The latest news releases from the Qwik team

Patch Changes

• 🐞🩹 prevent development image tooling from requesting private network resources (by @github-actions in #9074)

• 🐞🩹 dev server image auto fix endpoint accepted cross-site requests and paths outside src (by @Varixo in 85efa68)

Patch Changes

• 🐞🩹 limit request bodies to 10 MiB by default in the Node, Deno, Bun, Cloudflare Pages, Netlify Edge and Vercel Edge adapters (and AWS Lambda / Firebase through Node); configurable with the new requestBodyLimit option (by @github-actions in #9074)

• 🐞🩹 prevent private responses from entering shared Cloudflare caches (by @Varixo in 0585c24)

• 🐞🩹 prevent excessive array lengths from form field indexes (by @Varixo in b40324c)

• 🐞🩹 catch-all route matching no longer hangs on paths containing // (by @wmertens in #9072)

• 🐞🩹 redirect() now strips ASCII tab/LF/CR from the URL, so targets like /<TAB>/example.com can no longer redirect to another origin (by @github-actions in #9074)