v0.5.3

Security

• Preserve private/no-store caching on SSR root, route and action redirects, and when data handlers throw Responses. Prevent inherited Node/CDN cache directives from overriding the transport policy. Redirect destinations and cookies are preserved; explicit resource-route responses retain their caching contract.
• Define nested loader values as own data properties so a configured __proto__ route ID cannot replace the value map’s prototype or introduce inherited values. This is local dictionary pollution, not global prototype pollution or demonstrated RCE.

Maintenance

• Simplify HTTP error paths with early returns, remove redundant error normalization, and group document/root-data imports consistently.

v0.5.2

Security

• Keep route-data and SSR responses private when application metadata includes targeted CDN caching headers. Override existing *-Cache-Control and Surrogate-Control directives alongside Cache-Control, preventing public/max-age metadata from taking precedence over the framework’s private/no-store policy. Regression coverage includes both data dispatchers and React/Preact SSR. This hardens conditional cache disclosure; CDN rules that deliberately override origin headers remain a hosting responsibility.

• Prevent cross-origin form-field disclosure in browser data transport. Same-origin route URLs whose pathname starts with // now fail before fetch instead of being interpreted as another host. Transport requests also use mode: "same-origin", preventing HTTP redirects from forwarding mutation bodies to another origin. React and Preact minified-browser regressions cover both paths, cross-origin redirects and successful local submissions. Explicit legacy data endpoints must stay on the page origin; use a same-origin proxy for remote APIs. This requires an application to accept an attacker-influenced matching route URL or an upstream cross-origin redirect; it is not evidence of server RCE.

• Contain malformed-target parser crashes in Vite development hosting. Guard Connect's public request entrypoint before its middleware parser; malformed URLs now receive a generic, non-cacheable 400 with a closed connection instead of terminating the process. Applies through routerPlugin/fileRouter and applicationPlugins, including middleware mode and server restarts. Unexpected failures still reach the host callback or server logger with a generic 500 response; no global exception handler or dependency fork is introduced. This protects Smolter-integrated development servers, not standalone Vite or a parent host that parses requests before Vite.

• Enforce the production browser boundary for *.server.ts/js modules outside src/, including raw imports. Previously a root-level or shared-directory server-marked module could be bundled into client JavaScript if accidentally imported. Both React and Preact application builds now reject it; SSR builds remain supported. This closes a conditional credential/source disclosure, not an arbitrary file-read or RCE exploit.

• Preserve every Set-Cookie header in the standalone Vite data transport. Previously only the final cookie survived, so a session-revocation cookie could be dropped when a response also updated another cookie. Reuse the shared streaming response writer instead of buffering and rewriting responses independently. This affects development transport; production Node hosting already uses the shared writer.

• Close a Vite server-export boundary bypass: destructured bindings and class declarations named loader/action are now rejected alongside ordinary inline handlers. Previously these forms could leave server-only implementation or embedded credentials in served browser modules. Named re-exports from separate server files remain supported; client-only destructuring is unchanged. This is a conditional source-disclosure issue when applications use these export forms, not evidence of remote code execution.

• Add blocking Semgrep code/workflow scans and a full-workspace pnpm audit to PR/main CI, with SARIF code-scanning results and retained audit artifacts. Pin GitHub Actions to commit SHAs and enable pnpm release-age, exotic-transitive-source and trust-downgrade protections. Scanners remain outside package dependencies.

• Cookie compatibility: preserve Secure and all other Set-Cookie attributes verbatim in the Node adapter, regardless of NODE_ENV. Previously an unset or non-production environment silently removed Secure, making an HTTPS session cookie eligible for plain HTTP. Applications own local cookie configuration; use local HTTPS when testing secure sessions. A Chromium regression uses synthetic cookies and an intercepted HTTPS origin to verify HTTP exclusion.

• Parse deferred settlement payloads as JSON instead of evaluating them as JavaScript object literals. A __proto__ data key can no longer alter a queued value’s prototype or disappear during hydration. Keep script-closing text escaped; existing nonce and streaming behavior remain supported. A minified Chromium regression covers the queue before hydration and the final resolved data.

• Restore route and hydration errors without invoking property setters. A JSON __proto__ key can no longer replace the revived Error prototype or bypass Error classification. Ordinary error data is retained. This is object-local prototype injection, not a demonstrated global prototype pollution or Critical exploit.

