What middleapi/orpc shipped
Written by FoxPlug from the repository's own releases; not affiliated with Orpc. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/middleapi/orpc; Orpc did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Bracket notation deserialization in OpenAPI now tracks empty slots across the whole payload, bounding memory use while still allowing longer sequential arrays, and path parsing was optimized. Pull request #2196
- The OpenAPI generator now supports enum and union status codes in detailed output responses, including picklists emitted by Effect, arktype and valibot and unions of literals, so a single response definition can cover multiple statuses. Pull request #2187
- In compact input structure, path params now take precedence over colliding query or body keys, so a client body field can no longer replace the value taken from the URL. Pull request #2191
- Cloudflare message ids are now timestamp based, so resuming after idle cleanup or a schema reset no longer skips newer events when SQLite's autoincrement sequence restarts on table recreation. Pull request #2190
- The Retry After Link Plugin now detects and skips requests with non-resendable request bodies such as ReadableStream and AsyncIteratorObject, since those bodies are consumed on the first attempt. Pull request #2183
- Path matching now handles both raw characters such as caret and colon and their percent-encoded forms when clients send them, retrying with normalization transparently. Pull request #2185
- TanStack Query and Pinia Colada peer dependency floors were raised: tanstack-query needs query-core 5.89.0 or newer and pinia-colada needs 1.2.0 or newer, because older TanStack versions pass an undefined fnContext to mutation interceptors. Pull request #2180
- Every standard-server dependency was upgraded from 0.10.1 to 0.10.2, picking up upstream fixes for the Node and peer WebSocket and MessagePort adapters, with no oRPC source changes required. Pull request #2194
- The tRPC to oRPC router conversion now catches and converts TRPCError exceptions thrown during subscription iteration, not only during initial procedure execution. Pull request #2181
- A regex pattern in the getIssueMessage function was anchored at the start so numeric path validation only matches a path that is entirely numeric. Pull request #2186
Why it matters
This week's work tightens the OpenAPI surface: memory use for bracket notation keys is bounded, enum and union statuses are supported in detailed responses, and path params win over colliding body or query keys in compact input. Several fixes prevent silent data problems, from Cloudflare message ids skipping events after a table recreation to retries of request bodies that cannot be resent. Peer dependency floors were raised so mutation interceptors behave correctly on supported TanStack Query and Pinia Colada versions.
Changelog entry
- Fix(openapi)!: bound memory used by sparse bracket notation keys Pull request #2196
- Feat(openapi): support enum and union status in detailed responses Pull request #2187
- Fix(openapi): give path params precedence in compact input Pull request #2191
- Fix(cloudflare): use timestamp-based ids to handle table recreation Pull request #2190
- Fix(client): prevent retry of non-resendable request bodies Pull request #2183
- Fix(openapi,rpc): handle raw chars in paths stored percent-encoded Pull request #2185
- Fix(openapi): fix regex pattern for numeric path validation Pull request #2186
- Fix: raise TanStack Query and Pinia Colada peer dependency floors Pull request #2180
- Fix: upgrade standard-server/* packages to 0.10.2 Pull request #2194
- Fix(trpc): handle TRPCError in subscription iterators Pull request #2181
- Chore(msw): upgrade MSW to v3 while keeping v2 support Pull request #2203
- Chore(content): upgrade Blume to v2 Pull request #2193
New release: OpenAPI detailed responses now support enum and union statuses, bracket notation keys use bounded memory, and path params take precedence in compact input. Also: timestamp-based Cloudflare message ids, no retry of non-resendable bodies, and higher TanStack Query and
This week we shipped changes across the OpenAPI layer and a few important fixes. OpenAPI detailed responses now accept enum and union status codes, including picklists from Effect, arktype and valibot. Bracket notation deserialization tracks empty slots across the payload to bound memory while allowing longer sequential arrays, and path params now take precedence over colliding query or body keys in compact input. On the fixes side, Cloudflare message ids are timestamp based so resuming after idle cleanup or a schema reset does not skip newer events, the Retry After Link Plugin skips requests whose bodies cannot be resent, and path matching handles raw and percent-encoded characters. We also raised the TanStack Query and Pinia Colada peer dependency floors because older TanStack versions p
Week of September 28, 2026
What shipped
- V2.0.0-beta.42 released with improved JSON Schema converter caching, upgraded standard-server and OpenAPI spec packages. Release
- JSON Schema converter now directly uses Effect's native API instead of wrapping the standard converter. Pull request #2175
- OpenAPI path matching upgraded to rou3 v1.0.0 with better handling of catch-all parameters and special characters. Pull request #2173
- Batch link plugin now excludes aborted subrequests from batch messages sent to the server. Pull request #2176
- Cancelled batched streams now properly stop on the server instead of running indefinitely. Pull request #2161
- Batched and deduped requests now send in their caller's async context, preserving request-scoped data. Pull request #2160
- Infinity and -Infinity now round-trip through RPC serializers instead of becoming null. Pull request #2158
- Fixed date parsing, bigint handling, tuple composition, and required field detection in JSON schema. Pull request #2127
- OpenAPI handler now only parses query strings when the input structure actually uses them. Pull request #2139
- Effect library peer dependency upgraded to stable 4.0.0 release. Pull request #2163
Why it matters
This week focused on robustness in streaming and batch operations, fixing edge cases where cancelled requests continued running and async context was lost between callers. The JSON Schema and OpenAPI improvements ensure types round-trip correctly and special values like Infinity serialize properly. These fixes matter because they prevent silent failures in production where batched calls, streams, and context-aware transports are heavily used.
