v1.10.0

1.10.0 (2026-08-11)

🚀 New Features

• example: add Next.js Guard policy agent (#6191) (c7726c3)
• expand metadata to nested JSON on guard() and protect() (#6171) (caedefa)
• expose threat and billing metadata (#6207) (aa94784)
• guard: add capture client surface (#6175) (95e07ef)
• guard: add Eve support as @arcjet/guard/vercel-eve/v0 (#6208) (e3a399d)
• guard: add provider-namespaced AI SDK helpers as @arcjet/guard subpaths (#6164) (90a867a)
• guard: batch and flush capture delivery (#6176) (3a3a74a)
• guard: evaluate remote local policies first (#6222) (78183d9)
• guard: evaluate remote policies (#6186) (63e6939)
• support explicit client IP sources (#6223) (12924e1)

🪲 Bug Fixes

• classify phone numbers with Rampart model (#6187) (b05af68)
• emit Windows-compatible Wasm paths (#6189) (c68b19d)
• examples: override sharp to 0.35.x for GHSA-f88m-g3jw-g9cj (#6185) (026af8c)
• guard: pin @connectrpc/* and @bufbuild/protobuf to exact versions (#6165) (a1114c3)
• regenerate redact and analyze WebAssembly modules (#6183) (c18c6b3)

📝 Documentation

• guard: clarify failure defaults (#6219) (d2358ea)

🧹 Miscellaneous Chores

• adjust Arcjet descriptions (#6181) (c6f3928)
• document publishing and fix sensitive-info-rampart peer deps (#6146) (22d48de)
• examples: remove examples migrated to arcjet/examples (#6217) (e69962f)
• pin npm to 12.0.1 in CI and remove unenforced Trunk config (#6154) (ed08ede)
• proto: sync generated bindings with arcjet monorepo main (#6163) (500a889)

📚 Tests

• transport: characterize unary Connect behavior (#6221) (4d4f362)

🔨 Build System

• deps-dev: bump astro from 7.0.9 to 7.1.0 (#6152) (4e7e33c)
• deps-dev: bump fast-uri from 3.1.2 to 3.1.4 in /examples/nestjs (#6161) (7752027)
• deps-dev: bump ip-address from 10.2.0 to 10.4.0 in /examples/express-newman (#6190) (492b221)
• deps-dev: bump js-yaml from 4.3.0 to 4.3.1 (#6210) (2c516a5)
• deps-dev: bump js-yaml from 4.3.0 to 4.3.1 in /examples/nextjs-server-actions (#6212) (86be46f)
• deps-dev: bump js-yaml from 4.3.0 to 4.3.1 in /examples/remix-express (#6209) (12974fe)
• deps-dev: bump next from 16.2.10 to 16.2.11 (#6169) (451ee09)
• deps-dev: bump react-router from 7.18.1 to 8.3.0 (#6168) (775885d)
• deps: bump @nuxt/devtools from 3.2.4 to 3.4.1 in /examples/nuxt (#6211) (cd362db)
• deps: bump astro and @astrojs/node in /examples/astro (#6182) (509c35d)
• deps: bump body-parser from 1.20.4 to 1.20.6 in /examples/react-router-middleware (#6153) (f8792c3)
• deps: bump brace-expansion from 2.1.2 to 2.1.4 in /examples/nuxt (#6196) (0e91f70)
• deps: bump brace-expansion in /examples/nextjs-ai-agent (#6195) (f7d090c)
• deps: bump brace-expansion, @eslint/compat and eslint in /examples/sveltekit (#6150) (529712b)
• deps: bump fast-uri in /examples/fastify (#6188) (f118e62)
• deps: bump find-my-way from 9.6.0 to 9.7.0 in /examples/fastify (#6170) (1e95a4f)
• deps: bump js-yaml from 4.3.0 to 4.3.1 in /examples/nextjs-pages-wrap (#6214) (4d7e6c8)
• deps: bump next from 16.2.6 to 16.2.12 in examples (#6180) (fb2eb5e)
• deps: bump postcss and next (#6194) (c98714e)
• deps: bump postcss and next in /examples/nextjs-ai-agent (#6197) (dfdf161)
• deps: bump postcss and next in /examples/nextjs-app-dir-rate-limit (#6204) (cd4f5f6)
• deps: bump postcss and next in /examples/nextjs-app-dir-validate-email (#6203) (1b0f48f)
• deps: bump postcss and next in /examples/nextjs-bot-categories (#6202) (1c15f89)
• deps: bump postcss and next in /examples/nextjs-decorate ([#6201](#6201...

