolve.schemaas read-only. A resolved schema is the document's own node or a shallow merge over it, so writing to it writes into the document behind the store's back; every change belongs in a store mutation, and a caller that needs a modified shape copies what it needs first. No in-repo consumer had to change.
- #10261: Make rendering from the store cheaper: the detect-changes proxy no longer allocates a path on every property read,
getResolvedRefDeepstops deep-unpacking every node it visits,resolve.schemabuilds its composed typebox schema once, andgetExampleFromSchemabuilds its options cache key once per call instead of once per node. - #10261: Follow chains of references when resolving. A reference can point at a second reference —
resolve()on a static or SSR workspace leaves the component behind as a{ $ref: '#/x-ext/<hash>', $global: true }stub with the content underx-ext— sogetResolvedRefandgetResolvedRefDeepnow hop through references that carry nothing but a$refuntil they reach the node itself, instead of handing back the stub. A reference that carries keywords of its own stays its own hop, since it is a schema in its own right.
- @scalar/api-reference@1.69.2
- @scalar/api-reference@1.69.2
- @scalar/api-reference@1.69.2
- @scalar/api-reference@1.69.2
- @scalar/api-reference@1.69.2
- @scalar/api-reference@1.69.2
- @scalar/api-reference@1.69.2
v16.4.0-canary.36
- Persist resurrected tasks as new tasks: #98729
- Rspack: Remove bincode dependency from rspack by way of turbo-unix-path: #98855
- Pin tasks across restore waiter handoff: #98728
- test: honor skipStart for Vercel deployments: #98776
- Use internal prefix for Turbopack shutdown env: #98747
- test: retry waiting for ISR fallback in prefetch-static-shell: #98884
- Fix generated Turbopack GC option docs: #98888
- Add agent feedback behavior evals: #98887
- Add experimental agent feedback workflow: #98582
- Clean up unnecessary output asset creation: #98834
- Properly disable laziness on next/dynamic: #98828
- Set
experimental.agenticAutoUpgradeafter successful upgrade: #98871 - example(cache-handler-redis): fix connection leak, hangs on a down Redis, and cross-page tag invalidation: #98716
- Do not check Node version while agentic upgrade: #98852
- test: run cargo unit tests with miri as well: #97535
- test: unflake instant-validation: #98854
Huge thanks to @sokra, @bgw, @gnoff, @wbinnssmith, @lubieowoce, @jimmyhmiller, @aurorascharff, @devjiwonchoi, @leejpsd, and @mischnic for helping!
static-middleware v0.4.16
- Bumped
@remix-run/*dependencies:
tar-parser v0.8.0
-
BREAKING CHANGE:
parseTarHeader(),parseTar(), andTarParsernow default topathPolicy: 'relative', throwingTarParseErrorfor empty entry names or link targets, absolute paths, Windows drive prefixes, backslashes, and embedded NULs. Entry names cannot contain..path components. Symlink targets are checked relative to the link's parent directory, and hard-link targets relative to the archive root;..components are allowed only when resolution stays within the archive. Valid paths retain their spelling, including nested paths,./prefixes, and trailing directory slashes. Applications that need to inspect or process unrestricted archive paths can opt intopathPolicy: 'preserve':-await parseTar(archive, handleEntry) +await parseTar(archive, { pathPolicy: 'preserve' }, handleEntry)
The same option works with
parseTarHeader()andnew TarParser(). It does not disable archive limits or header structure validation. Path validation applies after ustar prefixes and GNU/PAX overrides, before an entry reaches the handler. GNU long names and link targets now omit their terminating NUL under either policy. Extractors must still enforce containment on their destination filesystem, including when existing or archived symlinks are present. -
BREAKING CHANGE:
parseTar()andTarParsernow default to limits of 2 MiB per entry body, 20 MiB of total archive input, and 5,000 entries, where previously none were limited. Applications processing larger archives must configuremaxEntrySize,maxTotalSize, andmaxEntriesto raise the applicable limits, or set any limit toInfinityto disable it:-await parseTar(archive, handleEntry) +await parseTar( + archive, + { maxEntrySize: Infinity, maxTotalSize: Infinity, maxEntries: Infinity }, + handleEntry, +)
The entry size and count limits include PAX/GNU metadata entries and are checked before reading their bodies or invoking entry handlers. Padding and end markers do not count as entries. The total size limit counts all input bytes, including headers, padding, and metadata, after any upstream decompression. Exceeding a limit throws the exported
MaxEntrySizeExceededError,MaxTotalSizeExceededError, orMaxEntriesExceededError, all extendingTarParseError.Global PAX metadata now applies to subsequent entries even without a local PAX header, so global sizes are parsed and checked against the entry limit. Local PAX values continue to take precedence.