Changelog entry
- V2.0.0-beta.42 released Release
- Effect: improved JSON Schema converter with direct Effect API integration Pull request #2175
- OpenAPI: upgrade rou3 to v1.0.0 and improve path matching for edge cases Pull request #2173
- Client: batch link now excludes aborted subrequests Pull request #2176
- Client: cancelled batched streams now stop on the server Pull request #2161
- Client: batched and deduped requests preserve caller async context Pull request #2160
- RPC: Infinity and -Infinity now serialize and deserialize correctly Pull request #2158
- JSON Schema: fixed date parsing, bigint, tuple, and required handling Pull request #2127
- OpenAPI: query string only parsed when input structure uses it Pull request #2139
- Dependencies: @openapi-spec packages upgraded to v0.3.0 Pull request #2178
- Dependencies: @standard-server packages upgraded to 0.10.1 Pull request #2174
- Effect: upgraded to stable 4.0.0 release Pull request #2163
V2.0.0-beta.42: batch streams now cancel properly, async context flows correctly between callers, Infinity round-trips through serializers, and JSON Schema handles dates and composed types.
V2.0.0-beta.42 ships fixes for batch and streaming reliability. Cancelled streams now properly stop on the server instead of running indefinitely, batched requests preserve caller async context so request-scoped data stays intact, and infinity values round-trip through serializers. We also improved JSON Schema handling for dates, tuples, and composed types, and OpenAPI path matching now correctly handles catch-all parameters and special characters.
Week of September 21, 2026
What shipped
- Redis Pub/Sub now delivers events in stream order when resume is enabled, fixing cases where concurrent publishers could skip or duplicate events. Pull request #2073
- Batched procedures and subscriptions now stop when the client disconnects instead of running to completion. Pull request #2092
- BatchLinkPlugin and DedupeLinkPlugin gain a wait option to collect requests for milliseconds before sending, reducing request count. Pull request #2090
- Procedures served through toORPCRouter now receive only schema-declared fields, closing a mass-assignment risk. Pull request #2106
- RetryLinkPlugin no longer loops forever when retryDelay throws or rejects. Pull request #2105
- Publisher resume with lastEventId no longer silently drops the oldest missed events when backlog exceeds maxBufferedEvents. Pull request #2104
- Nest Express adapter now cancels streamed response bodies when the client disconnects, preventing subscription leaks. Pull request #2101
- PrototypePollutionProtectionHandlerPlugin now protects against proto keys on arrays in MessagePort messages. Pull request #2107
- CloudflareTracer now renames request spans to procedure paths and records exceptions following OpenTelemetry semantics. Pull request #2095
- Routers implemented with.lazy() now follow the contract's error map and meta. Pull request #2070
Why it matters
This week addresses critical reliability issues in streaming, batching, and event delivery, plus mass-assignment and security gaps. Connection lifecycle handling across multiple transports is now correct, and procedures respect schema boundaries properly. These fixes prevent data loss, resource leaks, and vulnerability exposure.
Changelog entry
- Fix(publisher, bun)!: keep Redis Pub/Sub delivery in stream order Pull request #2073
- Fix(server): abort batch sub-requests when the client disconnects Pull request #2092
- Feat(client): add wait option to batch and dedupe link plugins Pull request #2090
- Fix(trpc): stop toORPCRouter from passing input keys the schema strips Pull request #2106
- Fix(client): stop retrying forever when retryDelay throws Pull request #2105
- Fix(publisher): stop truncating the resume backlog to maxBufferedEvents Pull request #2104
- Fix(nest): cancel streamed response bodies when the client disconnects Pull request #2101
- Fix(server): stop MessagePort arrays from bypassing prototype pollution protection Pull request #2107
- Feat(cloudflare): rename spans and follow OTel exception semantics in CloudflareTracer Pull request #2095
- Fix(server): apply the contract to routers implemented with.lazy() Pull request #2070
- Fix(client): send FormData uploads outside the batch Pull request #2102
- Fix(json-schema): prevent unhandled rejections when converting async schemas Pull request #2103
- Fix(server,contract,ai-sdk): stop loose stacked input schemas from reverting earlier transforms Pull request #2099
- Fix(shared): close the source iterator when consumeAsyncIterator onEvent throws Pull request #2093
- Fix(client): let the WebSocket link reconnect after giving up Pull request #2084
- Fix(client): reject WebSocket link calls when connect returns a closed socket Pull request #2083
- Fix(client): reject message port link calls after the port closes Pull request #2082
- Fix(client): reject WebSocket link calls after the socket closes Pull request #2081
- Fix(client): reject batched calls when a batch option throws Pull request #2079
This week: Redis events now stay in order, batches and subscriptions stop on disconnect, retry loops don't freeze, and procedures respect their schemas. 40 fixes across transport, validation, and streaming.
