@cloudflare/worker-bundler@0.2.4 v3.90.0
louislam/uptime-kumaSep 18, 2026 → Sep 18, 20260 days between releases
What's New
Older release patches a DoS vulnerability; newer release introduces critical security hardening and breaking API changes.
Breaking Changes
- Password changes now revoke other sessions
- Stricter SVG and XML upload validation
- Client uploads hardened across all adapters
- Azure containers default to private
- Client uploads stored in per-upload folder
New Features
- Password reset now clears lockouts; forgot-password is throttled
- Adds new `resetPasswordRequestedAt` field to user collections
Improvements
- Client uploads hardened across all adapters
- External file fetches require trusted origin
- Multipart uploads capped at 50MB
Bug Fixes
- Security patch for TOML parsing DoS vulnerability
- Fixes for critical security vulnerabilities
Upgrade Notes
Regenerate payload types using `pnpm payload generate:types`. If using a relational database, create and run a migration for the new `resetPasswordRequestedAt` field. Action is required for password reset changes.
The Two Releases
@cloudflare/worker-bundler@0.2.4
Sep 18, 2026· 1 month ago
v0.2.4 patches a high-severity denial of service vulnerability in the smol-toml dependency by raising the minimum version to ^1.7.2, which includes the upstream fix for malformed TOML parsing.
Full release notesv3.90.0
Sep 18, 2026· 1 month ago
v3.90.0 contains critical security fixes including password changes revoking sessions, stricter SVG/XML upload validation, client upload hardening across all adapters, and various API changes requiring migrations.
Full release notes