• Stop copying arbitrary Error properties into route-data responses and hydration snapshots. Transported errors retain name/message and explicit HTTP status/statusText/data, while request configs, credentials, causes, stacks and custom serialization hooks are excluded. Covers root, route and action failures, early/deferred hydration, and React/Preact static Scripts. Thrown non-Error objects remain failures instead of becoming successful loader data. Error messages and explicit public response data remain application-controlled and must not contain secrets. Consumers that relied on custom Error properties in the browser should move intentionally public fields into explicit route-error data or a Response payload.

• Anchor Node request targets to the HTTP request origin. Leading double slashes or backslashes cannot change the origin used for action authorization, closing a browser-reproduced bypass of the new mutation checks. Preserve route paths and queries.

• Reject executable javascript: destinations after URL normalization and deployment URL mapping, before React/Preact link rendering, document handoff or recovery-marker consumption. Mixed-case and embedded-tab/newline variants are covered. Normal HTTP(S), mail and telephone links remain supported. This prevents script execution when an application passes untrusted navigation targets; applications must still validate redirect destinations.

• Restrict Vite client-route transforms to discovered route files and enforce canonical route-directory and Vite filesystem permissions. Crafted module queries can no longer read protected environment files or files outside the route directory through this transform. This fixes a development-server disclosure; production static hosting is not affected by this path.

• Reject browser mutations whose Origin differs from the request URL origin, opaque/malformed origins, and requests marked cross-site. Apply the same policy to HTTP hosting, data dispatch and SSR document actions before application handlers run. Headerless non-browser clients remain supported; this does not replace authentication, authorization or application CSRF tokens. Reverse proxies must supply the correct public request URL through a trusted hosting configuration; forwarded headers are not trusted automatically.

• Return 405 with Allow for unsupported action methods, including OPTIONS, instead of executing mutations. Normalize GET/HEAD as read operations across both data dispatchers; HEAD cannot reach an action.

• Upload compatibility: bound Node and Vite request buffering to 1 MiB by default, including multipart overhead. Return 413 before application handlers run for oversized declared or chunked bodies; reject forbidden origins and methods before reading upload bytes. Set maxBodySize consistently on createRequestHandler and applicationPlugins/routerPlugin for intentionally larger uploads. Low-level webRequest accepts the limit as its fourth argument and throws a Response for rejection. Direct Web Request integrations and hosting still own request-time, rate, concurrency and decompression limits.

Code maintenance

• Unify the feature calculator and Smolter routing/data table rows around the same production Vite measurements. Optional features start unchecked; the default data selection matches the data row. Verify both frameworks against displayed table cells in the hosted-site browser check. Complete-entry bundles and competitor snapshots remain clearly labeled with their measurement methods.

• Replace cross-package source-path imports in tests and streaming fixtures with declared workspace exports. Move the Vite browser-boundary unit test into its owning package. Keep React and Preact entrypoints separate; no new public npm exports or dependencies.

v0.5.1

Stable release of the nested-layout and route-owned presentation work tested in 0.4.12-beta.1–beta.4, plus build-time removal of unused transition dispatch.

Routing and presentation

• Add optional React and Preact nested client routing through /react/nested and /preact/nested. Shared layouts retain state and focus; loaders, actions, fetchers, errors and shouldRevalidate belong to their route. router.revalidate({ route: id }) refreshes only the selected owner(s), while respecting their revalidation vetoes.
• Infer nested ownership from file routes. The generated virtual module selects nested routing only when actual parent/child route modules exist; flat applications do not include the nested engine. Nested SSR is not supported by this release.
• Keep loader-free parent layouts mounted while child loaders show their own HydrateFallback.
• Presentation compatibility: replace the previous NavigateOptions.viewTransition boolean (including stable 0.4.11) with a page or layout export, viewTransition(commit, previous, next). The destination page takes precedence over its nearest layout. Smolter does not start browser transitions or select animations. Consumers own browser support, reduced motion, CSS, image readiness and animation errors. Call commit() to apply the destination; stale/repeated commits are ignored. The callback return value is not awaited.
• Vite removes transition selection and lazy dispatch when analyzed file-route applications do not use them. Manual factories, opaque references and computed writes retain support conservatively. Builds without Smolter’s Vite plugin keep transition support. This does not remove route retention, recovery ownership or normal scroll restoration.
• Add real-scroll React/Preact regressions alongside the existing hash and preventScrollReset checks. Page-owned scroll animations should clean up in a layout effect before paint; passive cleanup can run after a router reset. No router workaround for consumer animation lifetimes is introduced.

