Changelog

This is a complete history of changes for Meteor releases.

v3.6.0, 2026-11-09

Highlights

Native TypeScript types for Meteor packages. Use meteor types to generate definitions for editor autocomplete and TypeScript checking. Package authors can ship their own definitions with api.types(). New TypeScript, TypeScript + Tailwind, Angular, and Svelte apps use native package declarations by default. Adoption remains optional for existing apps, which can keep @types/meteor or zodern:types. See the setup guide, PR#14699, PR#14762, PR#14853.
Build apps with Rspack 2, PR#14360.
- ⚡ Apps using the rspack package now require Rspack 2.2.7 or newer. When automatic dependency installation is enabled, Meteor installs the required build dependencies for you.
- 📦 Update Meteor’s Rspack integration (@meteorjs/rspack) to 3.0.0 for compatibility with Rspack 2, including a fix for build errors in TypeScript projects that re-export types.
- ⚛️ New React apps start with React 19.2. The Rspack integration supports React Compiler and keeps React Refresh working with Rspack 2 so component edits can appear without a full page reload.
- 🔁 Existing Rspack 1 apps can upgrade through Meteor’s automatic dependency installation, including apps whose older npm lockfiles would otherwise block the upgrade.
- 🧪 Hot module replacement (HMR) updates code during development without a full page reload. Its runtime is now included only when needed for meteor run, keeping it out of production builds and native app bundles.
These changes address the Rspack 2 compatibility and upgrade behavior reported in #14368, #14652, #14310.
Node.js 26: Meteor apps and build tools now run on Node.js 26.13.0 with npm 11.20.0, PR#14412, PR#14786, PR#14862, PR#14884.
MongoDB 8: local development now uses MongoDB 8.0.29 with official MongoDB binaries. Review the platform requirements and data migration steps below before updating, PR#14663.

Features

Create pnpm workspaces and share local packages, PR#14421.
- 📁 Run meteor create --pnpm my-workspace to create a Meteor + Rspack app alongside reusable client, server, and shared packages in one repository.
- 🔍 Meteor detects whether your app uses npm, Yarn, or pnpm when installing Rspack dependencies. If you install dependencies manually, it shows commands for your package manager.
- 🔗 Apps can use locally linked and workspace packages without Rspack’s dependency checks incorrectly rejecting their version declarations.
This addresses the long-standing report #10903.
Create an installable web app with meteor create --pwa. The Blaze template includes app icons, installation support, and a fallback page for when the user is offline, PR#14473.
Choose packages interactively in the terminal. Run meteor add or meteor remove without arguments to select packages and confirm your choices. Use meteor add --search <query> to start with a search, PR#14408.
Start projects and add packages directly from Git repositories. Use meteor create <url> for a project or meteor add <url|user/repo> for a package. You can also select a branch or a subdirectory of the repository, PR#14409.
Observe server activity with the new instrumentation package. Subscribe to events from Meteor methods, publications, and client connections to build monitoring integrations. Capturing argument and result previews is optional, PR#14483.
Enable terminal autocompletion for Meteor commands with meteor shell-completion. Bash and Zsh are supported, PR#14551.
Use separate app code and Rspack settings for modern browsers, older browsers, and Cordova. Meteor builds each configured entry point independently, including meteor.mainModule.legacy for older browsers. You can also disable an entry point your app does not need, PR#14800.

Improvements

Update the SWC compiler to 1.16.2 across Meteor’s JavaScript build tools and Rspack, PR#14792.
Make Rspack development-server connection errors easier to diagnose, with useful error details and a summary of repeated failures, PR#14348.
Prepare package dependencies in parallel during meteor --get-ready, with individual retries if a batch fails, PR#14683.
Avoid reinstalling unchanged Git dependencies declared by Meteor packages. The first build after upgrading still refreshes each package’s npm dependencies and rewrites its shrinkwrap file for the new format, PR#14681.
Strengthen HttpOnly login-cookie protection with origin and token checks, stricter cookie settings, and request limits. Apps using this feature should review the migration steps below, PR#14726.
Validate passwordless login requests before looking up or creating accounts, and apply the default Accounts request limit, PR#14725.

Fixes

Prevent crafted proxy headers from crashing or stalling production apps using force-ssl, while preserving HTTPS and local-connection detection. Parser fix
Update webapp compression to 1.8.2 and OAuth body parsing to 1.20.9. HTTP responses can now use Brotli when clients advertise br; gzip-only clients retain gzip. Dependency updates
Keep generated Rspack development and production HTML out of test builds, preventing stale chunk references and browser errors after switching modes.
Honor release-required package wrap versions when resolving indirect dependencies.
Avoid restarting the Rspack development server when a rebuild leaves its emitted server code unchanged, PR#14850.
Keep Change Streams observers current after oversized events by reassembling split events and recovering from non-resumable failures before releasing pending writes, PR#14787.
Preserve EJSON.equals object comparisons in minified legacy production bundles, preventing repeated subscription restarts, PR#14792, #14847.
Let applications augment Meteor.UserServices, and align native OAuth and provider declarations with their runtime behavior, PR#14813, PR#14830.
Install required build-time dependencies even when NODE_ENV=production, and restore client refreshes after delayed legacy builds extend their watched files, commit e7dcf5dfd5.
Validate native Google and Facebook sign-in tokens against the configured application before accepting the external identity, commit 6052d7f1ac.
Bound and validate dynamic-import requests while batching valid client requests, reject invalid DDP message handlers safely, and retain field names that overlap inherited object properties during allow/deny validation, commit 6052d7f1ac.
Protect shell-history storage and reject untrusted deployment-discovery destinations before sending Meteor credentials, commit 6052d7f1ac.
Preserve own __proto__ fields when computing and applying document changes without changing object prototypes in diff-sequence.
Require two-factor authentication for passwordless user-level tokens when enabled, and prevent concurrent login attempts from consuming the same passwordless token more than once.
Consume email-verification tokens only while the token and its email address still match, and reject stale verification attempts.
Reject unregistered DDP method and publication names inherited from object prototypes while preserving explicitly registered handlers.
Preserve own __proto__ fields during EJSON cloning and conversion without changing object prototypes.
Restrict Minimongo modifier traversal and optimized _id lookups to own properties, and preserve prototype-named fields as data.
Preserve prototype-named fields when applying Mongo collection replication changes without reading inherited document values.
Keep Meteor.users and account indexes in sync when Accounts.config({ collection }) selects a custom users collection, including a different collection instance with the same name, PR#14272.
Resume valid HttpOnly-cookie sessions after temporary network errors, rate limits or server errors, while cancelling stale retries after logout or another successful login, PR#14777.
Wait for a Rspack server bundle's top-level await before running Meteor.startup hooks in development, PR#14807.
Preserve native async functions and private fields in Rspack server builds, preventing runtime errors caused by unnecessary downlevel transforms, PR#14466.
Keep Rspack hot-reload builds running when generated entry files are briefly missing during a rebuild, PR#14493.
Prevent build crashes during native npm dependency rebuilds after an upgrade or when moving an app between environments, PR#14679.
Preserve original source locations in Rspack legacy builds, serve hot-update source maps correctly, and refresh Meteor compiler caches when input maps change, PR#14776.
Prevent Babel startup and build failures when source-map lookup occurs while compiler plugins are still loading, PR#14822.
Avoid memory growth when serving Rspack static assets, and return 404 for missing asset files, commit 1ed24e64f5.
Keep dynamically imported code loading when the browser closes its local cache connection, PR#14780, #14761.
Keep the exact npm dependency versions recorded in a Meteor package’s shrinkwrap file when rebuilding without cached dependencies, PR#14418, #14415.
Fix Windows updates that fail while rebuilding the argon2 password-hashing dependency, PR#14706, #13663.
Restore browser-based package tests by including their required jQuery dependency, PR#14736, #14735.
Handle SWC cache writes gracefully when a temporary app directory has already been removed, PR#14360.
Stop meteor run --inspect from repeatedly printing the full Rspack configuration unless verbose logging is enabled, PR#14732, #14731.
Fix repeated reconnects when clients negotiate a DDP protocol version over the uWebSockets transport, PR#14747, #14746.
Fix Rspack startup when --port includes a hostname or URL, such as localhost:3060 or http://localhost:3060/, PR#14743, #14741.
Prevent Server sent add for existing id errors when resubscribing with NO_MERGE_NO_HISTORY while a client update is pending, and preserve the client’s temporary changes, PR#14768.
Stop TypeScript apps using Rspack from entering a development-server restart loop, and keep the last working server entry when compilation fails, PR#14769.
Respect .meteorignore exceptions and METEOR_IGNORE when selecting Rspack tests, and prevent automatic exclusions from hiding generated test entry points, PR#14800, PR#14799.
Fix Rspack test discovery on Windows so dependencies and generated folders are correctly excluded, PR#14758.
Prevent crashes and hangs in meteor run during rapid rebuilds, PR#14775.
Keep commands from linked workspace packages working when a deployment bundle is moved to another location, PR#14765.
Keep subscriptions working when repeated document messages omit the fields property, PR#14766.
Fix generated TypeScript definition paths and correct types for DDP, subscriptions, and Minimongo, PR#14779, PR#14782.
Allow stylesheet side-effect imports such as import './App.css' in apps created from the TypeScript template on TypeScript 6+ (TS2882); existing apps can set noUncheckedSideEffectImports to false, PR#14877, #14833.
Handle errors from instrumentation reporting callbacks and limit the data included in error previews, PR#14778.
Use the platform’s built-in fetch in modern Cordova apps, PR#14781.
Keep reactive queries using $where or $near working by falling back from Change Streams to another configured database observer, PR#14733.
Fix OAuth login flows that open additional popups or return credentials across origins, PR#14666.
Pass the resolved user to login-failure hooks, and correctly accept allowed email domains across external login services, PR#14620, PR#14185.
Fix Rspack development scripts in apps served under a URL prefix, and restore the full app template’s 404 page, PR#14719, PR#14720.
Fix Bash and Zsh completion installation and support package names containing colons, PR#14772.
Re-send outstanding DDP methods after reconnecting on browsers without Promise.allSettled, and stop Accounts.config from throwing on browsers without Object.hasOwn, PR#14879, #14869.

