What middleapi/orpc shipped
Generated by FoxPlug from public activity — not affiliated with Orpc.
Week of September 14, 2026
What shipped
- v2.0.0-beta.37 removes adapter interceptors and adapter plugins, removes built-in RegExp support from serializers and JSON Schema coercer, and fixes plugin registration order. Release
- RPC JSON serializer now checks wire types before restoring serialized values and compiles RegExp values lazily to prevent type confusion attacks from untrusted clients. Pull request #2048
- Server handler options now accept context as a function resolved after the prefix check, avoiding context setup costs on requests that don't match. Pull request #2029
- v2.0.0-beta.36 adds distributed locking helpers with multiple adapters, NestJS support for HTTP QUERY method, and Redis cluster support for rate limiting. Release
- Documentation now lists Cloudflare Workers Traces alongside OpenTelemetry as a first-party tracing option. Pull request #2051
- NestJS integration now supports HTTP QUERY method on NestJS v11.2+ through QueryMethod decorator. Pull request #2031
- Performance comparison page updated with benchmarks from oRPC 2.0.0-beta.37, tRPC 11.19.0, and Hono 4.13.8. Pull request #2050
- Zod integration now preserves JSON Schema constraints on zod >= 4.6 by reading checks from the definition directly. Pull request #2028
- Bracket notation serializer now prevents prototype pollution by reading and writing own properties only. Pull request #2024
- Lock package adds distributed locking helpers with multiple adapter implementations. Pull request #2016
Why it matters
Beta.37 hardens security with type checking during deserialization and removes deprecated adapter-level hooks, while beta.36 expanded platform support with distributed locks and NestJS QUERY method. These releases improve both safety and flexibility for developers building production systems.
Changelog entry
- Breaking: Remove adapter interceptors and adapter plugins Release
- Breaking: Remove built-in RegExp support from serializers and JSON Schema coercer Release
- Fix: Keep registration order when sorting plugins Release
- Fix: Check serialized value types and compile regexps lazily during RPC deserialization Release
- Upgrade: @standard-server/* to 0.9.2 Pull request #2049
- Docs: Warn that Fastify bodyLimit does not cover catch-all parser in oRPC Pull request #2046
- Docs: Add Redirect Response section to OpenAPI Input and Output Mapping page Pull request #2043
- Upgrade: @standard-server/* to 0.9.1 Pull request #2035
- Feature: Add distributed locking helpers with multiple adapters Release
- Feature: NestJS support for HTTP QUERY method Release
- Feature: Rate limiter accepts Redis cluster clients Release
- Fix: Keep request span open until streamed response body finishes Pull request #2032
- Feature: Handler options accept context as function resolved after prefix check Pull request #2029
- Fix: Reject form action calls with non-FormData input Release
- Fix: Keep JSON Schema constraints on zod >= 4.6 Release
- Fix: Prevent prototype pollution through object values in bracket notation Pull request #2024
v2.0.0-beta.37 and beta.36 shipped this week. Beta.37 removes adapter interceptors, hardens RPC deserialization against type confusion, and fixes plugin ordering. Beta.36 adds distributed locking, NestJS QUERY support, and Redis cluster adapters.
Two oRPC beta releases landed this week with significant improvements: v2.0.0-beta.37 removes deprecated adapter-level interceptors and plugins, hardens the RPC serializer to validate wire types before restoring built-in values, fixes plugin registration order, and lets handlers accept context functions resolved after prefix checks. v2.0.0-beta.36 introduces distributed locking helpers with multiple adapters, adds NestJS support for HTTP QUERY method on v11.2+, and extends rate limiting to accept Redis cluster clients. Documentation now clarifies that any Standard Schema library works with oRPC, not just the three highlighted packages.