v0.136.0

Fixes

• Server-side queries (Query.prefetch, Query.instant, and useQuery calls discovered during SSR) now run the api route's own middleware before its handler, as the browser's fetch of the same url does (#934, #935). Before, a handler that read req.state set by its middleware threw MissingRequestStateError, and an api route guarded only by its own middleware (auth, ownership checks) was answered unguarded when a view queried it server-side.

Upgrade notes (behaviour change)

• An api route's middleware now also runs for server-side queries. A rate limit on an api route counts SSR prefetches, and middleware that hits the database (ownership checks) does one more read per prefetch.
• If a middleware refuses (e.g. a 403), the server-side query fails with the same status the browser's request would get, so the view's query error handling applies.