See all merged PRs for Meteor 3.6

Breaking Changes

Native Google and Facebook sign-in tokens must belong to your application. For Google Sign-In SDKs, send an ID token for an accepted client or list your own native OAuth client IDs in the Google service configuration's additionalClientIds. Facebook native tokens must be valid for the configured Facebook app. Web OAuth configuration is unchanged.
Automatic deployment discovery accepts only trusted Galaxy HTTPS destinations. Deployments to a deliberately configured custom server must use an explicit DEPLOY_HOSTNAME; review that destination before setting it.
Custom users collections receive the default Accounts permissions and indexes. After Accounts.config({ collection }), the selected collection receives account indexes and, where client mutation methods are enabled, the default rule allowing users to update their own profile. Review custom allow/deny policies and configure the collection before clients connect, PR#14272.
Existing local databases need preparation. Before opening MongoDB 7 data with the bundled MongoDB 8, set its feature compatibility version (FCV) to 7.0 while still running MongoDB 7. External databases configured through MONGO_URL are upgraded separately.
Linux requirements have changed for the local database. The bundled MongoDB needs glibc 2.34+ on x86_64 or 2.35+ on ARM64, plus libcurl.so.4, libssl.so.3, and libcrypto.so.3, PR#14663.
The local database requires Windows 11 or Windows Server 2022 (x64). Windows 10, Windows Server 2019, and earlier versions are no longer supported by the bundled MongoDB. See MongoDB’s platform requirements, PR#14663.
Meteor now uses Node.js 26.13.0 and npm 11.20.0. Check your app and native npm dependencies against the new runtime before deploying.
Apps using rspack now need Rspack 2. Required versions are @rspack/core and @rspack/cli 2.2.7+, @rspack/dev-server 2.2.1+, and @meteorjs/rspack 3.0.0. Meteor installs them automatically when that setting is enabled. Review custom configurations against the Rspack 1.x migration guide.
The npm Rspack integration has new dependencies. @meteorjs/rspack@3.0.0 uses rspack-merge instead of webpack-merge and declares Rspack 2.2.0 peer dependencies. Meteor’s required versions are listed above.
HttpOnly login cookies have stricter requirements. Enable useHttpOnlyCookies on the server. Cookie requests must come from the app’s origin, and /set requires JSON with a valid, unexpired login token. SameSite=Strict means the cookie is not sent on an initial navigation from another site.
Custom passwordless login calls are validated more strictly. Calls to requestLoginTokenForUser may contain only selector, userData, and options at the top level. The selector must contain exactly one non-empty id, username, or email. Handle validation errors and too-many-requests responses.
Custom passwordless user-token flows now enforce 2FA and single use. Tokens supplied through Accounts.onCreateLoginToken require a valid 2FA code when enabled and cannot be reused after consumption.

Internal API changes

Accounts.onUsersCollectionChanged(callback) lets account packages refresh their setup when the users collection is replaced. The callback receives the selected collection, PR#14272.
Build-plugin output hashes now include an explicitly supplied hash, allowing compilers to invalidate cached output when auxiliary inputs such as source maps change, PR#14776.
tools-core adds helpers for installing dependencies with the app’s package manager: getDependencyInstallContext, formatInstallCommands, renderManualInstallInstructions, and pnpm/Yarn command helpers, PR#14421.
rspack adds version constants for its dev server and SWC dependencies: DEFAULT_RSPACK_DEV_SERVER_VERSION and DEFAULT_METEOR_RSPACK_SWC_CORE_VERSION, PR#14360.
Package authors can register TypeScript definitions and submodules with api.types(). Meteor preserves these definitions when building and publishing packages, PR#14699.
The Meteor tool exposes its top-level command list for shell completion, PR#14551.
DDP transport adapters must send queued messages before close() finishes. The uWebSockets adapter now uses end() for this, PR#14747.
tools-core adds parseMeteorAppPort(). Its existing getMeteorAppPort() helper now returns only the port digits, without the host or URL prefix, PR#14743.

Migration Steps

Before updating, prepare your local database: back up existing data and set MongoDB 7's FCV to 7.0 while still running MongoDB 7. Follow the MongoDB upgrade prerequisites. External databases configured through MONGO_URL are not upgraded by Meteor. Check the installation requirements as well. Then update:

bash

meteor update --release 3.6

Update the Meteor release to receive the complete security fixes. A package-only update on an older release does not include the new EJSON minor version and its companion Mongo and Minimongo fixes.

Check the parts your app uses:

Native Google/Facebook sign-in: verify that SDK tokens belong to the configured app. For Google, configure the SDK to send an ID token for your web client, or add your own Android/iOS client IDs to additionalClientIds in the Google service configuration. See the package migration guidance.
Custom deployment endpoints: explicitly configure DEPLOY_HOSTNAME only for a deployment server you trust.
Custom users collections: set Accounts.config({ collection }) early, before clients connect. Review the default profile update rule and confirm the account indexes were created; index-creation errors are logged.
Native npm dependencies: rebuild and test them with Node.js 26 before deploying.
Rspack: run meteor run to install the required versions listed above. If automatic installation is disabled, use the install command Meteor prints. Review custom rspack.config.js settings against the migration guide.
HttpOnly login cookies: enable useHttpOnlyCookies on the server. Custom cookie requests must use the app’s origin, send JSON and a valid token to /set, and handle rate limits. Test sign-in flows reached through links from other sites because the cookie now uses SameSite=Strict.
Custom passwordless login calls: use the payload described above and handle 400 validation errors and too-many-requests responses.
Custom passwordless user-token flows: use Meteor.passwordlessLoginWithTokenAnd2faCode for accounts with 2FA enabled, and request a new login token after the previous token has been consumed. User-level tokens do not verify an email address.
Native TypeScript types (optional): follow the setup guide to switch providers, run meteor types, and configure your project. You can keep your current type provider during this upgrade.
Package shrinkwrap files: the first build refreshes each Meteor package’s npm dependencies once. If your app tracks packages/*/.npm/package/npm-shrinkwrap.json, commit the rewritten files.

Bumped Meteor Packages

accounts-2fa@3.1.1
accounts-base@3.4.0
accounts-facebook@1.3.5
accounts-github@1.5.2
accounts-google@1.4.2
accounts-meetup@1.5.2
accounts-meteor-developer@1.5.2
accounts-oauth@1.4.8
accounts-password@3.3.2
accounts-passwordless@3.1.2
accounts-twitter@1.5.3
accounts-weibo@1.4.2
allow-deny@2.1.2
autoupdate@2.0.2
babel-compiler@7.15.2
base64@1.0.15
binary-heap@1.0.14
boilerplate-generator@2.2.0
browser-policy-common@1.0.14
callback-hook@1.8.1
check@1.5.1
ddp@1.4.3
ddp-client@3.4.2
ddp-common@1.4.6
ddp-rate-limiter@1.3.1
ddp-server@3.6.0
diff-sequence@1.2.1
dynamic-import@0.8.1
ecmascript@0.19.2
ejson@1.4.1
email@3.2.1
facebook-oauth@1.12.1
facts-base@1.0.3
facts-ui@1.0.3
fetch@0.2.1
force-ssl-common@1.1.2
geojson-utils@1.0.13
github-oauth@1.4.3
google-oauth@1.5.1
hot-module-replacement@0.6.1
id-map@1.2.1
instrumentation@0.0.1
inter-process-messaging@0.1.4
logging@1.3.7
meetup-oauth@1.1.4
meteor@2.3.2
meteor-developer-oauth@1.3.4
meteor-tool@3.6.0
minifier-js@3.3.2
minimongo@2.2.1
modern-browsers@0.2.4
mongo@2.6.0
mongo-id@1.0.10
npm-mongo@6.18.1
oauth@3.0.5
oauth-encryption@1.3.4
oauth1@1.5.4
ordered-dict@1.2.1
promise@1.0.1
random@1.2.3
rate-limit@1.2.1
reactive-dict@1.3.3
reload@1.3.3
retry@1.1.2
roles@1.1.1
routepolicy@1.1.3
rspack@1.4.0
server-render@0.4.5
service-configuration@1.3.6
session@1.2.4
sha@1.0.11
shell-server@0.7.2
socket-stream-client@0.7.2
standard-minifier-js@3.3.0
test-in-browser@1.6.2
test-in-console@2.2.0
tools-core@1.4.0
tracker@1.3.5
twitter-oauth@1.3.5
typescript@5.11.2
url@1.3.7
webapp@2.4.0
webapp-hashing@1.1.3
weibo-oauth@1.3.4

Bumped NPM Packages

compression@1.8.2
body-parser@1.20.9
@meteorjs/babel@7.20.2
@meteorjs/rspack@3.0.0
@meteorjs/swc-core@1.16.2

Special thanks to

✨✨✨

PR authors and source contributors:

@hexsprite
@nachocodoner
@dupontbertrand
@italojs
@mvogttech
@sanki92
@Grubba27, and for implementing the proxy-header fix and dependency updates.
@StorytellerCZ
@perbergland
@cyphercodes
@YadavAkhileshh
@zodern
@julio-rocketchat
@boomfly
@Julusian
@kobihikri

Reviewers and design contributors:

Issue reporters and reproduction contributors:

Meteor's continued development is supported by our sponsors. Thank you:

Support Meteor through the Meteor Sponsorship Program.

