# What changed in elysia

> 25 changes in elysia 1 from its official release notes, upgrade guides and advisories: 2 breaking, 6 security, 4 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/elysia/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## elysia 1

### Breaking changes

- Removes the Bun-specific build. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- The response encode path throws ValidationError instead of returning a boolean. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)

### Security

- This release lists security advisories; 1.4.x will only publish security updates. (1.4.30) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.30)
- elysia has Inefficient Algorithmic Complexity and Interpretation Conflict (1.4.29) — [security advisory](https://github.com/advisories/GHSA-9643-4QGH-G8MX)
- Elysia Cookie Value Prototype Pollution (1.4.27) — [security advisory](https://github.com/advisories/GHSA-8HQ9-PHH3-P2WP)
- Elysia has a string URL format ReDoS (1.4.26) — [security advisory](https://github.com/advisories/GHSA-F45G-68Q3-5W8X)
- Elysia affected by arbitrary code injection through cookie config (1.4.18) — [security advisory](https://github.com/advisories/GHSA-8VCH-M3F4-Q8JF)
- Elysia vulnerable to prototype pollution with multiple standalone schema validation (1.4.17) — [security advisory](https://github.com/advisories/GHSA-HXJ9-33PP-J2CC)

### New APIs and options

- Exports AnySchema from the root. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Exports ElysiaTypeCustomErrors. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Exports ModelsToTypes from the root. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Exports UnwrapSchema from the root. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)

### Performance

- Multipart form data normalization uses .get instead of .getAll for faster performance. (1.4.29) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.29)
- Addresses a performance blow-up when handling a direct ReadableStream. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)

### Behavior and default changes

- App cookie configuration is merged into route cookie validator configuration. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Stream responses use pull-based backpressure. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)

### Fixes and other changes

- Fixes breakage of Bun HTML imports. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- The cookie schema is used for the cookie noValidate check. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- The transformed cookie value is written directly to the cookie entry. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Custom parsers are checked by their full name. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Dynamic imports inside .guard now register routes. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Detects an HTML bundle when an inline response is a Promise. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Mapped error response promises are awaited. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- File and blob responses handle the range header. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)
- Headers are set conditionally for String and Object responses when set.headers is absent. (1.4.28) — [release notes](https://github.com/elysiajs/elysia/releases/tag/1.4.28)