Sourced from @​radix-ui/react-checkbox's changelog.

1.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

• See full diff in compare view

Sourced from @​radix-ui/react-dialog's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

• See full diff in compare view

Sourced from @​radix-ui/react-label's changelog.

2.1.17

• Updated dependencies: @radix-ui/react-primitive@2.2.0

• See full diff in compare view

Sourced from @​radix-ui/react-popover's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed aria-controls being set on Popover.Trigger while the popover is closed.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

• See full diff in compare view

Sourced from @​radix-ui/react-select's changelog.

2.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

2.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Fixed content alignment when all items are disabled.
• Fixed a bug where updating a Select value programmatically while inside a <form> would dispatch a click event from the hidden bubble select that propagated to ancestor onClick handlers.
• Fixed a bug resulting from incorrect tree-shaking in SWC-minified code.
• Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-use-callback-ref@1.1.5, @radix-ui/react-visually-hidden@1.2.13

• See full diff in compare view

Sourced from @​radix-ui/react-separator's changelog.

1.2.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/react-primitive@2.2.0

• See full diff in compare view

Sourced from @​radix-ui/react-slider's changelog.

1.6.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.6.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Fixed a bug where updating a Slider value programmatically inside a <form> would dispatch an input event that propagated to ancestor onInput handlers.
• Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

• See full diff in compare view

Sourced from @​radix-ui/react-slot's changelog.

1.5.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

• See full diff in compare view

Sourced from @​radix-ui/react-switch's changelog.

1.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

• See full diff in compare view

Sourced from @​radix-ui/react-tooltip's changelog.

1.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-visually-hidden@1.2.13

• See full diff in compare view

Sourced from @​tanstack/react-table's releases.

@​tanstack/react-table-devtools@​9.3.1

Patch Changes

• Updated dependencies [87c6bcc]:
  • @​tanstack/table-devtools@​9.3.1

@​tanstack/react-table@​9.3.1

Patch Changes

• #6631 3d3648f - Refresh the AppTable context when the useAppTable owner renders with new options or state, so useTableContext() consumers no longer show stale rows after data is replaced under a cached (React Compiler, useMemo, memo) AppTable element.
• Updated dependencies [2d5f5b6, 87c6bcc]:
  • @​tanstack/table-core@​9.3.1

Sourced from @​tanstack/react-table's changelog.

9.3.1

Patch Changes

• #6631 3d3648f - Refresh the AppTable context when the useAppTable owner renders with new options or state, so useTableContext() consumers no longer show stale rows after data is replaced under a cached (React Compiler, useMemo, memo) AppTable element.
• Updated dependencies [2d5f5b6, 87c6bcc]:
  • @​tanstack/table-core@​9.3.1

• 95c4768 ci: Version Packages (#6632)
• 3d3648f fix(react-table, preact-table): refresh AppTable context under cached element...
• See full diff in compare view

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Sourced from @​aws-sdk/client-s3's releases.

v3.1152.0

3.1152.0(2026-10-14)

Documentation Changes

• client-marketplace-metering: Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change. (c97db282)

New Features

• clients: update client endpoints as of 2026-10-14 (91a8a07c)
• client-imagebuilder: This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends. (e8a5e26b)
• client-cloudfront: This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections. (6bae6413)
• client-transfer: AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover. (9d0e8866)
• client-dynamodb-streams: Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream. (150e6ae3)
• client-ec2: Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards (65c6056b)
• client-arc-region-switch: Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block (d21aa72b)
• client-organizations: With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes. (9324745e)
• client-bedrock-agentcore-control: This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field. (30c5bca2)
• client-lambda: AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span. (08219be0)
• client-guardduty: Releasing support for Custom Detection Rule Runtime Monitoring (0cb32b8f)
• lib-transfer-manager: publish as a preview package (#8355) (41080929)

---

For list of updated packages, view updated-packages.md in assets-3.1152.0.zip

v3.1151.0

3.1151.0(2026-10-13)

Chores

• lib-transfer-manager: move lib-transfer-manager to preview/ folder (#8351) (5037a006)
• scripts: add preview/ folder to build tooling (#8350) (a922905a)

Documentation Changes

• client-lambda-web: Documentation update to include common use cases. (643507a0)

New Features

• clients: update client endpoints as of 2026-10-13 (d3994582)
• client-lakeformation: Added new LakeFormation APIs and documentation updates for Simple Row-level Security (RLS). (c7a586fc)
• client-agent-registry-control: AWS Agent Registry is improving recently launched custom metadata schema feature to make shared attributes easier to manage. (ed00d0bb)
• client-omics: With Expanded container registry support, you can use container images from registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry with AWS HealthOmics private workflows, without manually migrating images into Amazon ECR or editing your workflow definitions. (db382740)
• client-route-53-domains: Route 53 Domains now supports premium domains. This release adds consent objects to operations on premium domains and a new GetDomainPrices API. Also, the Flags and PublicKey fields were deprecated from the DnssecKey response. (c5cc6f50)
• client-gamelift: Adds support for new instance types in the C8a, C8i, C9g, M8a, M8i, and M9g families for managed EC2 and container fleets (51456772)
• client-appstream: Adds support for administrators to require users to re-authenticate OneDrive and Google Drive storage connectors when a streaming session is reused. (2b6f2af5)
• client-connect: New APIs to support aliases and versions for ContactFlow. (39466baa)
• client-appintegrations: This release adds the Connect JWT authentication type and the AudienceOverride field to AuthConfig, letting A2A server applications authenticate with JWTs issued by Amazon Connect. (3b212b20)

... (truncated)

Sourced from @​aws-sdk/client-s3's changelog.