✨✨✨

v3.5.4, 2026-10-27

Highlights

Prevent crafted proxy headers from crashing or stalling production apps using force-ssl, while preserving HTTPS and local-connection detection. Parser fix
Update webapp compression to 1.8.2 and OAuth body parsing to 1.20.9. HTTP responses can now use Brotli when clients advertise br; gzip-only clients retain gzip. Dependency updates
Keep generated Rspack development and production HTML out of test builds, preventing stale chunk references and browser errors after switching modes.
Honor release-required package wrap versions when resolving indirect dependencies.
Consume email-verification and passwordless tokens atomically to prevent concurrent reuse, and enforce two-factor authentication for user-level passwordless tokens. Changes
Preserve document fields such as __proto__ as own data throughout EJSON conversion, document diffs, Minimongo updates, and MongoDB replication, and prevent update paths from traversing inherited properties. Changes
Preserve document ownership fields when processing oplog replacement events. Changes
Prevent inherited object properties from being treated as registered DDP methods or publications. Changes
Report the remote client address correctly with the uws DDP transport, including connections forwarded through Meteor's local WebSocket proxy. Changes
Avoid an extra credential-bearing MongoDB connection during startup, and omit the connection URL from malformed MONGO_URL warnings. Changes
Update the bundled Node.js runtime to 24.22.1 and npm to 11.19.1. Changes

Breaking Changes

accounts-passwordless: Custom login integrations using user-level tokens delivered to Accounts.onCreateLoginToken must now supply a two-factor authentication code when two-factor authentication is enabled. These flows can no longer bypass that check.

Internal API changes

ddp-server: Method and publication handler registries now have null prototypes. Extensions that inspect these internal registries must not depend on inherited Object.prototype members.
npm-mongo: Startup validation parses MONGO_URL without opening an additional connection. Actual database connectivity is established through the normal MongoDB connection path.

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.5.4

Update the Meteor release to receive the complete security fixes. A package-only update on an older release does not include the new EJSON minor version and its companion Mongo and Minimongo fixes.

Passwordless integrations: Supply the required two-factor authentication code when signing in with a user-level token for an account with two-factor authentication enabled. Treat login tokens as single-use credentials and request a fresh token after one has been consumed.
uWS deployments: Review custom IP-based rate limits or access checks that use clientAddress. For deployments behind external proxies, keep HTTP_FORWARDED_COUNT consistent with the trusted proxy chain; do not add a hop for Meteor's internal uWS connection. See HTTP_FORWARDED_COUNT.

Bumped Meteor Packages

force-ssl-common@1.1.1_1
oauth@3.0.4_1
webapp@2.3.0_1
accounts-password@3.3.1_1
accounts-passwordless@3.1.1_1
ddp-server@3.5.0
diff-sequence@1.2.0
ejson@1.4.0
meteor-tool@3.5.4
minimongo@2.2.0_1
mongo@2.5.1_1
npm-mongo@6.18.0
rspack@1.3.1

Bumped NPM Packages

compression@1.8.2
body-parser@1.20.9
npm@11.19.1

Special thanks to

✨✨✨

@italojs, for implementing and integrating the security fixes.
@nachocodoner, for updating the runtime bundle and validating passwordless token races.
@Grubba27, for implementing the proxy-header fix and dependency updates, and reviewing and testing account-token fixes.

✨✨✨

v3.5.3, 2026-10-13

Highlights

Validate Google and Facebook direct-login tokens against the application's OAuth configuration, use provider-verified Google identity fields, and keep Facebook verification errors from exposing the app secret.
Prevent server crashes caused by invalid DDP protocol-handler names and unhandled asynchronous handler rejections.
Include all modified top-level fields in allow/deny checks, closing a field-authorization bypass.
Bound dynamic-import request size and complexity, batch large legitimate module graphs, and limit failed module reads and logging.
Keep meteor shell history and compilation caches private on POSIX systems, and keep the app running when private history persistence is unavailable.
Restrict deploy destinations returned by discovery to trusted HTTPS Galaxy servers before sending account credentials, while preserving HTTP discovery for first deploys.

Breaking Changes

google-oauth: Native sign-in that directly supplies an iOS or Android access token without serverAuthCode must list that client in additionalClientIds, or supply a Google-validated idToken for an accepted client and the same user. Google email and picture data no longer fall back to client-supplied fields; apps must request the corresponding scopes.
dynamic-import: Oversized or malformed requests now receive HTTP 413 or 400. The updated client batches large valid graphs, but already-open clients running older code may need a refresh during a rolling deployment. Individual module paths must fit the new enforced limits.
allow-deny: Update validators now receive __proto__ in the modified-field list instead of omitting it. Review validators that rely on that list.
Deploy discovery now rejects destinations outside Galaxy's HTTPS deploy domain. Custom deploy servers must be selected explicitly through DEPLOY_HOSTNAME; that override remains trusted with the account credentials.

Internal API changes

DDP protocol dispatch accepts only string names for handlers defined directly on the handler table. Extensions that inherit protocol handlers must define them directly.

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.5.3

Google sign-in: For native access-token sign-in without serverAuthCode, set additionalClientIds in the server's Google service configuration to your application's iOS and Android OAuth client IDs, or send a matching idToken that Google can validate for an accepted client. Request email and profile scopes if your app needs those fields. Allow outbound access to oauth2.googleapis.com when using ID-token validation, alongside the existing Google API endpoints. The standard server authorization-code flow exchanges the code for tokens before validation.
Dynamic imports: Deploy the updated client and server together. If older open clients fail to load a large uncached module graph after the server update, refresh them to load the client that batches requests.
Allow/deny: Check validators that restrict updates by field name, including applications that intentionally use a top-level __proto__ field.
Meteor shell: If a permissions warning appears, check ownership and permission support for .meteor/local/shell. The shell continues without persistent history when it cannot ensure privacy, and compilation runs without disk caching when the cache cannot be made private.
Deploy: Review any DEPLOY_HOSTNAME override and trust its destination before supplying account credentials. Automatic discovery still tries HTTP when HTTPS discovery fails, including first deploys before a site has a certificate; the discovery-selected deploy server must use trusted Galaxy HTTPS.

Bumped Meteor Packages

allow-deny@2.1.1
ddp-server@3.4.1
dynamic-import@0.8.0
facebook-oauth@1.12.0
google-oauth@1.5.0
shell-server@0.7.1
meteor-tool@3.5.3

Bumped NPM Packages

N/A

Special thanks to

✨✨✨

@italojs, for implementing and adapting the fixes.
@Grubba27 and @nachocodoner, for reviewing dynamic-import.
Vext Labs, for the OAuth vulnerability disclosure.

✨✨✨

v3.5.2, 2026-09-04

Highlights

Improve Meteor-Rspack reliability, correctness, and performance, PR#14643, PR#14678
- Preserve top-level await and build the correct client and server bundles in full-app tests, PR#14405, PR#14575, PR#14653. These changes address reports #14066, #14371, #14395, and #14561, whose investigation and reproduction were developed in PR#14562.
- Isolate concurrent development and test builds that share an application directory, and preserve their generated output across watcher processes, PR#14576, PR#14674.
- Keep persistent caches warm across modes and build contexts, reduce rebuild statistics overhead, and load the SWC native binding only when needed, PR#14569, PR#14578. These changes address the low-risk improvements from report #14568.
- Resolve hoisted Rspack CLI installations, track TypeScript configuration dependencies, clean linker caches correctly, bound ignored-extension scanning, and fail immediately if a Rspack process exits or panics before its first compilation, PR#14641, PR#14645, PR#14646, PR#14574, PR#14581.
- Discover eager tests when an application's absolute path contains a private segment, preventing full-app Rspack tests from silently reporting zero passing tests, PR#14693, issue #14688.
Add a shared tools-core dependency manager and let Rspack install required npm dependencies automatically, with actionable instructions when automatic installation is disabled, PR#14492.
Upgrade to Cordova CLI 13 and cordova-android@15.1.0, update Android native testing, and preserve local Cordova plugin paths containing encoded or reserved characters, PR#14487.
Update meteor-node-stubs to 1.2.30 with bundled qs@6.16.0 to address GHSA-q8mj-m7cp-5q26, GHSA-4mjr-xmp4-gh2g, and GHSA-x5fp-wj9c-mxmx, PR#14485, PR#14708, issues #14484 and #14707.
Expose the HttpOnly cookie endpoints only when useHttpOnlyCookies is enabled and reject oversized request bodies, PR#14657, issue #14654.
Prevent change stream observers from replaying events already covered by a causal primary snapshot, avoiding intermittent login disconnects, PR#14697, issue #14695.
Redact credentials from invalid MONGO_URL warnings and respect the connection string's TLS settings during the startup compatibility check, PR#14658, issue #14400.
Follow the browser page protocol when deriving the default DDP connection URL, preventing failed connections when the page and ROOT_URL use different protocols, PR#14640, issue #14635.
Stop watching immutable package warehouse files, reducing native watcher consumption and preventing macOS FSEvent stream exhaustion, PR#14672, issue #14671.
Compute client manifest size, hash, and SRI values from the exact bytes written to disk after source-map URL processing, PR#14482, continuing PR#14476 and issue #10710.
Remove the transitive jquery dependency from test-in-browser, allowing Blaze tests to run with or without jQuery when it is supplied explicitly, PR#14308.

