[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@edgestore/cli@1.0.1

Patch Changes

• #307 394fded Thanks @raviships! - Update smol-toml to 1.9.1 so a malformed or very large Codex config.toml can no longer hang the CLI (GHSA-7w5x-hrqm-74c2, GHSA-r4xh-jqrq-34v2).
• Updated dependencies []:
  • @edgestore/sdk@1.0.1

@edgestore/react@1.0.1

Patch Changes

• Updated dependencies [85791bb]:
  • @edgestore/shared@1.0.1

@edgestore/server@1.0.1

Patch Changes

• #309 85791bb Thanks @raviships! - Require beforeDelete to replace or overwrite existing files from the browser.

  Replacing a file deletes it, so a browser upload with replaceTargetUrl, or
  with a manualFileName that matches an existing file, now runs the bucket's
  beforeDelete on that file first. Replacement targets must be in the same
  bucket. Without beforeDelete these uploads fail. Generated file names and
  backend uploads are unchanged.

  Custom providers that let the browser choose file names should call the new
  authorizeOverwrite request parameter with any file already at the key.

• #308 83cba2a Thanks @raviships! - Harden the edgestore-ctx cookie against cross-site requests.

  • The cookie now defaults to SameSite=Lax and HttpOnly, and to Secure
    when NODE_ENV is production. cookieConfig.ctx.options still overrides
    each default; a frontend on a different site needs sameSite: 'none' and
    secure: true. Browsers don't store Secure cookies over plain HTTP
    (Safari not even on localhost), so set secure: false to test a production
    build over HTTP.
  • Requests with a body must use Content-Type: application/json, as
    @edgestore/react already does. Other content types get a 400.
  • The encrypted context now expires with the cookie's maxAge instead of
    always after 30 days.

• Updated dependencies [85791bb]:

  • @edgestore/shared@1.0.1
  • @edgestore/sdk@1.0.1

@edgestore/shared@1.0.1

Patch Changes

• #309 85791bb Thanks @raviships! - Require beforeDelete to replace or overwrite existing files from the browser.

  Replacing a file deletes it, so a browser upload with replaceTargetUrl, or
  with a manualFileName that matches an existing file, now runs the bucket's
  beforeDelete on that file first. Replacement targets must be in the same
  bucket. Without beforeDelete these uploads fail. Generated file names and
  backend uploads are unchanged.

  Custom providers that let the browser choose file names should call the new
  authorizeOverwrite request parameter with any file already at the key.

@edgestore/sdk@1.0.1

No changes in this release.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
edgestore-docs	Ready	Preview	Oct 24, 2026 3:57am UTC
example-access-control	Ready	Preview	Oct 24, 2026 3:57am UTC
example-components	Ready	Preview	Oct 24, 2026 3:57am UTC