unstale

npm / @whatwg-node/server

@whatwg-node/server

What changed in @whatwg-node/server 0.11 to 0.13, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

5 breaking1 security3 new APIs and options1 behavior and defaults4 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.1 on npm

@whatwg-node/server 0.131 changes

Breaking changes 1

  • crypto is no longer exported from @whatwg-node/fetch, createFetch, or FetchAPI; use globalThis.crypto instead.

    0.13.0release notes

@whatwg-node/server 0.1211 changes

Breaking changes 4

  • When the request Origin is not in the allowlist, the server omits this header instead of sending the string null.

    0.12.0release notes

  • All published packages now declare Node.js >=22.15.0; Node.js 18 and 20 are no longer supported.

    0.12.0release notes

  • The deprecated adapter method was removed; use handleNodeRequestAndResponse, passing the Node response as the second argument.

    0.12.0release notes

  • Use this method in place of handleNodeRequest; it receives the Node response as well as the request and returns a WHATWG Response without writing it to res.

    0.12.0release notes

Security 1

  • Adds a plugin that rejects oversized bodies using Content-Length and a byte-counting TransformStream; place it after useContentEncoding when limiting decoded bytes.

    0.12.0release notes

New APIs and options 2

  • Request handlers receive the active fetchAPI as a third argument, keeping Request, Response, and stream constructors compatible with native requests and custom fetch implementations.

    0.12.0release notes

  • An optional custom responseFromError callback customizes the early-reject Response.

    0.12.0release notes

Behavior and default changes 1

  • Custom error handlers receive the resolved fetchAPI so they can construct responses using the correct runtime primitives.

    0.12.0release notes

Fixes and other changes 3

  • Values in Accept-Encoding and Content-Encoding header lists are trimmed, allowing encodings after commas to match and response compression to work.

    0.12.0release notes

  • The Node response is destroyed when its response body stream errors or is aborted, so piped sockets close rather than hang.

    0.12.0release notes

  • Unread Node and uWS request bodies are discarded when responding, preventing stalled keep-alive connections and large rejected uploads from being buffered.

    0.12.0release notes

@whatwg-node/server 0.112 changes

New APIs and options 1

  • Adds a plugin that enforces per-request timeouts by aborting the request signal and returning a custom response when the handler exceeds the configured timeout.

    0.11.0release notes

Fixes and other changes 1

  • Fixes a duplicate transfer-encoding: chunked header when streaming with uWebSockets.js, which could break strict load balancers.

    0.11.0release notes