1.8.38-beta.1

• Add support for tRPC 11.x
• Add support for @prisma/adapter-better-sqlite3 7.x
• Add Zen.bypassRequest() to bypass Zen protection for a single request, based on your own custom logic
• Catch more SSRF attacks hidden in redirects, like a Location: //evil-host/path header
• Show which table needs a tenant ID in IDOR protection error messages
• Don't require a tenant ID for queries that only touch excluded tables
• Detect SQL injection and enforce IDOR protection in mysql queries built with mysql.createQuery()
• Support fastify route hooks passed as arrays, e.g. preHandler: [fn1, fn2]
• Add path traversal protection for the new Zip API in node:zlib (Node.js 26.8+)
• Fix a harmless debug-mode warning logged on older hono versions that don't support HTTP's newer QUERY method yet
• Speed up matching against IP allow/block lists (Geo, Known Threat Actors, Tor) with a faster, native implementation
• Guard against repeated config fetches when realtime updates arrive too quickly