# What changed in @hocuspocus/provider > 42 changes in @hocuspocus/provider 3 to 4 from its official release notes, upgrade guides and advisories: 6 breaking, 1 security, 10 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@hocuspocus/provider/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## @hocuspocus/provider 4 ### Breaking changes - When beforeHandleMessage throws, other messages that were already queued are no longer processed. (4.5.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.5.0) - The CloseEvent passed to onClose callbacks now contains only code and reason; target and type are no longer available. (4.0.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.0.0) - attach() now throws an error when attaching two authenticated providers with the same effective name instead of silently overwriting the existing provider. (4.0.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.0.0) - The provider no longer imports or re-exports Event, MessageEvent, or CloseEvent from ws; TypeScript users relying on those types should import from @hocuspocus/common or use web-standard types. (4.0.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.0.0) ### Security - Enforces resource limits before authentication to safeguard server stability. (4.3.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.3.0) ### New APIs and options - Adds an option for batching updates to reduce websocket traffic during heavy editing. (4.4.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.4.0) - Adds consistent state synchronization across Redis instances. (4.4.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.4.0) - Adds a hook that runs after message handling completes. (4.3.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.3.0) - Adds the unloadImmediately option to configure document persistence behavior when disconnect() is called. (4.2.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.2.0) - Exposes sessionAwareness in provider-react HocuspocusRoom. (4.1.1) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.1.1) - Adds the beforeHandleAwareness hook for handling awareness updates. (4.1.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.1.0) - Adds application-level Ping (9) and Pong (10) message types; the provider responds to server Ping messages with Pong, replacing WebSocket-level ping/pong. (4.0.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.0.0) - Adds an opt-in that embeds a unique sessionId in message document names, allowing multiple providers with the same document name on one WebSocket; it defaults to false for v3 compatibility. (4.0.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.0.0) ### Performance - extension-redis now delays forwarding messages to Redis with setImmediate, improving performance when many users are connected to the same document. (4.6.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.6.0) ### Behavior and default changes - Updates are batched before being sent to clients. (4.5.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.5.0) - The provider sends its package version in the authentication message; v3 servers safely ignore the extra field. (4.0.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.0.0) - Unknown message types now log console.error instead of throwing, allowing future protocol additions without crashing the provider. (4.0.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.0.0) ### Fixes and other changes - Batched changes are sent when the page is hidden. (4.7.1) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.7.1) - A pending reconnect is canceled when disconnect() or destroy() is called. (4.7.1) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.7.1) - The retry cancel handle is kept until the connection attempt resolves. (4.7.1) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.7.1) - Emits maxAttemptsFailed instead of an unhandled rejection when attempts fail. (4.7.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.7.0) - Redis sync replies are published only to the requester. (4.7.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.7.0) - Messages are ignored in awarenessUpdateHandler when origin is this. (4.5.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.5.0) - Allows binding the server to a specific address. (4.4.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.4.0) - Ensures server.destroy() only runs once. (4.4.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.4.0) - Deletes the debouncer timer entry before awaiting the in-flight execution. (4.1.2) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.1.2) - Fixes client-initiated broadcastStateless. (4.1.1) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.1.1) - Scratch Awareness objects in MessageReceiver are destroyed to fix a memory leak. (4.1.1) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.1.1) - Wraps awareness origin as TransactionOrigin. (4.1.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.1.0) - When the WebSocket is not yet open and messages are queued, duplicate awareness messages for the same document are deduplicated, keeping only the latest one. (4.0.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v4.0.0) ## @hocuspocus/provider 3 ### Breaking changes - Tightens the types for authorizedScope. (3.4.4) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.4.4) - beforeSync is no longer awaited, to avoid breaking message order. (3.4.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.4.0) ### New APIs and options - A document now exposes lastChangeTime, which can be used to identify when it last had changes. (3.4.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.4.0) - Adds a hook for re-syncing auth tokens. (3.3.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.3.0) ### Behavior and default changes - Redis unloading logic was rewritten to utilize before/after-unload hooks. (3.2.6) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.2.6) ### Fixes and other changes - Fixes websocket URLs ending with / so they work. (3.4.4) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.4.4) - Fixes a memory leak under high load. (3.4.2) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.4.2) - Prevents a crash related to awareness in extension-redis. (3.4.1) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.4.1) - Fixes a memory leak in onStoreDocument in extension-redis. (3.4.1) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.4.1) - Debounce now prevents a storeDocumentHook from running concurrently, even when a new debounced function starts before the previous one finishes. (3.4.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.4.0) - Fixes timing issues when multiple users leave the same document together. (3.3.0) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.3.0) - The onUpdate listener is bound before afterLoadDocument is called, so document changes can trigger storeDocumentHooks. (3.2.6) — [release notes](https://github.com/ueberdosis/hocuspocus/releases/tag/v3.2.6)