All Merged PRs@GitHub PRs 3.5.2

Meteor Mocha Changelog: meteortesting:mocha@3.4.0

Breaking Changes

Cordova Android builds now use cordova-android@15.1.0 and require Android SDK Platform 36 and Build Tools 36.0.0.
test-in-browser@1.6.0 no longer supplies jquery transitively. Tests that need jQuery must declare it explicitly or use --extra-packages=jquery.

Internal API changes

tools-core adds shared helpers for detecting, installing, and reporting required npm dependencies, PR#14492.

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.5.2

Cordova Android users must install SDK Platform 36 and Build Tools 36.0.0:

bash

sdkmanager 'platforms;android-36' 'build-tools;36.0.0'

Package tests that need jQuery must declare it explicitly or run with --extra-packages=jquery.

Bumped Meteor Packages

accounts-base@3.3.1
babel-compiler@7.15.1
ddp-client@3.4.1
ecmascript@0.19.1
meteor-tool@3.5.2
minifier-js@3.3.1
mongo@2.5.1
npm-mongo@6.16.3
rspack@1.3.0
test-in-browser@1.6.0
tools-core@1.3.0
typescript@5.11.1

Bumped NPM Packages

@meteorjs/rspack@2.2.0
meteor-node-stubs@1.2.30

Special thanks to

✨✨✨

PR authors, contributors, and reviewers:

Issue reporters and reproduction contributors:

Meteor's continued modernization also depends on sponsors who make long-term investment in the framework possible. Thank you to our current sponsors:

If Meteor has helped you build and grow, consider supporting what comes next through the Meteor Sponsorship Program.

✨✨✨

v3.5.1, 2026-08-04

Highlights

Rspack

Reliably free the Rspack dev server port when the app is stopped — including SIGTERM/SIGHUP from Docker, process managers, and IDE stop buttons, not just Ctrl+C — so the next meteor run no longer fails with a port-in-use error, PR#14406
Fix a Rspack dev-mode memory leak where meteor-tool grew on every rebuild PR#14464
Remove the critical elliptic vulnerability from the Rspack toolchain PR#14584

Change Streams & MongoDB

Automatically recover from an infinite change-stream restart loop (and re-sync missed events) when MongoDB reports the change-stream history was lost PR#14607
Fix method calls (such as login) hanging forever under change streams when a method writes a collection and triggers new observers on it in the same call, PR#14564
Fix methods hanging forever ("change stream catching up took too long") when an app uses multiple MongoDB connections that share a collection name, PR#14602
Fix a publication crash (TypeError) when a collection's publication strategy is changed at runtime between a document being added and removed, PR#14540
Subscriptions using a nested-object projection no longer crash under change streams — they fall back to oplog/polling as before, PR#14518
Prevent an oplog-tailer crash (Unknown command) when unqualified admin-database drop/create operations appear in the oplog (e.g. Percona hot-backups), PR#14519
Clearer error when MONGO_OPLOG_URL points at a replica set that hasn't been initialized yet — it now tells you to run rs.initiate(), PR#14520
Fix TypeScript type resolution for the mongo package so tools like zodern:types pick up the bundled MongoDB v6 driver types instead of falling back to outdated @types/meteor, PR#14422

More reliable reconnections

Unsubscribing during a brief disconnect now takes effect after reconnect, instead of dropping the unsub and leaving the subscription streaming on the server, PR#14542
Stop firing a phantom browser disconnect event on every reconnect attempt, PR#14532
Fix a memory leak where DDP.connect() connections were never released after close(), PR#14538
Run a subscription's current onStop callback on stop, so re-subscribing with a new onStop in a reactive rerun no longer fires the stale one, PR#14544
Stopping the same subscription or observer more than once no longer silently breaks other live queries on that collection, PR#14536
Silently discard malformed DDP messages instead of throwing in the client's message handler, PR#14530
Fix session-resumption edge cases so brief disconnects reconnect cleanly and buffered updates arrive in order, PR#14528
Restore client write batching so multi-document updates apply together instead of flickering through intermediate states, PR#14526

Improvements

The current method name is now available via this.name inside server methods, even when invoked with server-side Meteor.callAsync, PR#14478
Add an opt-in packages.webapp.skipCompressionWithContentLength setting to leave responses that already declare a Content-Length uncompressed, so the header survives behind CDNs/proxies, PR#14588
Update accounts-password hashing dependencies (bcrypt 6.0.0, argon2 0.44.0) for upstream security fixes; existing password hashes stay valid and no action is required on Node 20+, PR#14407
Compile server code to es2022 on modern Node for smaller, faster output (async/await is no longer down-leveled to generator helpers), PR#14369
Silence the Node deprecation warnings (url.parse / util._extend) that appeared in the terminal during meteor run and builds, and make the Rspack dev proxy more resilient, PR#14558

Fixes

Force-kill the old app process on dev restart when it ignores SIGTERM — previously it leaked across restarts and kept holding the port, PR#14516
Deliver runtime updates to Meteor.settings.public to clients that connect after the change, PR#14515
Fix a server crash (TypeError: Invalid URL) triggered by any client sending a malformed request URL such as //, PR#14598
Stop the legacy heartbeat watchdog from force-disconnecting healthy native-WebSocket connections (arm it only on the SockJS transport), PR#14546
Fix abandoned WebSocket upgrades exhausting the dev proxy's connection pool and wedging normal HTTP requests through meteor --port, PR#14386
Fix meteor build hanging indefinitely when the file watcher hits an EINTR interrupted syscall (common in Docker/CI) — it now falls back to polling, PR#14450
Fix package assets added with api.addAssets being wrongly treated as compilable source files, which could abort the build with a spurious compile error, PR#14566
Surface lazy compilation errors as build failures instead of silently swallowing them into a runtime Cannot find module, PR#14491
Fix binding the server to an IPv6 host producing a malformed ROOT_URL that broke Meteor.absoluteUrl(), PR#14553
Fix mongo and webapp TypeScript definitions so they type-check under TypeScript 6/7 (tsgo), PR#14556
Fix the modern (rspack) build for apps that use app-local symlinked packages/modules in a monorepo (opt in via resolve.symlinks: false), PR#14442
Enable the modern Cordova/Capacitor bundle by default when meteor.modern isn't set (previously fell back to the legacy bundle), PR#14411

All Merged PRs@GitHub PRs 3.5.1

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.5.1

Bumped Meteor Packages

meteor-tool@3.5.1
accounts-password@3.3.1
babel-compiler@7.15.0
ddp-client@3.4.0
ddp-server@3.4.0
ecmascript@0.19.0
inter-process-messaging@0.1.3
minifier-js@3.3.0
mongo@2.5.0
npm-mongo@6.16.2
rspack@1.2.0
socket-stream-client@0.7.1
tools-core@1.2.0
typescript@5.11.0
webapp@2.3.0

Bumped NPM Packages

@meteorjs/rspack@2.1.0

Our Sponsors

Meteor is made possible by our amazing sponsors. Support the project and get your logo featured by visiting our Sponsorship page.