3.1152.0 (2026-10-14)

Note: Version bump only for package @​aws-sdk/client-s3

3.1151.0 (2026-10-13)

Note: Version bump only for package @​aws-sdk/client-s3

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/client-s3

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/client-s3

• 3ce8aa7 Publish v3.1152.0
• d6adfcb Publish v3.1151.0
• 4c9a334 Publish v3.1150.0
• a960c14 Publish v3.1149.0
• 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
• See full diff in compare view

Sourced from @​aws-sdk/client-ses's releases.

v3.1152.0

3.1152.0(2026-10-14)

Documentation Changes

• client-marketplace-metering: Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change. (c97db282)

New Features

• clients: update client endpoints as of 2026-10-14 (91a8a07c)
• client-imagebuilder: This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends. (e8a5e26b)
• client-cloudfront: This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections. (6bae6413)
• client-transfer: AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover. (9d0e8866)
• client-dynamodb-streams: Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream. (150e6ae3)
• client-ec2: Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards (65c6056b)
• client-arc-region-switch: Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block (d21aa72b)
• client-organizations: With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes. (9324745e)
• client-bedrock-agentcore-control: This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field. (30c5bca2)
• client-lambda: AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span. (08219be0)
• client-guardduty: Releasing support for Custom Detection Rule Runtime Monitoring (0cb32b8f)
• lib-transfer-manager: publish as a preview package (#8355) (41080929)

---

For list of updated packages, view updated-packages.md in assets-3.1152.0.zip

v3.1151.0

3.1151.0(2026-10-13)

Chores

• lib-transfer-manager: move lib-transfer-manager to preview/ folder (#8351) (5037a006)
• scripts: add preview/ folder to build tooling (#8350) (a922905a)

Documentation Changes

• client-lambda-web: Documentation update to include common use cases. (643507a0)

New Features

• clients: update client endpoints as of 2026-10-13 (d3994582)
• client-lakeformation: Added new LakeFormation APIs and documentation updates for Simple Row-level Security (RLS). (c7a586fc)
• client-agent-registry-control: AWS Agent Registry is improving recently launched custom metadata schema feature to make shared attributes easier to manage. (ed00d0bb)
• client-omics: With Expanded container registry support, you can use container images from registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry with AWS HealthOmics private workflows, without manually migrating images into Amazon ECR or editing your workflow definitions. (db382740)
• client-route-53-domains: Route 53 Domains now supports premium domains. This release adds consent objects to operations on premium domains and a new GetDomainPrices API. Also, the Flags and PublicKey fields were deprecated from the DnssecKey response. (c5cc6f50)
• client-gamelift: Adds support for new instance types in the C8a, C8i, C9g, M8a, M8i, and M9g families for managed EC2 and container fleets (51456772)
• client-appstream: Adds support for administrators to require users to re-authenticate OneDrive and Google Drive storage connectors when a streaming session is reused. (2b6f2af5)
• client-connect: New APIs to support aliases and versions for ContactFlow. (39466baa)
• client-appintegrations: This release adds the Connect JWT authentication type and the AudienceOverride field to AuthConfig, letting A2A server applications authenticate with JWTs issued by Amazon Connect. (3b212b20)

... (truncated)

Sourced from @​aws-sdk/client-ses's changelog.

3.1152.0 (2026-10-14)

Note: Version bump only for package @​aws-sdk/client-ses

3.1151.0 (2026-10-13)

Note: Version bump only for package @​aws-sdk/client-ses

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/client-ses

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/client-ses

• 3ce8aa7 Publish v3.1152.0
• d6adfcb Publish v3.1151.0
• 4c9a334 Publish v3.1150.0
• a960c14 Publish v3.1149.0
• 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
• See full diff in compare view

Sourced from @​clickhouse/client's releases.

client-1.24.1

Bug fixes

• Fixed a socket hang up error on a request that took over a socket released by an earlier request, when another request queued for that socket was aborted in between. The orphaned idle-socket timer from the earlier release destroyed the socket idle_socket_ttl later, mid-request (Node.js only) (#1040). (#1041)

#1040: ClickHouse/clickhouse-js#1040 #1041: ClickHouse/clickhouse-js#1041

• 6a265d2 Merge pull request #1044 from ClickHouse/main
• 6750ed4 fix: unblock the 1.24.1 release PR CI (#1045)
• 938b720 chore: bump @​clickhouse/client version to 1.24.1 (#1043)
• c2d69e7 fix(client-node): stop an aborted waiting request from destroying a socket in...
• cbaf09b chore(deps): bump sharp from 0.34.5 to 0.35.5 in /demo/logs (#1039)
• caf5859 chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /examples/node (#1...
• 5350609 chore(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 in /examples/node...
• f3d5c8f chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /skills/clickhouse...
• c32237e ci: roll ClickHouse version matrix to 26.9, 26.8, 26.7, 26.3 (#1003)
• 7c01e77 chore(deps-dev): bump the dev-dependencies group across 1 directory with 15 u...
• Additional commits viewable in compare view

Sourced from @​graphql-tools/merge's changelog.

