v0.4.0

Packages

Published to npm, each with a provenance attestation the release verified before this
draft was made. Attached below are the tarballs npm is serving, and a bill of
materials for what they carry: sbom.cyclonedx.json (CycloneDX 1.7) and
sbom.spdx.json (SPDX 2.3), both from pnpm sbom --prod, so they describe the
production dependency closure of this tag and not the tooling this repository builds
with. Their root component is the workspace itself.

• @stayingupwind/adapter@0.4.0 — https://slsa.dev/provenance/v1
• @stayingupwind/auth@0.4.0 — https://slsa.dev/provenance/v1
• @stayingupwind/core@0.4.0 — https://slsa.dev/provenance/v1
• create-upwind@0.4.0 — https://slsa.dev/provenance/v1
• @stayingupwind/runtime@0.4.0 — https://slsa.dev/provenance/v1
• @stayingupwind/sdk@0.4.0 — https://slsa.dev/provenance/v1
• upwind@0.4.0 — https://slsa.dev/provenance/v1

What's Changed

• feat(adapter): three seams a host needs to see what an application does by @k-taro56 in #54
• fix(runtime): say what the Function failed with, where nothing else can by @k-taro56 in #57
• ci: retire the bootstrap credential, and let the site install 0.3.0 by @k-taro56 in #55
• fix(runtime): a failure body that cannot itself fail, and counts what it says it counts by @k-taro56 in #58
• chore: build against Next.js 16.3.8, which is the security release by @k-taro56 in #59
• feat: say when a project's Next.js is older than the fixes it is missing by @k-taro56 in #60
• feat: authentication a project can start with before it has configured any by @k-taro56 in #56
• feat(adapter): let a host leave the prefetch segments out of the Function by @k-taro56 in #62
• fix(runtime): ask the host for a segment the Function was not given by @k-taro56 in #63
• Smaller Functions: the middleware carries what its path reads, the runtime minified and without zod, twin chunks loaded once by @soleil-colza in #51
• Answer a regeneration's visitor from its render, and regenerate nothing in front of a prefetch by @soleil-colza in #47
• Write cached fetches behind the prerender, and answer the middleware from the manifest's head by @soleil-colza in #46
• Read the data cache in each request that needs it, and base64 through the platform's codec by @soleil-colza in #45
• Split a large application's routes across app Functions by @k-taro56 in #64
• deploy-tests: a deployment that fails says why where the suite's log will show it by @k-taro56 in #79
• fix(runtime): upload a regeneration's outputs four at a time by @soleil-colza in #78
• Serve the shell to Googlebot and to a speculative navigation, and run a crawler list only where its cost is bounded by @soleil-colza in #52
• Carry a build's source maps through index maps and the hooks that delete them by @k-taro56 in #80
• deploy-tests: a settle the operator gives, waited out before the suite starts by @k-taro56 in #81
• Merge #52 and #80 on the line before #51, for the host that pins both by @soleil-colza in #82
• runtime: answer a segment prefetch it cannot serve with Next.js's 404, not the page's payload by @k-taro56 in #84
• core: judge a prefetch's x-deployment-id as a dpl, instead of turning it away as internal by @k-taro56 in #85
• adapter: accept constants and punycode, which workerd implements in full by @k-taro56 in #83
• adapter: ship a file a server module refers to by URL, and tell the Turbopack runtime where it is by @k-taro56 in #86
• runtime: answer a Pages Router miss with its error page under a 404 when the build wrote no /404 by @k-taro56 in #87
• docs(web-site): the bundle directory by its name, now that the site installs it by @k-taro56 in #88
• chore(deps): every open Dependabot bump in one PR, TypeScript aside by @k-taro56 in #89
• runtime: see a request that may change something through to its answer, whatever became of its client by @k-taro56 in #90
• feat(runtime): tell the edge which tags a request invalidated at once by @k-taro56 in #94
• adapter, runtime: answer a rewrite that lands on a file under _next/static from the host by @k-taro56 in #92
• docs(runtime): say what reads a Function's env back, not one application's clients by @k-taro56 in #95
• adapter: let a dynamic load the code catches itself through the audit, and record it as guarded by @k-taro56 in #91
• Keep the documents a router-only rule cannot touch, and route a build with a base path by @soleil-colza in #43
• Serve the pages of a trailingSlash build at the spelling they are asked for by @soleil-colza in #44
• Compile a rule list's patterns once, skip data routes for a page, and classify HEAD as GET by @soleil-colza in #49
• adapter: read an import's chain past its handler, and let a switch be plain by @k-taro56 in #97
• feat(runtime): say at which revision of the scope a request's at-once invalidations were recorded by @k-taro56 in #99