🌟 Supernova Sponsors

🌌 Nebula Sponsors

CodeRabbit

Special thanks to

✨✨✨

v3.5.0, 2026-06-30

Highlights

Features

MongoDB Change Streams, PR#13787
- 📉 Major resource savings and a significant throughput boost — app servers handle far more concurrent users, subscriptions, and method calls per instance, often shrinking the fleet (and the bill) needed to serve the same load
- MongoDB version requirement bumped for Change Streams — Change Streams now require MongoDB 6+ with a replica set or sharded cluster (previously 3.6+). Apps on older MongoDB versions will automatically fall back to oplog or polling. (9a0720b8)
- ☁️ Real-time reactivity now works on managed and serverless MongoDB tiers (Atlas Shared, serverless) where oplog access isn't available — no more being forced into expensive polling
- 🛡️ More resilient under load — narrowly scoped subscriptions stay fast even on busy collections, and the system gracefully falls back to another driver if change streams aren't usable
- ✅ Enabled by default in 3.5 — most apps benefit immediately on upgrade with no code changes (see Migration Steps to revert)
- 📃 Documentation
DDP Session Resumption, PR#14051
- 📱 Smoother UX on real-world networks — mobile handoffs, sleeping tabs, and flaky Wi-Fi no longer cause the UI to flicker, lose state, or re-fetch everything
- ⚡ Faster reconnects — pending method calls are not lost and active subscriptions pick up where they left off, so users don't see spinners or stale data after a blip
- 🧠 Less wasted server work — short disconnects no longer trigger full re-publish/re-subscribe cycles, reducing CPU spikes from large reconnect storms
- 🎚️ Tunable to your traffic — adjust the grace period and message-queue limit per app to balance responsiveness, memory, and presence semantics
Pluggable DDP Transport Architecture, PR#14231
- 🎯 Pick the right trade-off for your app — maximum compatibility (sockjs, default) for public traffic behind strict proxies, or lower latency and higher throughput (uws) for internal/controlled deployments
- 🚀 Faster, lighter real-time on uws — noticeable latency wins on hot reconnects and higher message throughput per server, especially valuable for dashboards and chat-like workloads
- 🔧 Switch with a single env var or settings flag — no application code changes, easy to A/B and roll back
- 🧱 Future-proof — additional transports can be added without touching app code or DDP itself
- 📃 Documentation
Authenticated REST endpoints with accounts-express, PR#14091
- 🔐 Build authenticated REST/Express endpoints as first-class citizens of a Meteor app — protected routes can read Meteor.userId() and Meteor.user() exactly like methods and publications, removing a long-standing gap between DDP-based auth and REST surfaces
- 🧩 Drop-in Accounts.auth() middleware to gate routes on authentication or your own custom conditions, so existing Express integrations no longer need bespoke token-parsing code
- 🌐 New client helper sends the auth token automatically on requests to protected endpoints, making it easy to consume your own authenticated APIs from Meteor clients without manual header juggling
- 📃 New accounts-express package ships out of the box
Async DDPRateLimiter Rule Matchers, PR#14182
- 🧠 Smarter, context-aware rate limiting — gate methods and subscriptions by user role, billing tier, feature flag, or any value you need to fetch from the database, without ugly workarounds
- 🛡️ Stronger abuse protection without overblocking legitimate users, since rules can now reflect who is calling, not just how often
Fully Functional DISABLE_SOCKJS Mode, PR#14206
- 🪶 Drop the SockJS layer entirely on deployments that don't need polling fallback — smaller client bundle, fewer handshake round-trips, and a cleaner network path end-to-end
MongoDB Collation Support, PR#14188
- 🔍 Reliable case-insensitive search and locale-aware sorting out of the box — international/accented text behaves the way users expect, with no custom regex tricks or duplicated lowercase fields
- 🤝 Consistent results client-side and server-side — optimistic UI in Minimongo matches what the server returns, eliminating "looks right offline, wrong after sync" bugs
- ⚡ Performance-friendly — case-insensitive queries no longer silently fall back to polling, keeping reactivity fast on busy collections

Improvements

Upgrade to Node.js 24.15.0 & NPM 11.12.1, PR#14176, PR#14399
EJSON Performance Optimizations:
- Zero-clone stringifyDDP to reduce allocations in DDP message serialization, PR#14213
- Copy-on-write toJSONValue/fromJSONValue to reduce allocations, PR#14209
- Fast-path primitive comparisons in EJSON.equals, PR#14208
- Early bail-out on key count mismatch in EJSON.equals, PR#14205
- Avoid array allocation in lengthOf utility, PR#14204
Replace deprecated url.parse() with WHATWG new URL() API across packages and tools, PR#14248
Set change streams as the default reactivity mechanism, PR#14217
Asyncify client-side calls in accounts-base to align with Meteor's async API model, PR#14069
Add Meteor.loginWithPasswordAsync and Meteor.loginWithTokenAsync for promise-based login flows that fit naturally inside async/await code, PR#14070
Replace node-2fa with OTPAuth in accounts-2fa for better maintenance and standards compliance, PR#14321
Replace http-proxy with http-proxy-3 to get an actively maintained proxy implementation, PR#13916
Upgrade @mapbox/node-pre-gyp from 1.0.11 to 2.0.3, PR#14101
Warn when Accounts.emailTemplates.from is not configured to prevent silent email failures, PR#14044
Bump uWebSockets.js to v20.66.0 in ddp-server for improved stability of the uws DDP transport, PR#14330
Update email package dependencies, PR#14028
Add TypeScript type declarations for accounts-express package, PR#14433
Remove legacy isMeteorPre144 shim and semver dependency from babel-compiler — dead code for Meteor versions before 1.4.4 (released in 2017), PR#14382

Fixes

Fix ObjectID fields sent as binary when using projection with change streams, PR#14238
Fix DDP connection latency regression from dynamic SockJS import, PR#14229
Fix default DDP connection URL for mirror domains, PR#14189
Fix forEachAsync and mapAsync behavior in minimongo to match server, PR#14021
Improve change streams synchronization by passing a specific fence to writes, PR#14362
Close race conditions in ChangeStreamObserveDriver so events are no longer dropped during snapshot, restart, or watch() setup — preventing stuck DDP write fences and missing added/changed messages, PR#14389
Fall back to polling for change-stream cursors that use skip/limit, PR#14389
Preserve all uws transport listeners across close/data events in ddp-server, PR#14389
Stop forwarding METEOR_ALLOW_SUPERUSER as NPM_CONFIG_UNSAFE_PERM in the CLI, PR#14389
Remove unnecessary NPM_CONFIG_NODEDIR env var to fix npm 11+ warning, PR#14239
Fix uws transport settings handling and prevent port collisions in ddp-server, PR#14425
Fix race condition in Accounts HttpOnly cookie login completion that could leave a session unauthenticated, PR#14469

All Merged PRs@GitHub PRs 3.5

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.5

Change streams are now the default reactivity mechanism — no configuration is required to enable them. If you need to revert to the previous behavior, configure the reactivity order in your settings.json to force oplog:

json

{
  "packages": {
    "mongo": {
      "reactivity": ["oplog", "polling"]
    }
  }
}

Check out the change streams documentation for more details.

Change streams require MongoDB 6+ with a replica set or sharded cluster.

Bumped Meteor Packages

meteor-tool@3.5.0
accounts-2fa@3.1.0
accounts-base@3.3.0
accounts-express@1.0.0
accounts-oauth@1.4.7
accounts-password@3.3.0
accounts-passwordless@3.1.1
babel-compiler@7.14.1
base64@1.0.14
binary-heap@1.0.13
callback-hook@1.8.0
ddp-client@3.3.0
ddp-common@1.4.5
ddp-rate-limiter@1.3.0
ddp-server@3.3.0
ecmascript@0.18.1
ejson@1.2.0
email@3.2.0
fetch@0.2.0
force-ssl@1.1.2
meteor@2.3.1
minifier-css@2.0.2
minifier-js@3.2.1
minimongo@2.2.0
mongo@2.4.0
oauth@3.0.4
oauth1@1.5.3
rate-limit@1.2.0
session@1.2.3
socket-stream-client@0.7.0
tinytest@1.4.1
typescript@5.10.1
url@1.3.6
webapp@2.2.0

Bumped NPM Packages

N/A

Special thanks to

✨✨✨

v3.4.3, 2026-10-27

Highlights

Prevent crafted proxy headers from crashing or stalling production apps using force-ssl, while preserving HTTPS and local-connection detection. Parser fix
Update webapp compression to 1.8.2 and OAuth body parsing to 1.20.9. HTTP responses can now use Brotli when clients advertise br; gzip-only clients retain gzip. Dependency updates
Honor release-required package wrap versions when resolving indirect dependencies.
Prevent concurrent reuse of email-verification and Meteor-generated passwordless login tokens, and enforce configured two-factor authentication for user-level passwordless tokens. Security backports.
Preserve prototype-named fields as ordinary data through EJSON, Minimongo, change notifications and Meteor's MongoDB integration, including projections, authorization checks and oplog replacements. Field-boundary fixes, oplog replacement fix.
Reject inherited, unregistered DDP method and publication names while preserving explicitly registered names. Security backports.
Remove the extra MongoDB startup connection that bypassed certificate validation, and keep connection strings out of invalid-URL warnings. Security backports.
Upgrade the dev bundle to Node.js 22.23.4 and npm 10.9.9. Bundle update.

Breaking Changes

accounts-passwordless: Custom login flows using user-level tokens from Accounts.onCreateLoginToken must now provide a valid second-factor code when 2FA is enabled for the user.

Internal API changes

DDP method and publication registries now have null prototypes. Extensions accessing these internal tables must not rely on inherited object methods; use Object.prototype.hasOwnProperty.call(registry, name) instead of registry.hasOwnProperty(name).

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.4.3

Update the Meteor release to receive the complete security fixes. A package-only update on an older release does not include the new EJSON minor version and its companion Mongo and Minimongo fixes.

If you use user-level tokens delivered through Accounts.onCreateLoginToken, ensure custom login flows supply a valid two-factor code when 2FA is enabled. These tokens are single-use and do not verify an email address. Successful use also invalidates the email codes from the same issuance; request a new token after it has been consumed.
Check extensions accessing internal DDP method or publication registries for inherited-object assumptions.