9.2.8

Patch Changes

• #8445 82457d1 Thanks @​ardatan! - dependencies updates:

  • Updated dependency @graphql-tools/utils@^12.0.4 ↗︎ (from ^12.0.3, in dependencies)

• #8445 82457d1 Thanks @​ardatan! - Fix: Preserve symbol-keyed GraphQL extensions when building, merging, or extracting schemas.

  GraphQL.js v17 allows string | symbol keys on schema/type/field extensions (via toObjMapWithSymbols). @graphql-tools was dropping those symbol keys in two places:

  1. mergeDeep only walked enumerable string keys (for...in), so symbol extensions were lost when applying schemaExtensions.
  2. extractExtensionsFromSchema did not copy non-enumerable own symbol keys (enumerable symbols already survive object rest/spread; the explicit loop covers the non-enumerable case).

  Example (bug)

  import { makeExecutableSchema } from '@graphql-tools/schema'
  const META = Symbol('META')
  const schema = makeExecutableSchema({
  typeDefs: /* GraphQL */ type Query { hello: String },
  schemaExtensions: {
  schemaExtensions: {
  [META]: { source: 'app' },
  tagged: true,
  },
  types: {},
  },
  })
  // Before: only string keys survived
  // schema.extensions === { tagged: true }
  // After: symbol keys are preserved
  // schema.extensions[META] === { source: 'app' }
  // schema.extensions.tagged === true
  

  Schema extension merge/extract and resolver merging always enable { enumerable: true, nonEnumerable: true } so symbol keys survive in tools' own merge/extract paths on every supported GraphQL.js major. (GraphQL.js itself may still drop symbol keys from field configs below v17 when rebuilding types.)

  mergeDeep API

  mergeDeep now accepts an options object. The old positional boolean arguments still work but are deprecated.

... (truncated)

• 3634233 chore(release): update monorepo packages versions (#8505)
• 82457d1 fix: preserve symbol-keyed schema extensions (#8445)
• 691cbd7 build(deps): bump the actions-deps group across 1 directory with 16 updates (...
• 28d08e8 chore(release): update monorepo packages versions (#8486)
• a73dd1d build(deps-dev): bump the actions-deps group across 1 directory with 3 update...
• See full diff in compare view

Sourced from @​graphql-tools/schema's changelog.

10.1.5

Patch Changes

• #8445 82457d1 Thanks @​ardatan! - dependencies updates:

  • Updated dependency @graphql-tools/merge@^9.2.7 ↗︎ (from ^9.2.6, in dependencies)
  • Updated dependency @graphql-tools/utils@^12.0.4 ↗︎ (from ^12.0.3, in dependencies)

• #8445 82457d1 Thanks @​ardatan! - Fix: Preserve symbol-keyed GraphQL extensions when building, merging, or extracting schemas.

  GraphQL.js v17 allows string | symbol keys on schema/type/field extensions (via toObjMapWithSymbols). @graphql-tools was dropping those symbol keys in two places:

  1. mergeDeep only walked enumerable string keys (for...in), so symbol extensions were lost when applying schemaExtensions.
  2. extractExtensionsFromSchema did not copy non-enumerable own symbol keys (enumerable symbols already survive object rest/spread; the explicit loop covers the non-enumerable case).

  Example (bug)

  import { makeExecutableSchema } from '@graphql-tools/schema'
  const META = Symbol('META')
  const schema = makeExecutableSchema({
  typeDefs: /* GraphQL */ type Query { hello: String },
  schemaExtensions: {
  schemaExtensions: {
  [META]: { source: 'app' },
  tagged: true,
  },
  types: {},
  },
  })
  // Before: only string keys survived
  // schema.extensions === { tagged: true }
  // After: symbol keys are preserved
  // schema.extensions[META] === { source: 'app' }
  // schema.extensions.tagged === true
  

  Schema extension merge/extract and resolver merging always enable { enumerable: true, nonEnumerable: true } so symbol keys survive in tools' own merge/extract paths on every supported GraphQL.js major. (GraphQL.js itself may still drop symbol keys from field configs below v17 when rebuilding types.)

  mergeDeep API

  mergeDeep now accepts an options object. The old positional boolean arguments still work but are deprecated.

... (truncated)

• 3634233 chore(release): update monorepo packages versions (#8505)
• 82457d1 fix: preserve symbol-keyed schema extensions (#8445)
• 28d08e8 chore(release): update monorepo packages versions (#8486)
• See full diff in compare view

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });
  

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected
  

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8
  

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html
  

... (truncated)

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });
  

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

Description has been truncated