v1.9.1

1.9.1 (2026-07-15)

🪲 Bug Fixes

• ip: update verify-ranges script paths for src/dist layout (#6143) (83fdb74)
• publish: include @arcjet/sensitive-info-rampart in publish workflow (#6145) (a5d0a8b)

v1.9.0

1.9.0 (2026-07-15)

🚀 New Features

• add Rampart model backend to localDetectSensitiveInfo (#6141) (a77cacc)
• sensitive-info-rampart: add on-device Rampart NER backend (#6120) (f2b9e44)

🪲 Bug Fixes

• arcjet-guard: detect and recycle silently dropped HTTP/2 connections (#6137) (742cb4b)
• arcjet-guard: make connection recycling single-flight per session generation (#6138) (ca0883c)

🧹 Miscellaneous Chores

• seed release-please manifest for sensitive-info-rampart (#6142) (39ec65f)

🔨 Build System

• deps-dev: bump ws from 7.5.10 to 7.5.12 in /examples/remix-express (#6140) (bc91c59)
• deps: bump morgan from 1.10.1 to 1.11.0 in /examples/react-router-middleware (#6139) (d91afca)
• deps: bump morgan from 1.10.1 to 1.11.0 in /examples/remix-express (#6135) (f5c1135)

✅ Continuous Integration

• publish: pass dist-tag via --tag and drop publishConfig.tag (#6133) (a429662)

v1.8.0

1.8.0 (2026-07-07)

For this release we've switched from rollup to tsdown for our build tool. If you encounter any issues please open an issue!

🧹 Miscellaneous Chores

• modernize build tooling (#6093) (48b89ea)
• publish 1.8.0 overtop of erroneously published 1.8.0-rc.0 (#6132) (3929316)

🔨 Build System

• deps-dev: bump js-yaml from 4.1.1 to 4.3.0 in /examples/nextjs-app-dir-validate-email (#6128) (ea2371a)

✅ Continuous Integration

• publish: preflight visibility and validation for the publish workflow (#6130) (7f4068a)

v1.7.0

1.7.0 (2026-07-06)

At 2026-07-06T16:23:17.995Z we mistakenly published 1.7.0-rc.1 to the latest tag on npm. It was intentionally published but intended for the rc channel. We've re-release version 1.6.1 as 1.7.0 so future installs get the correct version. If you installed 1.7.0-rc.1 during the roughly 40 minute window please update to 1.7.0.

🚀 New Features

• publish 1.7.0 overtop of erroneously published 1.7.0-rc.1 (#6125) (2d239c5)

v1.6.1

1.6.1 (2026-06-30)

🪲 Bug Fixes

• protocol: add typeid.js and typeid.d.ts to package files (#6121) (bb2425f)

v1.6.0

1.6.0 (2026-06-30)

🚀 New Features

• add outbound proxy support to @arcjet/transport and @arcjet/guard (#6089) (0048dfa)
• arcjet-guard: add per-request metadata to experimental_moderateContent (#6100) (fe28505)
• arcjet-guard: export experimental_moderateContent from node and fetch entrypoints (#6097) (1b7fc90)
• expose correlationId on protect() and guard() (#6104) (14a3a1f)
• guard: add experimental_moderateContent rule (#6059) (b001765)
• guard: error/warning decision model with hasFailedOpen() gate (#6096) (8bbb885)
• nosecone-next: add nonce API to get the CSP nonce (#6109) (165dc49)
• protocol: regenerate clients with correlation_id field (#6098) (71346b3)
• require Node.js >=22.21.0 and drop EOL Node.js 20 (#6090) (d002118)

🪲 Bug Fixes

• arcjet-guard: accept object input on string-input rules (#6114) (8e828d0)
• guard: split errorResult() from result() so errors aren't up-cast (#6107) (b5317ed)
• transport: make HTTP/2-over-CONNECT-proxy work on Node >= 26 (#6119) (2b72b6c)
• transport: skip Node 26-broken http2-proxy tests (revert force-exit) (#6112) (3ae2731)

🏎️ Performance Improvements

• analyze-wasm: regenerate js_req wasm (Aho-Corasick bot parser + Wizer) (#6066) (5f62631)

📝 Documentation

• use unified Arcjet skill install command (#6115) (3007110)

🧹 Miscellaneous Chores

• Add devcontainer lockfile (#6092) (2aa7e57)