Bumped Meteor Packages

force-ssl-common@1.1.1_1
oauth@3.0.2_1
webapp@2.1.3
accounts-password@3.2.4
accounts-passwordless@3.1.0_1
ddp-server@3.2.2
diff-sequence@1.1.4
ejson@1.3.0
minimongo@2.1.1
mongo@2.3.1
npm-mongo@6.17.0
meteor-tool@3.4.3

Bumped NPM Packages

compression@1.8.2
body-parser@1.20.9
npm@10.9.9

Special thanks to

✨✨✨

@italojs, for implementing and adapting the security fixes.
@nachocodoner, for the Node.js and npm bundle update, reproductions and substantive review.
@Grubba27, for implementing the proxy-header fix and dependency updates, and testing and reviewing the account-token fixes and release consolidation.

✨✨✨

v3.4.2, 2026-10-13

Highlights

Validate Google and Facebook direct-login tokens against the application's OAuth configuration, use provider-verified Google identity fields, and keep Facebook verification errors from exposing the app secret.
Prevent server crashes caused by invalid DDP protocol-handler names and unhandled asynchronous handler rejections.
Include all modified top-level fields in allow/deny checks, closing a field-authorization bypass.
Bound dynamic-import request size and complexity, batch large legitimate module graphs, and limit failed module reads and logging.
Keep meteor shell history and compilation caches private on POSIX systems, and keep the app running when private history persistence is unavailable.
Restrict deploy destinations returned by discovery to trusted HTTPS Galaxy servers before sending account credentials, while preserving HTTP discovery for first deploys.

Breaking Changes

google-oauth: Native sign-in that directly supplies an iOS or Android access token without serverAuthCode must list that client in additionalClientIds, or supply a Google-validated idToken for an accepted client and the same user. Google email and picture data no longer fall back to client-supplied fields; apps must request the corresponding scopes.
dynamic-import: Oversized or malformed requests now receive HTTP 413 or 400. The updated client batches large valid graphs, but already-open clients running older code may need a refresh during a rolling deployment. Individual module paths must fit the new enforced limits.
allow-deny: Update validators now receive __proto__ in the modified-field list instead of omitting it. Review validators that rely on that list.
Deploy discovery now rejects destinations outside Galaxy's HTTPS deploy domain. Custom deploy servers must be selected explicitly through DEPLOY_HOSTNAME; that override remains trusted with the account credentials.

Internal API changes

DDP protocol dispatch accepts only string names for handlers defined directly on the handler table. Extensions that inherit protocol handlers must define them directly.

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.4.2

Google sign-in: For native access-token sign-in without serverAuthCode, set additionalClientIds in the server's Google service configuration to your application's iOS and Android OAuth client IDs, or send a matching idToken that Google can validate for an accepted client. Request email and profile scopes if your app needs those fields. Allow outbound access to oauth2.googleapis.com when using ID-token validation, alongside the existing Google API endpoints. The standard server authorization-code flow exchanges the code for tokens before validation.
Dynamic imports: Deploy the updated client and server together. If older open clients fail to load a large uncached module graph after the server update, refresh them to load the client that batches requests.
Allow/deny: Check validators that restrict updates by field name, including applications that intentionally use a top-level __proto__ field.
Meteor shell: If a permissions warning appears, check ownership and permission support for .meteor/local/shell. The shell continues without persistent history when it cannot ensure privacy, and compilation runs without disk caching when the cache cannot be made private.
Deploy: Review any DEPLOY_HOSTNAME override and trust its destination before supplying account credentials. Automatic discovery still tries HTTP when HTTPS discovery fails, including first deploys before a site has a certificate; the discovery-selected deploy server must use trusted Galaxy HTTPS.

Bumped Meteor Packages

allow-deny@2.1.1
ddp-server@3.2.1
dynamic-import@0.8.0
facebook-oauth@1.12.0
google-oauth@1.5.0
shell-server@0.7.1
meteor-tool@3.4.2

Bumped NPM Packages

N/A

Special thanks to

✨✨✨

@italojs, for implementing and adapting the fixes.
@Grubba27 and @nachocodoner, for reviewing dynamic-import.
Vext Labs, for the OAuth vulnerability disclosure.

✨✨✨

v3.4.1, 2026-04-28

Highlights

Rspack Improvements

Pin @meteorjs/rspack to v2.x in Meteor 3.4.1, PR#14365
- 📦 Bumps the minimum @meteorjs/rspack requirement from ^1.0.0 to ^2.0.0 across all core packages, skeletons, and docs
- 🚧 v1.1.x introduced significant changes to config defaults. Without this bump, Meteor 3.4 users running npm install @meteorjs/rspack@^1.0.0 could silently pick up incompatible defaults and hit a broken build
- 🔗 Each Meteor release now pins to a major of @meteorjs/rspack (Meteor 3.4 → v1, Meteor 3.4.1 → v2). A future release may further restrict to a specific minor (e.g., 2.x.x) so breaking changes are clearer
- ⚠️ @meteorjs/rspack semver is independent of @rspack/core / @rspack/cli; keeping them in sync is not practical because the Meteor integration may have different needs
- 🔄 Existing apps pick up v2 automatically after running meteor update --release 3.4.1, followed by meteor run or meteor update --npm
Enable automatic CSS delegation to Rspack, PR#14257
Add support for swc.config.ts configuration files, PR#14150, PR#14233
Support running multiple Rspack instances via METEOR_LOCAL_DIR to isolate build contexts, PR#14165
Support server-only apps with Rspack, PR#14171
Serve sw.js files during development (HMR), PR#14255
Simplify Rspack build logs, PR#14158
Track local dependencies in rspack.config.js for cache invalidation, PR#14111
Fix tools-core error on certain environments and support NODE_ENV override, PR#14166
Ensure consistent POSIX-style paths to fix Windows Blaze issues, PR#14210
Inherit TOOL_NODE_FLAGS in Rspack processes, PR#14131
Skip Rspack HMR proxy middleware setup on Cordova, PR#14226
Disable Rspack HMR proxy in test mode to prevent WebSocket interference, PR#14329
Ensure Rspack child processes can find Meteor's bundled Node, PR#14336
Add skipLibCheck to avoid Rspack CLI type failure, PR#14094
Check if Preact is installed before adding React dependencies, PR#14268
Reduce resource usage in meteor test --full-app by running a single Rspack process, PR#14139
Resolve eager test ignore patterns relative to the project path and broaden ignore test coverage, PR#14148
Add Meteor.enablePortableBuild() for single-artifact deployments across environments, PR#14166
Add Service Worker and PWA support via the Workbox plugin, with HMR and offline-refresh fixes, PR#14344
Enable .html imports on the server config for Blaze apps, PR#14350
Bump @rsdoctor/rspack-plugin to v1.5.7, PR#14294

Features

Add getUserIdsInRoleAsync methods with tests, PR#14030
Add TypeScript + Tailwind skeleton, PR#14237
Revamp meteor create examples with dynamic fetching, --from-branch, and --from-dir options, PR#14266

Improvements

Update Blaze to v3.0.3 for SWC compatibility, speeding up the Blaze package build, PR#14354
Update to Node v22.22.1, PR#14219
Refactor callback-hook package with deduplication and bug fix in clear, PR#13861
Cache regex patterns in utils.js for improved performance, PR#14062
Add optional cookies property to CategorizedRequest type, PR#14085
Add support for dots in minimongo key names, PR#13975
Use concurrency-safe iteration in Minimongo async methods, PR#13927
Constrain TypeScript extension types to Document in collection extensions, PR#14105
Remove redundant await on returned promises in accounts-base, PR#14017, PR#14186
Remove import React from 'react' from project skeletons, PR#14041
Add IntelliJ IDEs icon, PR#14059
Improve TypeScript signatures and docs for defer functions, PR#14104
Update OAuth configuration instructions, PR#13947
Auto-detect branch and subdirectory in meteor create --from from GitHub, GitLab, and Bitbucket tree URLs, PR#14323
Delegate CSS processing to Rspack and switch to SCSS in the meteor create --full skeleton, PR#14324

Fixes

Await async onStop callbacks in DDP server to fix session memory leak, PR#14236
Handle deleted PostCSS dependency files gracefully, PR#14128
Fix meteor node using wrong Node.js version after git branch switch, PR#14144
Enable dev-bundle fast path on Apple Silicon Macs, PR#14146
Fix Cordova platforms detection to avoid modern/legacy mismatch, PR#14113
Remove Vary: User-Agent header from hashed assets, PR#14122
Handle quoted values in SERVER_NODE_OPTIONS, PR#14225
Skip CSS fragment identifiers in module warnings, PR#14079
Lazy-load vscode-nsfw to support RHEL 8 environments, PR#14058
Fix Cursor transform types in mongo.d.ts, PR#13774
Do not throw error on forgotPassword when ambiguousErrorMessages is set, PR#14060
Fix Watchman RootResolveError for symlinked packages, PR#14045
Fix getUsersInRoleAsync to handle assignment options correctly, PR#14014
Fix displaying Google Maps in mobile applications by preserving native globals in legacy polyfills
Remove unused _processOneDataMessage from DDP client
Fix bugs with test-in-console, PR#13000
Await async test driver start() in test_environment.js to prevent unhandled rejections, PR#14317
Disable hot-module-replacement client WebSocket in test modes to stop __meteor__hmr__/websocket console errors, PR#14333
Exclude transient .cache directory from node_modules during bundling to prevent ENOENT race conditions, PR#14339
Fix operator precedence bug in passwordValidator that could reject valid passwords, PR#14075, PR#14169

All Merged PRs@GitHub PRs 3.4.1

Breaking Changes

N/A

Internal API changes

Removed unused _processOneDataMessage method from DDP client Connection class

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.4.1

If you find any issues, please report them to the Meteor issues tracker.