Orpc shipped 40 fixes this week focusing on reliability and correctness. Redis Pub/Sub now guarantees event ordering during resume, client disconnects properly cancel streamed responses and batched work, and procedures no longer receive undeclared fields. RetryLinkPlugin no longer hangs on errors, and batching gains a configurable wait option to optimize request grouping. These changes address streaming leaks, mass-assignment risks, and connection lifecycle issues across WebSocket, MessagePort, and HTTP transports.
Week of September 14, 2026
What shipped
- V2.0.0-beta.37 removes adapter interceptors and adapter plugins, removes built-in RegExp support from serializers and JSON Schema coercer, and fixes plugin registration order. Release
- RPC JSON serializer now checks wire types before restoring serialized values and compiles RegExp values lazily to prevent type confusion attacks from untrusted clients. Pull request #2048
- Server handler options now accept context as a function resolved after the prefix check, avoiding context setup costs on requests that don't match. Pull request #2029
- V2.0.0-beta.36 adds distributed locking helpers with multiple adapters, NestJS support for HTTP QUERY method, and Redis cluster support for rate limiting. Release
- Documentation now lists Cloudflare Workers Traces alongside OpenTelemetry as a first-party tracing option. Pull request #2051
- NestJS integration now supports HTTP QUERY method on NestJS v11.2+ through QueryMethod decorator. Pull request #2031
- Performance comparison page updated with benchmarks from oRPC 2.0.0-beta.37, tRPC 11.19.0, and Hono 4.13.8. Pull request #2050
- Zod integration now preserves JSON Schema constraints on zod >= 4.6 by reading checks from the definition directly. Pull request #2028
- Bracket notation serializer now prevents prototype pollution by reading and writing own properties only. Pull request #2024
- Lock package adds distributed locking helpers with multiple adapter implementations. Pull request #2016
Why it matters
Beta.37 hardens security with type checking during deserialization and removes deprecated adapter-level hooks, while beta.36 expanded platform support with distributed locks and NestJS QUERY method. These releases improve both safety and flexibility for developers building production systems.
Changelog entry
- Breaking: Remove adapter interceptors and adapter plugins Release
- Breaking: Remove built-in RegExp support from serializers and JSON Schema coercer Release
- Fix: Keep registration order when sorting plugins Release
- Fix: Check serialized value types and compile regexps lazily during RPC deserialization Release
- Upgrade: @standard-server/* to 0.9.2 Pull request #2049
- Docs: Warn that Fastify bodyLimit does not cover catch-all parser in oRPC Pull request #2046
- Docs: Add Redirect Response section to OpenAPI Input and Output Mapping page Pull request #2043
- Upgrade: @standard-server/* to 0.9.1 Pull request #2035
- Feature: Add distributed locking helpers with multiple adapters Release
- Feature: NestJS support for HTTP QUERY method Release
- Feature: Rate limiter accepts Redis cluster clients Release
- Fix: Keep request span open until streamed response body finishes Pull request #2032
- Feature: Handler options accept context as function resolved after prefix check Pull request #2029
- Fix: Reject form action calls with non-FormData input Release
- Fix: Keep JSON Schema constraints on zod >= 4.6 Release
- Fix: Prevent prototype pollution through object values in bracket notation Pull request #2024
V2.0.0-beta.37 and beta.36 shipped this week. Beta.37 removes adapter interceptors, hardens RPC deserialization against type confusion, and fixes plugin ordering. Beta.36 adds distributed locking, NestJS QUERY support, and Redis cluster adapters.
Two oRPC beta releases landed this week with significant improvements: v2.0.0-beta.37 removes deprecated adapter-level interceptors and plugins, hardens the RPC serializer to validate wire types before restoring built-in values, fixes plugin registration order, and lets handlers accept context functions resolved after prefix checks. v2.0.0-beta.36 introduces distributed locking helpers with multiple adapters, adds NestJS support for HTTP QUERY method on v11.2+, and extends rate limiting to accept Redis cluster clients. Documentation now clarifies that any Standard Schema library works with oRPC, not just the three highlighted packages.