npm / bundlewatch
bundlewatch
What changed in bundlewatch 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
10 breaking3 security6 new APIs and options3 behavior and defaults14 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initbundlewatch 136 changes
Breaking changes 10
Self-hosted services must return
{ "baselinePrefix": 1 }before prefixed clients can run; clients stop if support cannot be confirmed and never fall back to an unprefixed baseline.Deep imports into bundlewatch/lib no longer work, except for lib/app.
ci.trackBranches replaces its defaults instead of merging with them index by index.
files replaces its defaults instead of merging with them index by index.
Proxy variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY are no longer read.
Numeric maxSize values are now enforced; 0 still means no limit.
BundleWatch 1.0 requires Node.js 22.17 or later, including in CI.
For users migrating from 0.3.x, the first 1.0 run reports files previously saved under an empty name as new until a tracked branch saves a new baseline.
Pull request builds no longer save baselines, preventing a fork's master from overwriting the repository's baseline; branch builds still save.
The service is introducing stricter authorization for saving baselines and creating short links: public-repository tokens must belong to a user with push access or be an installation token for that repository.
Security 3
Basic Auth credentials in bundlewatchServiceHost URLs continue to work and are omitted from results links, CI logs, and GitHub statuses.
Results pages escape every value and allow no scripts.
The setup page checks an OAuth state and recommends a fine-grained token.
New APIs and options 6
An optional top-level prefix gives each application its own GitHub statuses and baseline history. Prefixes must be 1–64 lowercase ASCII letters, digits, hyphens, or underscores, starting with a letter or digit.
BundleWatch discovers supported config files automatically, searching upward to the nearest package.json; a discovered config takes precedence over the package.json bundlewatch key.
Adds a service endpoint that renders a short results link.
On GitHub Enterprise Server, commit statuses are sent to GITHUB_API_URL; comparisons require a self-hosted service because service.bundlewatch.io only accepts github.com tokens.
Adds a service endpoint that creates a short results link.
Adds a flag that prints the version.
Behavior and default changes 3
Newly generated short-link IDs are 22 characters; existing result links continue to work.
Defaults to master, main, and develop, plus the repository's default branch on GitHub Actions.
TypeScript configuration files load natively on Node.js 22.18 and later.
Fixes and other changes 14
Results pages stay steady when file sections are toggled.
Runs with missing or unreadable files no longer send a baseline and log the reason.
The service writes baselines before sending the response, preventing a write from being lost when the Lambda freezes.
The 0.x entry point bundlewatch/lib/app continues to work.
The 0.x entry point lib/bin/index.js continues to work.
Setting bundlewatchServiceHost to null prints no results link, and the Node.js API returns url: undefined.
Empty files with compression set to none measure 0 B instead of failing with Could not read file.
The --config flag accepts absolute paths.
When CI is set but CI_REPO_OWNER and CI_REPO_NAME are missing, the repository is read from GIT_URL.
Failing files with paths sharing the same final 37 characters no longer share a status; the second gets a (2) suffix.
Malformed results links return 400, GitHub failures return 503, and baselines too large to store return 413.
Removed files named after Object.prototype properties show as removed, and a file named __proto__ is measured instead of dropped.
Service results links now render for files without maxSize, and accept size strings such as 100KB sent by 0.x CLIs for numeric maxSize values.
Descriptions exceeding GitHub's 140-character limit are truncated instead of leaving the status pending.