v1.10.0

1.10.0 (2026-10-07)

Features

• grants: set share passwords at mint and return result_id on recovery (#139) (c2f9d31)
• sites: publish complete site updates atomically (#145) (cef60de)

Operator

• D1: Apply 0023_upload_grant_passwords.sql and 0024_site_deployments.sql before deploying this release.
• wrangler.example.toml: New optional limits are MAX_ZIP_IMPORT_BYTES (100 MiB), MAX_ZIP_EXTRACTED_BYTES (500 MiB), and MAX_ZIP_EXPORT_BYTES (25 MiB). An explicitly set legacy MAX_ZIP_BYTES remains the fallback for unset ZIP limits. The single-file default remains 100 MiB and the platform quota remains 20 GiB. Staged uploads, retained versions, and pending cleanup count toward quota; budget room for both site versions plus archive input and extracted output.
• Rollout: Set [cache].cross_version_cache = false. Keep SITE_VERSIONING_ENABLED unset while deploying the new Worker to 100% of traffic; drain old writer invocations and purge or wait out old public site cache entries, including independent cache rules. Then set [vars].SITE_VERSIONING_ENABLED = "true" to enable legacy conversion. Nonempty legacy sites remain readable but their writes return retryable site_busy during the bridge phase. Monitor conversion progress in admin Health.
• Large ZIPs: The advertised upper limits were verified on Workers Paid with limits.cpu_ms = 30000; Workers Free did not pass large-ZIP qualification. Hosting ingress limits still apply. See atomic deployment rollout and qualification before enabling conversion or large ZIP publishing.
• Plugin: Regenerate after merging the release into a deployment repository; plugin versions follow version.txt (1.10.0).
• Rollback floor: Once any site uses immutable versions, retain a version-aware Worker and use a forward fix. An old mutable-layout Worker would serve stale bytes. Disabling the conversion flag does not undo published versions.