📚 Tests

• arcjet: force test runner to exit; add CI test-job timeouts (#6108) (a34473b)
• arcjet: verify protect() runs on Cloudflare Workers (#6110) (76a86fb)

🔨 Build System

• deps-dev: bump js-yaml from 4.1.1 to 4.2.0 in /examples/nextjs-sensitive-info (#6080) (9b9a307)
• deps-dev: bump js-yaml from 4.1.1 to 4.2.0 in /examples/sveltekit (#6072) (95f14c6)
• deps-dev: bump js-yaml from 4.1.1 to 4.3.0 in /examples/nextjs-decorate (#6085) (c46f133)
• deps-dev: bump js-yaml from 4.1.1 to 4.3.0 in /examples/nextjs-ip-details (#6106) (6d254d1)
• deps-dev: bump js-yaml from 4.1.1 to 4.3.0 in /examples/nextjs-pages-wrap (#6084) (7a0ea5a)
• deps-dev: bump js-yaml from 4.1.1 to 4.3.0 in /examples/nextjs-react-hook-form (#6086) (dc143e0)
• deps-dev: bump js-yaml from 4.1.1 to 4.3.0 in /examples/nextjs-server-actions (#6118) (5be3719)
• deps-dev: bump vite from 8.0.10 to 8.0.16 (#6074) (005bb8c)
• deps: bump js-yaml from 4.1.1 to 4.2.0 (#6073) (91c1cd7)
• deps: bump launch-editor from 2.13.2 to 2.14.1 in /examples/nuxt (#6081) (9992872)
• deps: bump nuxt from 4.4.6 to 4.4.8 in /examples/nuxt (#6078) (6e9cfd0)
• deps: bump shell-quote from 1.8.3 to 1.8.4 in /examples/nuxt (#6065) (3c17856)
• deps: bump undici and miniflare in /arcjet-guard (#6091) (b15e4b9)
• deps: bump undici from 6.24.1 to 6.27.0 in /examples/remix-express (#6095) (c2b0f3d)
• deps: upgrade Next.js examples to 16.2.6 (#6094) (5f9c64c)

✅ Continuous Integration

• stop release-please self-triggering loop on its own branch (#6105) (514ee98)

v1.5.0

1.5.0 (2026-06-09)

🚀 New Features

• support proxy services such as Cloudflare for client IP detection (#6060) (f77ead5)

🪲 Bug Fixes

• redact detectPromptInjectionMessage from report calls (#6041) (b490fc7)
• update @bufbuild/protobuf to 2.12.0 and add root override to fix Bun build (#6014) (ba8f1a3)

📝 Documentation

• clarify label/bucket slug validation in @arcjet/guard types (#6043) (81293b3)
• refresh root, next, and guard READMEs for guards release (#6017) (994232c)

🧹 Miscellaneous Chores

• configure release-please to use GitHub App Token (#6019) (571b1b7)
• remove redundant esbuild and flatted overrides (#6020) (ca2ad5a)

🔨 Build System

• deps-dev: bump astro from 6.1.2 to 6.1.6 (#6003) (6730508)
• deps-dev: bump astro from 6.1.6 to 6.1.10 (#6031) (ea8963d)
• deps-dev: bump fast-uri from 3.1.0 to 3.1.2 (#6023) (1d000d3)
• deps-dev: bump fast-uri from 3.1.0 to 3.1.2 in /examples/nestjs (#6024) (f830a47)
• deps-dev: bump fastify from 5.8.4 to 5.8.5 (#6000) (fe37f56)
• deps-dev: bump ip-address from 10.1.0 to 10.2.0 in /examples/express-newman (#6021) (11dd637)
• deps-dev: bump next from 16.2.4 to 16.2.6 (#6029) (dcf85e1)
• deps-dev: bump next from 16.2.4 to 16.2.6 in /arcjet-next (#6028) (082c20f)
• deps-dev: bump next from 16.2.4 to 16.2.6 in /nosecone-next (#6027) (29f3de1)
• deps: bump @astrojs/node from 10.0.4 to 10.0.5 in /examples/astro (#6008) (cdffb7d)
• deps: bump astro from 6.1.4 to 6.1.8 in /examples/astro (#6001) (69b4198)
• deps: bump astro from 6.1.8 to 6.3.2 in /examples/astro (#6032) (6397074)
• deps: bump brace-expansion from 5.0.5 to 5.0.6 in /examples/nuxt (#6039) (dac76d1)
• deps: bump devalue from 5.6.4 to 5.8.1 (#6034) (def151d)
• deps: bump devalue from 5.6.4 to 5.8.1 in /examples/astro (#6038) (c683d82)
• deps: bump devalue from 5.6.4 to 5.8.1 in /examples/nuxt (#6035) (9203466)
• deps: bump fast-uri from 3.1.0 to 3.1.2 in /examples/fastify (#6026) (c7bffe1)
• deps: bump nitropack from 2.13.3 to 2.13.4 in /examples/nuxt (#6022) (ecacd00)
• deps: bump nuxt and @nuxt/nitro-server to 4.4.6 in examples/nuxt (#6055) (74573e3)
• deps: bump qs to 6.15.2 in examples (#6051) (f784256)
• deps: bump simple-git from 3.33.0 to 3.36.0 in /examples/nuxt (#6025) (bff84fb)
• deps: bump svelte and @sveltejs/kit in examples/sveltekit (#6053) (4e44e85)
• deps: bump turbo, svelte, @sveltejs/kit and transitives (#6052) (57b263e)