Bumped Meteor Packages

meteor-tool@3.4.1
accounts-2fa@3.0.2
accounts-base@3.2.1
accounts-password@3.2.3
babel-compiler@7.14.0
callback-hook@1.7.0
ddp-client@3.2.0
ddp-server@3.2.0
ecmascript@0.18.0
ecmascript-runtime-client@0.13.0
facebook-config-ui@1.1.0
google-config-ui@1.1.0
hot-module-replacement@0.6.0
meetup-config-ui@1.1.0
meteor@2.3.0
meteor-developer-config-ui@1.1.0
minifier-js@3.2.0
minimongo@2.1.0
mongo@2.3.0
roles@1.1.0
rspack@1.1.0
server-render@0.4.4
standard-minifier-css@1.10.1
test-in-console@2.0.2
tinytest@1.4.0
tools-core@1.1.0
twitter-config-ui@1.1.0
typescript@5.10.0
webapp@2.1.2
weibo-config-ui@1.1.0

Bumped NPM Packages

@meteorjs/rspack@2.0.1

Special thanks to

✨✨✨

v3.4.0, 2026-01-30

Highlights

Meteor-Rspack Integration, PR#13910
- ⚡ New rspack atmosphere package (requires at least rspack@1.7.1) Orchestrates the full Rspack setup, including the development server and production builds.
- 📦 New @meteorjs/rspack npm package Provides a default rspack.config.js. Applications can extend or override this configuration with their own.
- 🛠️ New tools-core package Supplies runtime utilities for Meteor, designed to support this integration and future tool integrations.
- 🔑 Core updates Enhanced Meteor’s core to support the Rspack integration.
- ✅ Test suite additions Introduced tests for app skeletons and Meteor-Rspack features to ensure quality and reliability.
- 📃 Documentation Complete documentation section covering all details of the Meteor-Rspack integration, including migration guides, configuration helpers and more.
- Adopting Rspack gives you a faster build experience
- Adopting Rspack produces smaller bundle sizes through advanced tree shaking
- Adopting Rspack lets you extend your app with modern setups and tooling
Support for devOnly packages and Npm.devDepends to optimize production builds, PR#13797
Introduced Meteor.deferDev to optimize server startup during development, PR#14006
Optimize react-meteor-data Suspense hooks and isEqual checks, PR#456
Meteor runtime now shows --raw-logs by default, use --timestamps to keep timestamps, PR#13944
Integrate collection-extensions into core, PR#13830
Fix OPLOG includeCollections/excludeCollections when admin.$cmd happens, PR#13949
Report Mongo SIGILL crash errors, PR#13930
Fix bulk remove in LocalCollection to remove all items, PR#13965
Treat web.cordova as a modern architecture, PR#13983
Improve and beautify server error messages, PR#13848
Upgrade Accounts UI CSS (breaking visual change for accounts-ui users), PR#13840
Support NonEmptyString to check package, #12852
Update TypeScript definitions for async support in accounts-base, PR#13987
Fix an error when files have identical names with different cases, PR#13958
Add experimental config disableBoilerplateResponse to improve React SSR, PR#13855
Upgrade to Node v22.22.0, TypeScript 5.9.2 and SWC 1.15.3, PR#13997 and PR#13760

All Merged PRs@GitHub PRs 3.4

React Packages:

Breaking Changes

accounts-ui CSS has changed, PR#13840

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.4

To apply react-meteor-data changes:

bash

meteor add react-meteor-data@4.0.1

Add this to your package.json to enable the new modern build stack:

json

"meteor": {
  "modern": true
}

Check out the requirements for Meteor Bundler optimizations on existing apps.

Add rspack package to enable the Rspack Bundler integration:

bash

meteor add rspack

This package is added by default for new apps.

Check out the requirements for Rspack Bundler integration on existing apps.

📃 Modern Build Stack docs

☄️ Meteor Bundler optimizations docs

⚡ Rspack Bundler integration docs

If you find any issues, please report them to the Meteor issues tracker.

Bumped Meteor Packages

accounts-base@3.2.0
accounts-password@3.2.2
accounts-ui-unstyled@1.8.0
accounts-ui@1.5.0
babel-compiler@7.13.0
boilerplate-generator@2.1.0
ecmascript@0.17.0
meteor@2.2.0
minifier-js@3.1.0
minimongo@2.0.5
mongo@2.2.0
react-fast-refresh@0.3.0
rspack@1.0.0
shell-server@0.7.0
standard-minifier-css@1.10.0
standard-minifier-js@3.2.0
standard-minifiers@1.2.0
static-html@1.5.0
test-in-browser@1.5.0
tools-core@1.0.0
typescript@5.9.3
webapp@2.1.0
meteor-tool@3.4.0

Bumped NPM Packages

@meteorjs/rspack@1.0.0

Special thanks to

✨✨✨

v3.3.4, 2026-10-27

Highlights

Prevent crafted proxy headers from crashing or stalling production apps using force-ssl, while preserving HTTPS and local-connection detection. Parser fix
Update webapp compression to 1.8.2 and OAuth body parsing to 1.20.9. HTTP responses can now use Brotli when clients advertise br; gzip-only clients retain gzip. Dependency updates
Honor release-required package wrap versions when resolving indirect dependencies.
Enforce single-use email-verification and Meteor-generated passwordless login tokens, including concurrent attempts, and require configured two-factor authentication for user-level passwordless tokens. Security fixes
Handle fields such as __proto__ safely in EJSON, change detection, Minimongo, Meteor's MongoDB integration, and DDP method/publication registries. Security fixes
Remove the extra MongoDB startup connection that disabled certificate verification, and omit connection strings from invalid-URL warnings. Security fixes
Upgrade to Node.js 22.23.4 and npm 10.9.9. Bundle update
Pin the Solid and Vue application templates to jorgenvatle:vite 1.5.4 and meteor-vite 3.8.0. Solid template, Vue template
Make test-in-console wait for browser readiness and exit unsuccessfully on runner errors, with support for locally installed Puppeteer. Console runner

Breaking Changes

accounts-passwordless: Custom login flows using the user-level token exposed through Accounts.onCreateLoginToken now require a valid two-factor code when the account has two-factor authentication enabled.

Internal API changes

DDP method and publication registries now have null prototypes. Extensions inspecting these internal tables must not rely on inherited object methods.

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.3.4

Update the Meteor release to receive the complete security fixes. A package-only update on an older release does not include the new EJSON minor version and its companion Mongo and Minimongo fixes.

For custom user-level passwordless token flows, handle no-2fa-code by prompting for the authenticator code and retrying with Meteor.passwordlessLoginWithTokenAnd2faCode(selector, token, code, callback). A missing or invalid two-factor code does not consume the token; a successful login does.
Review extensions accessing internal DDP method or publication registries for reliance on inherited object properties.

Bumped Meteor Packages

force-ssl-common@1.1.1_1
oauth@3.0.2_1
webapp@2.0.8
accounts-password@3.2.1_1
accounts-passwordless@3.0.3
ddp-server@3.1.4
diff-sequence@1.1.4
ejson@1.3.0
minimongo@2.0.4_1
mongo@2.1.5
npm-mongo@6.17.0
test-in-console@2.1.0
meteor-tool@3.3.4

Bumped NPM Packages

compression@1.8.2
body-parser@1.20.9
npm@10.9.9
meteor-vite@3.8.0

Special thanks to

✨✨✨

@italojs, for consolidating the security fixes and updating the templates and console runner.
@nachocodoner, for preparing the Node.js/npm update and reviewing and validating the security fixes.
@Grubba27, for implementing the proxy-header fix and dependency updates, and reviewing and validating the authentication fixes.

✨✨✨

v3.3.3, 2026-10-13

Highlights

Validate Google and Facebook direct-login tokens against the application's OAuth configuration, use provider-verified Google identity fields, and keep Facebook verification errors from exposing the app secret.
Prevent server crashes caused by invalid DDP protocol-handler names and unhandled asynchronous handler rejections.
Include all modified top-level fields in allow/deny checks, closing a field-authorization bypass.
Bound dynamic-import request size and complexity, batch large legitimate module graphs, and limit failed module reads and logging.
Keep meteor shell history and compilation caches private on POSIX systems, and keep the app running when private history persistence is unavailable.
Restrict deploy destinations returned by discovery to trusted HTTPS Galaxy servers before sending account credentials, while preserving HTTP discovery for first deploys.

