• [turbopack] Bail CJS tree-shaking on var x = module.exports = {}: #97130
• docs: server client and directives: #96145
• docs: clarify client cache freshness after hydration: #97180
• Fix: Optimistic routing bugs leading to repeated prefetch loops: #97128
• docs: create client-side fetching guide: #96341
• Turbopack: accept a module type argument for import.meta.glob: #96991
• docs: align Cache Components authentication guide title: #97143
• test: re-enable a few more passing NFT unit cases: #97017
• [turbopack] Do the CJS analysis needed for scope hoisting: #95826
• Remove legacy PPR code paths: #96868
• Use Cache Components as the internal PPR signal: #96827
• Make legacy PPR paths explicit: #96753
• fix: typos in code comments: #97137
• Fix spelling in two comments: #97136

Huge thanks to @sampoder, @icyJoseph, @aurorascharff, @acdlite, @kelvinampofo, @mischnic, @ztanner, and @marcoshernanz for helping!

• #17618 2630631 Thanks @lazerg! - Fixes the missing "Add all missing imports" and "Add import from" quick fixes for Astro components

• Updated dependencies [0891ac9]:
  • @astrojs/underscore-redirects@1.0.4

• #17627 ba6a9f6 Thanks @astrobot-houston! - Fixes the astro peer dependency range from ^7.0.0 to ^7.2.0. The adapter imports symbols (beginContentEntryCollection, beginImageCollection, endContentEntryCollection, endImageCollection) from astro/app that were added in Astro 7.2.0, so earlier versions fail at build time with a MISSING_EXPORT error.

• Updated dependencies [0891ac9]:

  • @astrojs/underscore-redirects@1.0.4

• #17620 0891ac9 Thanks @astrobot-houston! - Fixes dynamic redirect routes to honour user-configured status codes instead of hardcoding 301. Previously, a redirect configured with { destination: '/new', status: 302 } would be emitted as 301 in the _redirects file when the route was dynamic.

• #17658 8b211a5 Thanks @astrobot-houston! - Fixes an EventEmitter memory leak when serving static pages over keep-alive connections with staticHeaders enabled and CSP (security.csp) active

• #17612 7133730 Thanks @thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages with ClientRouter

• #17628 4ada248 Thanks @astrobot-houston! - Fixes a CSP violation when using both security.csp and experimental.clientPrerender with data-astro-prefetch links. The dynamically injected <script type="speculationrules"> now uses a static "source": "document" approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP script-src directive at build time.

• #17605 89e4647 Thanks @ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.

• #17582 bd2c1a5 Thanks @astrobot-houston! - Fixes a regression where content collection reference() fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.

• #17661 97b0cc7 Thanks @ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.

• #17349 4328c73 Thanks @astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g. /_image with @astrojs/cloudflare's prerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable

• #17603 722eed6 Thanks @astrobot-houston! - Fixes <video> and <audio> elements being non-functional after navigating via view transitions (<ClientRouter />)

• #17616 3a890d2 Thanks @lazerg! - Fixes experimental.incrementalBuild re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.

• #17547 fba468c Thanks @dmgawel! - Improves getCollection() and getEntry() performance for entries without local image references

• #17602 16e0d9d Thanks @astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiers

• #730 by @bobsingor – Adds the share-grant contract: standing, revocable authorization decisions that let a document be embedded with no backend.

  • Defines shares.create, shares.list, shares.get, shares.update, and shares.delete under /v1/tenants/:tenantId/shares, governed by the new shares.manage tenant scope.
  • Defines shares.exchange at POST /v1/share-sessions, the contract's only unauthenticated operation: the grant row is the authorization, so a public share token trades for a short-lived document session JWT. The registry test now pins that surface, making any future credential-less operation an explicit decision.
  • Adds an optional origins allowlist to document-token issuance, so a minted token can be restricted to named web origins.
  • Adds tenants.usage for per-tenant usage facts, plus tenants.suspend and tenants.resume for operator-controlled tenant suspension.
  • Reports tenant status on tenant records and regenerates openapi.json, which now carries 44 operations.

• #734 by @bobsingor – Adds the integrity-pinned init → transfer → commit document upload protocol, including presigned PUT and policy-controlled multipart proxy transfer modes.

• #730 by @bobsingor – Adds share-session support, the client half of the no-backend embed flow.
  • Adds exchangeShareToken, which trades a public share token for a short-lived document session, and ShareExchangeError, whose code names the outcome (SharePasswordRequired, OriginNotAllowed, ShareExpired, NotFound).
  • Adds shareSessionSource, a caching token source that re-exchanges shortly before expiry and shares one in-flight exchange between concurrent callers. Because the transport resolves its token source on every request and on stream reconnect, renewal needs no timers and no listeners.
  • Requires no change to open(): an exchanged session is an ordinary document-scoped JWT, so a share source feeds open({ kind: 'token' }) unchanged, and each open keeps its own credential.

• #734 by @bobsingor – Adds the generated TypeScript SDK and its high-level uploads.create workflow. It hashes browser and Node.js upload sources, negotiates presigned or proxy transfer, uploads the bytes, and commits only after integrity verification.