Tooling and serving

• Preserve root/route response headers in SSR, including errors, while removing obsolete content length/encoding metadata.
• Harden example static asset serving against hidden files and symlink escapes.
• Remove the separate TypeScript 6 compiler alias; retain the TypeScript 7 analyzer introduced in beta.1. It uses TypeScript’s unstable build-only API and stays out of browser bundles.
• Publish catalog-resolved packages and centralize development dependencies. Keep competitor measurements as labeled documentation snapshots rather than installed router dependencies.
• Update guides, API references and generated size measurements. Reuse package builds in CI without weakening browser, package, coverage or size gates.

v0.4.12-beta.4

• Keep loader-free nested layouts mounted while children load, so child hydration skeletons are not hidden by an unrelated layout fallback. Preserve layout input and focus through settlement in React and Preact.
• Remove automatic document transitions and the viewTransition boolean options from both adapters. Consumers own presentation through a route-module viewTransition(commit, previous, next) export. The destination page wins, falling back to its nearest nested layout. The synchronous commit ignores stale and repeated calls; lazy file routes retain the export. Smolter no longer chooses animations, reduced-motion policy or component-based transition rules. Consumers using the boolean must move that policy into their own callback.

v0.4.12-beta.3

• Publish the pnpm-packed npm artifact so workspace catalog dependencies resolve to installable versions. Beta.2 incorrectly published typescript: "catalog:"; consumers should use beta.3. Runtime behavior is unchanged.

v0.4.12-beta.2

• Add optional React and Preact nested routing for client-only applications, using the existing data router. Preserve layout state and focus, scope forms/fetchers to their owning route, and support exclusive parent revalidation with per-layout shouldRevalidate vetoes.
• Infer parent/index/pathless relationships from flat route filenames in the application Vite plugin. Keep flat builds on their existing entrypoints and recognize nested Link imports in prefetch analysis.
• Preserve root and route HTTP response metadata during document rendering, including error response headers. Strip obsolete content lengths/encodings from rendered HTML.

v0.4.12-beta.1

• Harden both example SSR asset servers against hidden files and symlink escapes; add raw-HTTP traversal and Vite secret-file regression tests. The core SSR adapter dispatches routes and does not serve arbitrary files.
• Move package tests and framework development dependencies into their owning packages, with cross-package suites in a private integration-test workspace.
• Update development tools to current compatible stable releases and refresh comparison measurements for React Router 8.5.1, wouter 3.13.0 and wouter-preact 3.13.0.
• Replace the separate TypeScript 6 compiler alias with pinned TypeScript 7.0.2 native analysis. Retain typed prefetch selection, imported/JSDoc type tracking and HMR; close the compiler after each analysis. This explicitly uses TypeScript’s unstable API without adding compiler code to browser bundles.
• Remove installed competitor routers and retain versioned reference size measurements for the documentation site. Run size generation only for hosted docs, keep React Compiler tooling in the React examples, centralize development versions and declare internal adapter renderers as peers. Preserve browser runtime dependencies and size gates.

v0.4.11

• Update the documentation site, examples and development validation to Preact 11.1.1 and preact-render-to-string 6.8.2. Update JSR dependency imports to the same versions.
• Validate packed consumers against both the existing minimum Preact 11.0.1 / renderer 6.8.1 and the new versions. npm peer minimums and public APIs remain unchanged; npm consumers select their Preact versions independently.

v0.4.10

• Inspect directly imported JSX links before expensive prefetch type inference. When those links already require every capability, skip the remaining expression analysis; otherwise retain the complete alias, wrapper and dynamic-spread checks. Continue watching all source dependencies for HMR. This build-only optimization changes no public API or browser runtime.
• Avoid parsing documentation-only TypeScript comments and enumerating discarded tsconfig include lists during prefetch analysis. Preserve JavaScript JSDoc types, inherited compiler options, the complete type graph and watched dependencies. Add regressions for JSDoc imports and dynamically supplied Link components.

v0.4.9

• Reduce prefetch capability analysis work during Vite builds. Reject irrelevant syntax before requesting TypeScript types and stop semantic traversal once every capability must be retained, while continuing to track source dependencies for HMR. Preserve aliased components, typed spreads and conservative handling of dynamic usage.
• Add React/Preact regressions for resolved aliases, re-exports, typed wrappers and later watched dependencies, plus development capability updates when source files are added or removed. Public APIs, browser bundles and application configuration are unchanged.