# What changed in bundlewatch

> 36 changes in bundlewatch 1 from its official release notes, upgrade guides and advisories: 10 breaking, 3 security, 6 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/bundlewatch/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## bundlewatch 1

### Breaking changes

- Self-hosted services must return `{ "baselinePrefix": 1 }` before prefixed clients can run; clients stop if support cannot be confirmed and never fall back to an unprefixed baseline. (1.1.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.1.0)
- Deep imports into bundlewatch/lib no longer work, except for lib/app. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- ci.trackBranches replaces its defaults instead of merging with them index by index. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- files replaces its defaults instead of merging with them index by index. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Proxy variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY are no longer read. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Numeric maxSize values are now enforced; 0 still means no limit. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- BundleWatch 1.0 requires Node.js 22.17 or later, including in CI. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- For users migrating from 0.3.x, the first 1.0 run reports files previously saved under an empty name as new until a tracked branch saves a new baseline. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Pull request builds no longer save baselines, preventing a fork's master from overwriting the repository's baseline; branch builds still save. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- The service is introducing stricter authorization for saving baselines and creating short links: public-repository tokens must belong to a user with push access or be an installation token for that repository. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)

### Security

- Basic Auth credentials in bundlewatchServiceHost URLs continue to work and are omitted from results links, CI logs, and GitHub statuses. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Results pages escape every value and allow no scripts. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- The setup page checks an OAuth state and recommends a fine-grained token. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)

### New APIs and options

- An optional top-level prefix gives each application its own GitHub statuses and baseline history. Prefixes must be 1–64 lowercase ASCII letters, digits, hyphens, or underscores, starting with a letter or digit. (1.1.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.1.0)
- BundleWatch discovers supported config files automatically, searching upward to the nearest package.json; a discovered config takes precedence over the package.json bundlewatch key. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Adds a service endpoint that renders a short results link. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- On GitHub Enterprise Server, commit statuses are sent to GITHUB_API_URL; comparisons require a self-hosted service because service.bundlewatch.io only accepts github.com tokens. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Adds a service endpoint that creates a short results link. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Adds a flag that prints the version. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)

### Behavior and default changes

- Newly generated short-link IDs are 22 characters; existing result links continue to work. (1.1.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.1.0)
- Defaults to master, main, and develop, plus the repository's default branch on GitHub Actions. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- TypeScript configuration files load natively on Node.js 22.18 and later. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)

### Fixes and other changes

- Results pages stay steady when file sections are toggled. (1.1.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.1.0)
- Runs with missing or unreadable files no longer send a baseline and log the reason. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- The service writes baselines before sending the response, preventing a write from being lost when the Lambda freezes. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- The 0.x entry point bundlewatch/lib/app continues to work. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- The 0.x entry point lib/bin/index.js continues to work. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Setting bundlewatchServiceHost to null prints no results link, and the Node.js API returns url: undefined. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Empty files with compression set to none measure 0 B instead of failing with Could not read file. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- The --config flag accepts absolute paths. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- When CI is set but CI_REPO_OWNER and CI_REPO_NAME are missing, the repository is read from GIT_URL. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Failing files with paths sharing the same final 37 characters no longer share a status; the second gets a (2) suffix. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Malformed results links return 400, GitHub failures return 503, and baselines too large to store return 413. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Removed files named after Object.prototype properties show as removed, and a file named __proto__ is measured instead of dropped. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Service results links now render for files without maxSize, and accept size strings such as 100KB sent by 0.x CLIs for numeric maxSize values. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)
- Descriptions exceeding GitHub's 140-character limit are truncated instead of leaving the status pending. (1.0.0) — [release notes](https://github.com/bundlewatch/bundlewatch/releases/tag/v1.0.0)