• #730 by @bobsingor – Implements share grants, origin locking, per-tenant usage, and tenant suspension.

  • Stores share grants whose row id is the public share token, carrying document capabilities, an optional origin allowlist, an optional scrypt-hashed passphrase, a session TTL, and an optional expiry. Editing or deleting a grant retargets every embedded copy of its token at the next exchange.
  • Serves the public POST /v1/share-sessions exchange, which validates origin, passphrase, expiry, disablement, and tenant suspension before minting a document session JWT. Unknown, revoked, disabled, and suspended grants answer alike so the existence of a grant is never disclosed, and the route carries its own per-IP and per-grant limiters rather than the authentication-failure budget.
  • Enforces an optional origins claim on document tokens for every request that arrives with a browser Origin header, covering both share sessions and backend-minted tokens. Requests without the header are governed by the token itself.
  • Adds CORS through CLOUDPDF_CORS_ORIGINS (* to reflect, or a comma-separated allowlist), which browser-direct deployments need. Bearer tokens remain the security boundary; per-credential origin locks carry the origin policy a server-wide list cannot express.
  • Records per-tenant usage facts for views, uploads, and stored bytes, readable at GET /v1/tenants/:tenantId/usage. A view is a share exchange or an authorized /v1/access grant, counted once across the two. These counters hold no limits and are separate from license metering.
  • Adds tenants.suspend and tenants.resume, which fail every tenant JWT, document JWT, and share exchange closed while leaving the root API token free to inspect, resume, or delete the tenant.
  • Mounts token revocation from the CLI through CLOUDPDF_ENABLE_REVOCATION.
  • Records share and suspension lifecycle events in the security-event trail, and adds matching SQLite and PostgreSQL migrations plus origin, passphrase, and end-to-end share coverage.

• #734 by @bobsingor – Adds integrity-pinned uploads with presigned storage transfer preferred and a policy-controlled multipart proxy fallback.

  Hardens filesystem-backed storage against path traversal, storage-root deletion, and recursive deletion through symbolic links.

• #730 by @bobsingor – Accepts public share tokens, so a viewer can be embedded with a dashboard-generated snippet and no backend.
  • Adds the shareToken and sharePassword options for opening a single shared document.
  • Adds a cloud { kind: 'share' } document source for documents, so a multi-tab viewer can mix share tokens, document tokens, and document ids. Each entry exchanges and renews independently, and revoking one share leaves the others untouched. The source is lowered to an ordinary token source before the engine-agnostic viewer core sees it.
  • Re-exports exchangeShareToken, shareSessionSource, and ShareExchangeError so CDN-only consumers can build custom flows, such as prompting for a passphrase before mounting.

• #730 by @bobsingor – Accepts public share tokens on CloudPDFViewer, inherited from the cloud vocabulary it already shares with the snippet.
  • Adds the shareToken and sharePassword props for rendering a shared document without a backend.
  • Accepts cloud { kind: 'share' } entries in documents, so a multi-tab viewer can mix share tokens, document tokens, and document ids.

Release version v3.34.1

This release makes zip.js resilient to environments without "deflate-raw" support in Compression Streams and to web workers failing silently (e.g. in browser extensions), detects archives with an encrypted central directory, and improves the fidelity of written zip files with other tools.

• New workerStartupTimeout option in configure(): if a newly created web worker does not respond within this delay (5 seconds by default), it is terminated and the task runs inline transparently. This recovers from workers failing silently without any error event, e.g. worker scripts blocked by the Content Security Policy. Error events raised by workers which have never responded now also trigger the inline fallback instead of making the task fail. As part of this change, streams are only transferred to workers which have proven responsive, workers post a ready message as soon as their script is loaded, and terminateWorkers() re-enables the detection of web worker support
• New ERR_ENCRYPTED_CENTRAL_DIRECTORY error: ZipReader now detects archives with an encrypted central directory (PKWARE SES, e.g. produced by SecureZIP with filename encryption enabled) via the zip64 end of central directory record or the archive extra data record, and throws a clear error instead of failing with a misleading one
• Entries encrypted with the strong encryption feature of PKWARE (bit 6 of the general purpose bit flag) are now rejected with ERR_UNSUPPORTED_ENCRYPTION instead of ERR_INVALID_PASSWORD when reading

• The automatic fallback on the embedded deflate/inflate implementation did not work when Compression Streams were unavailable or did not support the "deflate-raw" format (e.g. Chromium <= 102, Firefox <= 112, older versions of Node.js), unless useCompressionStream was set to false (#669). The WebAssembly module is now initialized when needed, and its initialization is skipped for entries which do not need it (stored entries and entries using a custom codec)
• Explicitly passed externalFileAttributes values are now written verbatim, including 0 on directory entries. The msDosCompatible and unix mode options (unixMode, setuid, setgid, sticky) now only override the bits they represent and preserve the other bits (bits 8 to 15 of the DOS attributes were previously dropped when a unix mode was recomposed)

• Last modification dates with an odd number of seconds are now rounded up to the next even second in the DOS date/time fields instead of being truncated, consistently with Info-ZIP, 7-Zip, ditto and Windows. The extended timestamp and NTFS extra fields still store the exact date

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.8.37...v2.8.38