What middleapi/orpc shipped

This week: RPCLink rejects 3xx responses, malformed RPC success bodies now throw MalformedResponseError, abort listeners are cleaned up after deduped calls settle, and OpenAPI component names are sanitized to valid keys.

This week in oRPC: RPCLink now throws on 3xx responses instead of resolving a redirect body as output, and malformed 2xx JSON bodies are rejected with MalformedResponseError. Dedupe no longer keeps abort listeners after a request settles, batch streaming cancels the response stream on decode errors, and data-less SSE error events are preserved. On the OpenAPI side, documents are serialized before downgrading to 3.1 or 3.0, component names are sanitized to valid keys, and discriminator mapping refs are rewritten when $defs are hoisted. Also: the RPC outputStatus option must now resolve to a number.

V2.0.0-beta.48 is out: a cookie jar for clients outside the browser, HEAD support for GET procedures, a streaming option for batch responses, and a new OpenAPI router. Error response body options no longer fall back to defaults.

V2.0.0-beta.48 is out. It adds CookieJarLinkPlugin and CookieJar for clients outside the browser, HeadMethodHandlerPlugin for HEAD requests against GET procedures, a streaming mode for BatchLinkPlugin, and a new OpenAPI router. One breaking change: error response body options no longer fall back to the default behavior, so each option now always decides. This week also fixed RPC deserialization of unknown meta types and made wrapped readable streams read on demand.

V2.0.0-beta.46 is out: only jsonified client factories in createContractJsonifiedUtilsFactory, internal-only exports removed. Adapters gained a prefix() method, TanStack Query and Pinia Colada keys are now type-aware, and @orpc/effect plus @orpc/msw drop the experimental prefix.

This week's releases include v2.0.0-beta.46, which makes breaking changes: createContractJsonifiedUtilsFactory now accepts only jsonified client factories and internal-only APIs are no longer exported. Publisher, rate limiter and lock adapters gained a prefix() method that returns a scoped adapter sharing the original client. TanStack Query now uses type-aware structural sharing and serialized input keys, and Pinia Colada gained a configurable key serializer. The Effect integration is now published as @orpc/effect and the MSW integration as @orpc/msw, both dropping the experimental prefix. Fixes cover iterator retries after close, durable iterator token refresh failures, and primitive conversion for router utils and error constructor maps.

V2.0.0-beta.44 is out. Malformed responses now throw MalformedResponseError directly, and buffered batches switch to streaming when a sub-response is a stream. This week also shipped hardening: bigint digit caps, meta path checks in RPC deserialize, canonical base64url in unsign/

This week brought v2.0.0-beta.44 and v1.15.7, along with a set of security hardening fixes. Client links now throw MalformedResponseError directly instead of wrapping it in an ORPCError, and buffered batches switch to streaming when a sub-response is a stream. On the hardening side: bigint digit counts are capped in the RPC serializer and smart coercion, meta paths that descend into already deserialized values are rejected, unsign and decrypt reject non-canonical base64url, the lazy router prefix scan is bounded, small uploads stay in memory, and OpenAPILink encodes a leading slash in first-segment catch-all params. If you use RPC or OpenAPI links, review the breaking change before upgrading.

New release: OpenAPI detailed responses now support enum and union statuses, bracket notation keys use bounded memory, and path params take precedence in compact input. Also: timestamp-based Cloudflare message ids, no retry of non-resendable bodies, and higher TanStack Query and

This week we shipped changes across the OpenAPI layer and a few important fixes. OpenAPI detailed responses now accept enum and union status codes, including picklists from Effect, arktype and valibot. Bracket notation deserialization tracks empty slots across the payload to bound memory while allowing longer sequential arrays, and path params now take precedence over colliding query or body keys in compact input. On the fixes side, Cloudflare message ids are timestamp based so resuming after idle cleanup or a schema reset does not skip newer events, the Retry After Link Plugin skips requests whose bodies cannot be resent, and path matching handles raw and percent-encoded characters. We also raised the TanStack Query and Pinia Colada peer dependency floors because older TanStack versions p

V2.0.0-beta.42: batch streams now cancel properly, async context flows correctly between callers, Infinity round-trips through serializers, and JSON Schema handles dates and composed types.

V2.0.0-beta.42 ships fixes for batch and streaming reliability. Cancelled streams now properly stop on the server instead of running indefinitely, batched requests preserve caller async context so request-scoped data stays intact, and infinity values round-trip through serializers. We also improved JSON Schema handling for dates, tuples, and composed types, and OpenAPI path matching now correctly handles catch-all parameters and special characters.

This week: Redis events now stay in order, batches and subscriptions stop on disconnect, retry loops don't freeze, and procedures respect their schemas. 40 fixes across transport, validation, and streaming.

Orpc shipped 40 fixes this week focusing on reliability and correctness. Redis Pub/Sub now guarantees event ordering during resume, client disconnects properly cancel streamed responses and batched work, and procedures no longer receive undeclared fields. RetryLinkPlugin no longer hangs on errors, and batching gains a configurable wait option to optimize request grouping. These changes address streaming leaks, mass-assignment risks, and connection lifecycle issues across WebSocket, MessagePort, and HTTP transports.

V2.0.0-beta.37 and beta.36 shipped this week. Beta.37 removes adapter interceptors, hardens RPC deserialization against type confusion, and fixes plugin ordering. Beta.36 adds distributed locking, NestJS QUERY support, and Redis cluster adapters.

Two oRPC beta releases landed this week with significant improvements: v2.0.0-beta.37 removes deprecated adapter-level interceptors and plugins, hardens the RPC serializer to validate wire types before restoring built-in values, fixes plugin registration order, and lets handlers accept context functions resolved after prefix checks. v2.0.0-beta.36 introduces distributed locking helpers with multiple adapters, adds NestJS support for HTTP QUERY method on v11.2+, and extends rate limiting to accept Redis cluster clients. Documentation now clarifies that any Standard Schema library works with oRPC, not just the three highlighted packages.