npm / elysia
elysia
What changed in elysia 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
2 breaking6 security4 new APIs and options2 performance2 behavior and defaults9 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initelysia 125 changes
Breaking changes 2
Removes the Bun-specific build.
The response encode path throws ValidationError instead of returning a boolean.
Security 6
This release lists security advisories; 1.4.x will only publish security updates.
elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
Elysia Cookie Value Prototype Pollution
Elysia has a string URL format ReDoS
Elysia affected by arbitrary code injection through cookie config
Elysia vulnerable to prototype pollution with multiple standalone schema validation
New APIs and options 4
Exports AnySchema from the root.
Exports ElysiaTypeCustomErrors.
Exports ModelsToTypes from the root.
Exports UnwrapSchema from the root.
Performance 2
Multipart form data normalization uses .get instead of .getAll for faster performance.
Addresses a performance blow-up when handling a direct ReadableStream.
Behavior and default changes 2
App cookie configuration is merged into route cookie validator configuration.
Stream responses use pull-based backpressure.
Fixes and other changes 9
Fixes breakage of Bun HTML imports.
The cookie schema is used for the cookie noValidate check.
The transformed cookie value is written directly to the cookie entry.
Custom parsers are checked by their full name.
Dynamic imports inside .guard now register routes.
Detects an HTML bundle when an inline response is a Promise.
Mapped error response promises are awaited.
File and blob responses handle the range header.
Headers are set conditionally for String and Object responses when set.headers is absent.