Release Notes
Structured release notes for bQuery.js. Each minor version has its own page; older minors live in the CHANGELOG.
The library follows Semantic Versioning. The Stability matrix lists which modules are stable, beta, or experimental; the canonical source of truth (with per-module status history) is STABILITY.md.
Versions
| Version | Date | Highlights |
|---|---|---|
| 1.18.0 | 2026-10-23 | Standard Schema for forms (createSchemaForm()) and server (validate()); component re-renders morph the DOM and keep input state; retries default to idempotent methods and honour Retry-After; request bodies limited by default; create-bquery scaffolder; five sanitizer XSS fixes; full-page SSR keeps its doctype. |
| 1.17.2 | 2026-10-01 | Security patch: csrf() and session() name their cookies __Host-bq.csrf and __Host-bq.sid by default, so a sibling subdomain can no longer plant them. Users are logged out once; client code that reads the CSRF cookie needs the new name. |
| 1.17.1 | 2026-09-30 | Security-and-correctness patch: serveStatic sidecar containment, Node adapter no longer crashes on a throwing handler and cancels streams on disconnect, signed CSRF tokens bound to the session. Router params decoded, encoded static routes match, css() camelCase, toggle() on [hidden], Trusted Types for components, linear-time email(). |
| 1.17.0 | 2026-09-25 | server gains serveStatic() and rateLimit(); sanitizeHtml() works without a DOM; opt-in glitch-free reactive scheduler plus a flush-ordering fix that applies to batch() by default. Packaging: require('@bquery/bquery') works, sub-path types resolve, JS source maps dropped. One path break — dist/full.umd.js is now dist/full.umd.cjs. |
| 1.16.1 | 2026-08-26 | Toolchain-and-build maintenance patch: Bun floor moves to 1.4.0, dev dependencies refreshed, Vite configs build warning-free (import.meta.dirname, node:http stub). No source or API changes. |
| 1.16.0 | 2026-08-11 | Quality-and-performance release: batching spans transitive updates, computeds notify only on real value changes, hot-path allocation cuts across reactive/DOM/view, undelegate() leak and bq-model caret fixes, watchThrottle trailing option. No breaking changes. |
| 1.15.1 | 2026-07-06 | Security-and-correctness patch: XSS hardening across HTML sinks, evaluator code-execution paths closed, Trusted Types wired in (trustedHtmlForSink), secure-by-default cookies, reactive robustness fixes. No breaking changes. |
| 1.15.0 | 2026-06-30 | Thirteen modules graduate to Stable (every module is now Stable); view transitions + optional compiler, forms actions + optimistic, i18n ICU + extraction, opt-in file-based routing, devtools bridge + reference extension. |
| 1.14.2 | 2026-06-26 | Patch: dev-dependency maintenance (TypeScript-ESLint, ESLint, Vite, Bun 1.3.14); Dependabot added. No public API changes. |
| 1.14.1 | 2026-05-28 | Patch: motion prefersReducedMotion / reducedMotionSignal refresh stale media-query cache on matchMedia change. |
| 1.14.0 | 2026-05-26 | media, plugin, devtools, testing graduate into batteries-included tiers; additive expansions across router, view, a11y, i18n, dnd, storybook, concurrency, ssr, server. |
| 1.13.0 | 2026-05-21 | Forms / component / motion / core-utils baseline expansion. See CHANGELOG. |
| 1.12.0 | 2026-05-16 | unregisterPlugin, clearPlugins, WebSocketSendData public type, /full bundle type-export drift coverage. |
| 1.11.x | 2026-04-30 / 2026-05-12 | SSR / server runtime: createServer, renderToStringAsync, renderToStream, renderToResponse, runtime-agnostic WebSocket sessions. |
| 1.10.0 | 2026-04-15 | Concurrency module additions. |
| 1.9.0 | 2026-04-05 | Watcher / view / media APIs. |
| earlier | see CHANGELOG | Full history in CHANGELOG.md. |
How to read these notes
Each per-version page is organized by:
- Headlines — the main story of the release.
- Added / Changed / Fixed — the structured CHANGELOG sections.
- Migration notes — anything you need to do to upgrade from the previous minor.
- Links — to the module guides that document the new surface.
Deprecation policy
- Stable modules: deprecations are flagged at least one minor before removal.
- Beta modules: deprecations may be flagged in the same minor that removes them; an upgrade path is always documented.
- Experimental modules: APIs may change between minors without prior deprecation.
See Contributing — Release Process for the contributor view.