✅ Continuous Integration

• add workflow lint gate (actionlint + zizmor) (#6030) (f1f4707)
• allow mise attestation-verification endpoints in lint-workflows (#6061) (8fdeb39)
• split update duties between Dependabot (security) and Renovate (#6006) (a8a22c9)

v1.4.0

1.4.0 (2026-04-14)

🚀 New Features

Introducing Arcjet Guard - protect AI agent tool calls, background jobs, and anything beyond HTTP. @arcjet/guard is a new API built for the agentic era: rate limit by any key, detect prompt injection, and catch PII.

• guard: promote @arcjet/guard from experimental to stable release (#5996) (f511f44)

📝 Documentation

• add @arcjet/guard documentation to root README (#5993) (4be39c8)
• add MCP server mentions to @arcjet/guard (#5974) (cd398c0)

🧹 Miscellaneous Chores

• add .claude/ to .gitignore (#5988) (6f0f922)
• always trigger workflows on release-please branch (#5998) (6554cd1)
• delete astro-5 example (#5995) (38487cb)
• Deprecate score and threshold fields in detectPromptInjection (#5987) (de46cb7)
• examples: Add Astro 5 example, upgrade main Astro example to v6 (#5975) (a77c077)
• guard: add legacy type resolution for typescript@<=5 (#5978) (fd6ad6d)
• guard: introduce arcjet guard js (#5957) (53ff2e2)
• guard: update protobuf (#5986) (25f0e9e)
• proto: sync generated proto (#5994) (25b11fe)
• regenerate wasm binaries after aws-lc-rs update (#5969) (bda5448)

🔨 Build System

• deps-dev: bump vite from 7.3.1 to 7.3.2 (#5980) (8a253f6)
• deps-dev: bump vite from 7.3.1 to 7.3.2 in /examples/react-router (#5982) (ddf3416)
• deps-dev: bump vite from 7.3.1 to 7.3.2 in /examples/react-router-middleware (#5985) (e36cf35)
• deps: bump @nestjs/core from 11.1.17 to 11.1.18 in /examples/nestjs (#5983) (514ae8b)
• deps: bump unhead and @unhead/vue in /examples/nuxt (#5989) (6add894)
• deps: bump vite from 7.3.1 to 7.3.2 in /examples/nuxt (#5981) (97138bc)
• deps: bump vite in /examples/remix-express (#5977) (3b97d6f)

v1.3.1

1.3.1 (2026-03-30)

🪲 Bug Fixes

• filter: update wasm and add tests for len() on absent map fields (#5929) (d2a3161)
• install command & pricing references (#5959) (7e54cbd)

📝 Documentation

• add api sections (#5803) (a203381)

🧹 Miscellaneous Chores

• add ARCJET_SIGNALS to well-known bots list (#5930) (a936e87)
• astro: support astro@6 (#5963) (0058e90)
• docs: refresh READMEs (#5951) (e1957d3)
• refresh READMEs (#5940) (dae94a1)
• trunk: disable trivy (#5937) (d5b5b62)

🔨 Build System

• deps-dev: bump flatted from 3.3.3 to 3.4.2 in /examples/nestjs (#5939) (1731808)
• deps-dev: bump tar from 7.5.10 to 7.5.11 in /examples/nextjs-app-dir-rate-limit (#5924) (db91f18)
• deps: bump tar from 7.5.10 to 7.5.11 in /examples/nuxt (#5925) (66cb779)