• fix(deploy-tests): send the suite to a deployment's own URL, where the host gives one by @k-taro56 in #98
• fix(core): keep zod out of the middleware's runtime again by @soleil-colza in #96
• perf(runtime): one call for a turn's invalidation, use cache writes behind the render, tags read with the value by @k-taro56 in #101
• fix: preserve Reporting-Endpoints in shell response headers by @k-taro56 in #102
• Neutralize user-facing runtime and size-limit wording by @soleil-colza in #100
• fix(deploy-tests): wait out the project's previous run, and build and run the suites as Next.js's own jobs do by @k-taro56 in #104
• fix(runtime): read a prerender's placeholders against its route, not every bracket as one by @k-taro56 in #105
• fix(runtime): refuse what a page answers no read of, with Allow, where Next.js does by @k-taro56 in #106
• Complete first-request App Router output and keep redirects valid by @soleil-colza in #103
• runtime: run Sentry's random reads in the context the request entered with by @k-taro56 in #93
• fix(runtime): resume a blocking partially prerendered page no generation answered by @k-taro56 in #109
• fix(adapter): let a Function's fetch to its own hostname reach it by @k-taro56 in #107
• fix(core): keep x-next-cache-tags off a relayed response by @k-taro56 in #108
• revert(runtime): leave the unkept miss to the build's path, which #103 renders once by @k-taro56 in #110
• fix(core): read a blocking route's own entry as its class, which Next.js 16.3 calls a page by @k-taro56 in #111
• fix(deploy-tests): give a deployment the suite's own variables, read against the harness's environment by @k-taro56 in #112
• feat: the Workflow SDK, its flow route a Function of its own by @soleil-colza in #61
• fix(deploy-tests): leave Next.js's stack size out of a suite's variables, and put a value too short for a secret up as it is by @k-taro56 in #113
• fix(deploy-tests): run a fixture that pins npm with the pnpm every other fixture runs by @k-taro56 in #115
• feat(core): bound the cost of a routing pattern before it is tested by @soleil-colza in #116
• fix(runtime): give a request that came without a Host header the host of the URL it was asked under by @k-taro56 in #117
• fix(runtime): answer a Pages Router miss with the App Router's not-found where there is one by @k-taro56 in #114
• feat(core): name what serves a member of a class with no shell by @soleil-colza in #118
• Merge #116 and #118 on the line before #61, for the host that pins both by @soleil-colza in #119
• fix: tell a build's own manifests from another build's under a shared build id by @k-taro56 in #121
• fix: build and serve Next.js 16.4, which the adapter refused at its first patch by @soleil-colza in #120
• feat(core): store a manifest with what its routes repeat held once by @soleil-colza in #123
• feat(core): name a Pages Router page's props, and the client's request for them by @soleil-colza in #124
• feat(core): name a finished page's whole payload, and the router's request for it by @soleil-colza in #122
• Build with Next.js 16.4's defaults: read the collapsed route table by @soleil-colza in #126
• fix(core): the review's findings on the pattern budget by @soleil-colza in #125
• Answer what Next.js 16.4's own deploy suites found by @soleil-colza in #127
• Answer a Pages Router data request under the base path by @soleil-colza in #129
• fix: five findings of Next.js's deploy suites at 16.4.0 by @soleil-colza in #130
• feat: track default D1 dependencies in Next.js cache scopes by @k-taro56 in #128
• fix(core): test Next.js 16.4's middleware matchers within the budget by @soleil-colza in #131
• fix(deps): resolve Dependabot alerts in workspace and website by @k-taro56 in #132
• ci: audit workspace and website dependencies by @k-taro56 in #133
• fix(adapter): capture no immediates in a task where the runtime schedules tasks by @soleil-colza in #134
• fix(runtime): omit document preload links from RSC responses by @k-taro56 in #135
• ci: include low and moderate audit findings by @k-taro56 in #136
• fix(deploy-tests): deploy a workspace from the package its build built by @soleil-colza in #137
• chore: update pnpm to 12.10.1 by @k-taro56 in #138
• fix(runtime): offer the router each name's escaped spellings, for a rewrite to one by @soleil-colza in #139
• fix(runtime): offer a rewrite's written destination as written by @soleil-colza in #140
• fix: read a request's path by the name Next.js builds it under by @soleil-colza in #141
• fix(runtime): name a skipped prefetch's page as Next.js does by @soleil-colza in #144
• Add native Durable Object bindings and isolated class bundles by @k-taro56 in #143
• feat(runtime): end a response once its cache writes have landed by @soleil-colza in #156
