1.8.39

• Add support for tRPC 11.x
• Add support for @prisma/adapter-better-sqlite3 7.x
• Add Zen.bypassRequest() to bypass Zen protection for a single request, based on your own custom logic
• Catch more SSRF attacks hidden in redirects, like a Location: //evil-host/path header
• Show which table needs a tenant ID in IDOR protection error messages
• Don't require a tenant ID for queries that only touch excluded tables
• Detect SQL injection and enforce IDOR protection in mysql queries built with mysql.createQuery()
• Support fastify route hooks passed as arrays, e.g. preHandler: [fn1, fn2]
• Add path traversal protection for the new Zip API in node:zlib (Node.js 26.8+)
• Fix a harmless debug-mode warning logged on older hono versions that don't support HTTP's newer QUERY method yet
• Speed up matching against IP allow/block lists (Geo, Known Threat Actors, Tor) with a faster, native implementation
• Guard against repeated config fetches when realtime updates arrive too quickly
• Also check Buffers passed to XML parsers, not just strings
• Don't flag requests for openapi.json as part of an attack wave
• Only inspect a string as a JWT when it's long enough to actually be one