-
Buffer
TarEntrycontent using the bytes received, validate octal, base-256, and PAX entry sizes, and reject unfinished body readers when archive parsing fails. -
Reduce allocation and copying when GNU or PAX metadata arrives in small chunks. Metadata buffering grows with the bytes received and continues to honor the configured archive limits.
session-middleware v0.5.0
- BREAKING CHANGE: Session middleware now checks configured cookie
maxAgeandexpiresbefore loading session data from any backend. Existing cookies without expiration metadata start a new session when a lifetime is configured.maxAgerenews when an updated session emits a cookie; reads alone do not renew it. Sessions without a configured lifetime and backend TTL settings are unchanged. Backend record cleanup remains the storage provider's responsibility.
-
Session cookies now default to
Securefor HTTPS request URLs. HTTP development requests and explicitsecuresettings retain their configured behavior. When HTTPS terminates at a proxy, expose the original request URL or configuresecure: true. -
Bumped
@remix-run/*dependencies:
spa v0.1.2
- Bumped
@remix-run/*dependencies:
ui v0.10.0
-
BREAKING CHANGE: Navigations that specify a named frame that is not currently mounted now perform a document navigation instead of reloading the top frame. Fresh links, forms, and
navigate()calls are left to the browser, preserving native form methods and bodies, while back and forward traversal reloads the destination document. Omit the target when the navigation should always reload the top frame:-<a href="/account" data-rmx-target="optional-account"> +<a href="/account">
-
BREAKING CHANGE: The default
resolveFramenow only fetches same-origin sources and follows same-origin redirects. Apps that load cross-origin frame content must provide a customresolveFrametorun().Validate navigation source overrides regardless of the target, falling back to document navigation for invalid or cross-origin overrides.
-
BREAKING CHANGE: Raw HTML props now require an opaque value created by
unsafeHTML(). This applies toinnerHTMLand both iframesrcDocspellings (srcDocandsrcdoc). It prevents attacker-controlled prop spreads from activating HTML parsing with plain strings or JSON-shaped objects.outerHTMLis not supported because it would replace a reconciler-owned element.unsafeHTML()is an explicit authorization boundary; it does not sanitize or otherwise modify its input.-import type { Handle } from 'remix/ui' +import { unsafeHTML } from 'remix/ui' +import type { Handle } from 'remix/ui' function Content(handle: Handle<{ html: string }>) { - return () => <div innerHTML={handle.props.html} /> + return () => <div innerHTML={unsafeHTML(handle.props.html)} /> }
-
Ignore invalid host prop names and reserved DOM mutation properties during server rendering and client reconciliation. Block
javascript:URLs in executable URL attributes while preserving other URL schemes and non-executable attributes. Use theon()mixin for events; the explicitinnerHTMLAPI and standard DOM,data-*,aria-*, SVG, and custom-element properties continue to work as before. -
Fix duplicated text during hydration when a browser splits long server-rendered text into multiple DOM nodes, including chunks that span adjacent text children (see #11591).
-
Avoid attaching duplicate event handlers when a client entry imports and renders another client entry, including through fragments and wrapper components. Preserve deferred removal and exit animations when removing nested client entries (see #11844).
-
Restore the previous named frame from
handle.frames.get(name)when a more recently mounted frame with the same name unmounts.