• runtime: name the parameters a class route holds in its path for a handler handed the path asked for by @k-taro56 in #157
• feat(core): a validator with zod's API, and core's schemas on it by @k-taro56 in #158
• feat(runtime): read a generation another isolate published, and never publish over it by @soleil-colza in #160
• feat(runtime): catch a Function up with where its scope stands before a request is judged by @soleil-colza in #161
• runtime: give a page regenerated in the foreground the headers routing gives every answer by @k-taro56 in #159
• perf(adapter): bundle the runtime module with Rolldown by @k-taro56 in #162
• chore(deps): every open Dependabot bump in one PR, TypeScript and the site's Next.js aside by @k-taro56 in #163
• chore(deps): TypeScript 6.0.3, Miniflare 5.20261006.1-alpha and the newest shared pins by @k-taro56 in #166
• chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /web-site by @dependabot[bot] in #68
• chore: 0.4.0, and the credential that first publishes the auth package by @k-taro56 in #169
• fix(runtime): hold an answer for a first render's publish alone by @soleil-colza in #167
• fix(runtime): keep a request answered with a stale value going for its revalidation by @soleil-colza in #168
• Provide typed inference-only Workers AI bindings by @k-taro56 in #165
• perf(core): keep what checks an upload out of what a manifest's reader builds by @soleil-colza in #170
• feat(adapter): bundle an application's own cache handlers into the Function by @soleil-colza in #172
• fix(runtime): read an escaped slash in a Pages catch-all as routing does, when regenerating by @soleil-colza in #171
• fix(runtime): read an escaped slash in an App Router catch-all as routing does by @soleil-colza in #173
• perf(adapter): carry less of Next.js's server in a deployment's Functions by @soleil-colza in #180
• perf(runtime): pack the prerenders of a Function's runtime manifest by @soleil-colza in #182
• perf(runtime): upload a regeneration's small outputs in one call by @soleil-colza in #181
• chore: suites under one Vitest runner, and a vocabulary check for the packages that serve and deploy a deployment by @k-taro56 in #174
• fix(runtime): answer from the render this isolate is publishing, not a page of one's own by @soleil-colza in #175
• perf(adapter): give each split Function only its own routes' manifests by @soleil-colza in #185
• perf: carry less in a deployment's Functions: admission schemas, OpenTelemetry copies, prerender ids by @soleil-colza in #184
• feat(adapter): export UpwindConfig, the type of a project's configuration by @soleil-colza in #186
• perf(adapter): rename the locals of the runtime and of packages' CommonJS by @soleil-colza in #183
• fix(core): find a Set-Cookie's Domain however its name is spaced by @k-taro56 in #188
• fix(runtime): answer a superseded request with the render this isolate just published by @soleil-colza in #187
• refactor(adapter): bundle a Durable Object's class with Rolldown by @soleil-colza in #189
• fix(adapter): refuse a runtime import Rolldown cannot resolve by @soleil-colza in #190
• fix(runtime): answer a superseded request with the later generation's record a lease's answer carries by @soleil-colza in #192
• fix(runtime): say in a commit what the render's view held of each of its tags by @k-taro56 in #191
• fix(runtime): let a render being published answer past a move of the view that says nothing of its tags by @soleil-colza in #193
• feat(core): the path a request asks for a built page or a file by by @soleil-colza in #194
• Bound routing pattern work per request and reuse header decisions by @soleil-colza in #195
• fix(core, runtime): decode no page or file out of a path that escapes the base path or a locale by @soleil-colza in #196
• fix(cache): settle dynamic streams and retain invalidation deadlines by @soleil-colza in #197
• fix(core): read a repetition after a group of segments as taking each segment once by @soleil-colza in #198
• fix(runtime): stream fallback 404s and honor revalidation route precedence by @soleil-colza in #199
• fix(runtime): ask past a later data value that stands no better than stale, once by @soleil-colza in #200
• chore: build against Next.js 16.4.2, and hold builds to 16.4.1, the security release by @k-taro56 in #201
• fix(adapter): read the cache handler imports where a minified name holds a $ by @k-taro56 in #202
• Add reproducible hosting benchmarks from GitHub Actions by @soleil-colza in #203
• feat(paas): let the edge tell the runtime the status a middleware gave its rewrite by @k-taro56 in #205
• fix(runtime): answer a response only once the invalidations its request asked for are recorded by @soleil-colza in #204

New Contributors

• @dependabot[bot] made their first contribution in #68

Full Changelog: v0.3.0...v0.4.0