unstale

npm / nitropack

nitropack

What changed in nitropack 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

4 security3 new APIs and options7 behavior and defaults1 tooling17 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.1 on npm

nitropack 232 changes

Security 4

  • The Vercel skew protection cookie uses SameSite=Lax.

    2.13.5release notes

  • Nitro has a proxy scope bypass via percent-encoded path traversal in routeRules

    2.13.4security advisory

  • Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

    2.13.4security advisoryrelease notes

  • Proxy route rules reject out-of-scope requests, addressing a medium-severity vulnerability.

    2.13.4release notes

New APIs and options 3

  • The Bun preset uses the hostname option for Bun.serve.

    2.13.5release notes

  • The dev worker can listen on a Unix socket or named pipe.

    2.13.5release notes

  • The Vercel build output config includes framework information.

    2.13.5release notes

Behavior and default changes 7

  • The Cloudflare preset warns only about conflicting asset overrides.

    2.13.5release notes

  • Auto-import paths are emitted as files rather than directories.

    2.13.5release notes

  • The AWS Amplify preset supports Node.js 22 and 24 runtimes.

    2.13.5release notes

  • The Cloudflare preset prefers source paths rather than #imports.

    2.13.5release notes

  • The Cloudflare preset guards the nodejs_compat flag by compatibility date.

    2.13.5release notes

  • Node and Deno presets support PORT=0 for random port assignment.

    2.13.5release notes

  • The Vercel preset supports Node.js 24.

    2.13.5release notes

Tooling 1

  • RollupConfig.plugins accepts rolldown-typed plugins.

    2.13.5release notes

Fixes and other changes 17

  • Vercel ISR enables passQuery when allowQuery is set.

    2.13.5release notes

  • WebSocket upgrades are proxied for devProxy routes configured with ws.

    2.13.5release notes

  • String rules match Windows IDs, and resolved paths are normalized on Windows.

    2.13.5release notes

  • Import attributes are preserved in the build output.

    2.13.5release notes

  • The Bun preset supports setting NITRO_BUN_IDLE_TIMEOUT to 0.

    2.13.5release notes

  • The Cloudflare preset detects implicit nodejs_compat when deployConfig is false.

    2.13.5release notes

  • OpenAPI filtering removes undefined values only from array nodes.

    2.13.5release notes

  • Prerendering refuses .. only when it is a whole path segment.

    2.13.5release notes

  • A missing public asset on disk now receives a 404 response.

    2.13.5release notes

  • Public assets are kept inside the output directory when cleaning.

    2.13.5release notes

  • Each output file is counted once in the build size report.

    2.13.5release notes

  • Sourcemap mappings are preserved for chunks containing user code.

    2.13.5release notes

  • The SWR handler respects the h3 URL.

    2.13.5release notes

  • Header-only route entries are marked as continue.

    2.13.5release notes

  • Trailing slashes are stripped from prerendered route overrides.

    2.13.5release notes

  • Missing Wrangler observability types are added.

    2.13.5release notes

  • The Cloudflare preset uses pathe for POSIX relative paths in wrangler.json (v2).

    2.13.5release notes