Breaking Changes

google-oauth: Native sign-in that directly supplies an iOS or Android access token without serverAuthCode must list that client in additionalClientIds, or supply a Google-validated idToken for an accepted client and the same user. Google email and picture data no longer fall back to client-supplied fields; apps must request the corresponding scopes.
dynamic-import: Oversized or malformed requests now receive HTTP 413 or 400. The updated client batches large valid graphs, but already-open clients running older code may need a refresh during a rolling deployment. Individual module paths must fit the new enforced limits.
allow-deny: Update validators now receive __proto__ in the modified-field list instead of omitting it. Review validators that rely on that list.
Deploy discovery now rejects destinations outside Galaxy's HTTPS deploy domain. Custom deploy servers must be selected explicitly through DEPLOY_HOSTNAME; that override remains trusted with the account credentials.

Internal API changes

DDP protocol dispatch accepts only string names for handlers defined directly on the handler table. Extensions that inherit protocol handlers must define them directly.

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.3.3

Google sign-in: For native access-token sign-in without serverAuthCode, set additionalClientIds in the server's Google service configuration to your application's iOS and Android OAuth client IDs, or send a matching idToken that Google can validate for an accepted client. Request email and profile scopes if your app needs those fields. Allow outbound access to oauth2.googleapis.com when using ID-token validation, alongside the existing Google API endpoints. The standard server authorization-code flow exchanges the code for tokens before validation.
Dynamic imports: Deploy the updated client and server together. If older open clients fail to load a large uncached module graph after the server update, refresh them to load the client that batches requests.
Allow/deny: Check validators that restrict updates by field name, including applications that intentionally use a top-level __proto__ field.
Meteor shell: If a permissions warning appears, check ownership and permission support for .meteor/local/shell. The shell continues without persistent history when it cannot ensure privacy, and compilation runs without disk caching when the cache cannot be made private.
Deploy: Review any DEPLOY_HOSTNAME override and trust its destination before supplying account credentials. Automatic discovery still tries HTTP when HTTPS discovery fails, including first deploys before a site has a certificate; the discovery-selected deploy server must use trusted Galaxy HTTPS.

Bumped Meteor Packages

allow-deny@2.1.1
ddp-server@3.1.3
dynamic-import@0.8.0
facebook-oauth@1.12.0
google-oauth@1.5.0
shell-server@0.6.3
meteor-tool@3.3.3

Bumped NPM Packages

N/A

Special thanks to

✨✨✨

@italojs, for implementing and adapting the fixes.
@Grubba27 and @nachocodoner, for reviewing dynamic-import.
Vext Labs, for the OAuth vulnerability disclosure.

✨✨✨

v3.3.2, 2025-09-01

Highlights

Async-compatible account URLs and email-sending coverage #13740
Move findUserByEmail method from accounts-password to accounts-base #13859
Return insertedId on client upsert to match Meteor 2.x behavior #13891
Unrecognized operator bug fixed #13895
Security fix for sha.js #13908

All Merged PRs@GitHub PRs 3.3.2

Breaking Changes

N/A

Cordova Upgrade

Enable modern browser support for Cordova unless explicitly disabled #13896

Internal API changes

lodash.template dependency was removed #13898

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.3.2

If you find any issues, please report them to the Meteor issues tracker.

Bumped Meteor Packages

accounts-base@3.1.2
accounts-password@3.2.1
accounts-passwordless@3.0.2
meteor-node-stubs@1.2.24
babel-compiler@7.12.2
boilerplate-generator@2.0.2
ecmascript@0.16.13
minifier@3.0.4
minimongo@2.0.4
mongo@2.1.4
coffeescript-compiler@2.4.3
npm-mongo@6.16.1
shell-server@0.6.2
typescript@5.6.6

Bumped NPM Packages

meteor-node-stubs@1.2.23

Special thanks to

✨✨✨

v3.3.1, 2025-08-05

Highlights

MongoDB Driver Upgrades
- Upgraded core MongoDB driver to 6.16.0 to address latest issues reported #13710
- Introduced npm-mongo-legacy to maintain compatibility with MongoDB 3.6 via mongodb@6.9.0 #13736
- Mitigated a cursor leak issue by synchronizing next() and close() operations #13786
Improved SWC integration
- Fixed edge cases in config cache invalidation #13809
- Ensured @swc/helpers is consistently used for better bundle size and performance #13820
- Updated to SWC 1.12.14 #13851
Tooling and Build System
- Fixed regression affecting rebuild behavior #13810
- Addressed issues getting performance profiles in mounted volumes #13827
- Fallback to Babel parser when Acorn fails to parse source code #13844
Mobile Support
- Upgraded Cordova platform to version 14 #13837
Developer Experience
- Added TypeScript types for isModern and getMinimumBrowserVersions functions #13704
- Enhanced CLI help output and documented admin commands #13826
Vite Tooling
- Updated official Meteor + Vite skeletons #13835
Runtime & Dependencies
- Updated to Node.js 22.18.0 and NPM 10.9.3 #13877
- Bumped meteor-node-stubs to 1.2.21 #13825

All Merged PRs@GitHub PRs 3.3.1

Breaking Changes

MongoDB Driver Upgrades

If you're using MongoDB 3.6 or earlier, install the new legacy package:

bash

meteor add npm-mongo-legacy

This will pin the MongoDB driver to 6.9.0 for compatibility.

If you’re on MongoDB 4+, the default MongoDB driver 6.16.0 is applied automatically.

Please migrate your database as soon as possible to MongoDB 5 onward, as MongoDB driver 6.17.0 will drop MongoDB 4 support. We’ll keep offering npm-mongo-legacy so you can keep getting Meteor updates with your existing MongoDB legacy version.

Cordova Upgrade

The Cordova platform has been upgraded to version 14. Refer to the Cordova Changelog for more details on the changes and migration steps.

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.3.1

While this is a patch release, Meteor 3.3, a recent minor update, introduced a modern build stack that’s now the default for new apps. Here’s how you can migrate to it.

Add this to your package.json to enable the new modern build stack:

json

"meteor": {
  "modern": true
}

Check the docs for help with the SWC migration, especially if your project uses many Babel plugins.

Modern Transpiler: SWC docs

If you find any issues, please report them to the Meteor issues tracker.

Bumped Meteor Packages

babel-compiler@7.12.1
callback-hook@1.6.1
ecmascript@0.16.12
minifier-js@3.0.3
minimongo@2.0.3
modern-browsers@0.2.3
mongo@2.1.3
npm-mongo-legacy@6.9.0
npm-mongo@6.16.0
standard-minifier-js@3.1.1
tinytest@1.3.2
typescript@5.6.5
meteor-tool@3.3.1

Bumped NPM Packages

meteor-node-stubs@1.2.21

Special thanks to

✨✨✨

v3.3.0, 2025-06-11

Highlights

Support SWC transpiler and minifier for faster dev and builds PR#13657, PR#13715
Switch to @parcel/watcher for improved native file watching PR#13699, #13707
Default to modern architecture, skip legacy processing PR#13665, PR#13698
Optimize SQLite for faster startup and better performance PR#13702
Support CPU profiling in Meteor 3 bundler PR#13650
Improve meteor profile: show rebuild steps and total, support --build PR#16, PR#13694
Improve useFind and useSubscribe React hooks
Add replaceEmailAsync helper to Accounts PR#13677
Fix user agent detection and oplog collection filtering
Refine type definitions for Meteor methods and SSR's ServerSink
Allow opting out of usage stats with DO_NOT_TRACK
Update Node to 22.16.0 and Express to 5.1.0

All Merged PRs@GitHub PRs 3.3

React Packages Changelog: react-meteor-data@4.0.0

Breaking Changes

File watching strategy switched to @parcel/watcher
- Most setups should be fine, but if issues appear, like when using WSL with host, volumes, or remote setups—switch to polling.
- Set METEOR_WATCH_FORCE_POLLING=true to enable polling.
- Set METEOR_WATCH_POLLING_INTERVAL_MS=1000 to adjust the interval.
react-meteor-data@4.0.0
- Independent from the core, only applies if upgraded manually.
- useFind describes no deps by default PR#431

Internal API changes

express@5.1.0 - Depends on Meteor’s webapp package.
- Deprecates non-native promise usage #154
- Use async/await or Promise.resolve when defining endpoints to avoid deprecation warnings.

Migration Steps

Please run the following command to update your project:

bash

meteor update --release 3.3

To apply react-meteor-data changes:

bash

meteor add react-meteor-data@4.0.0

Add this to your package.json to enable the new modern build stack:

json

"meteor": {
  "modern": true
}

These settings are on by default for new apps.

On activate modern your app will be updated to use SWC transpiler. It will automatically fallback to Babel if your code can't be transpiled wit SWC.

Check the docs for help with the SWC migration, especially if your project uses many Babel plugins.

Modern Transpiler: SWC docs

If you find any issues, please report them to the Meteor issues tracker.

Bumped Meteor Packages

accounts-base@3.1.1
accounts-password@3.2.0
autoupdate@2.0.1
babel-compiler@7.12.0
boilerplate-generator@2.0.1
ddp-client@3.1.1
ecmascript@0.16.11
ejson@1.1.5
meteor@2.1.1
minifier-js@3.0.2
modern-browsers@0.2.2
mongo@2.1.2
server-render@0.4.3
socket-stream-client@0.6.1
standard-minifier-js@3.1.0
typescript@5.6.4
webapp@2.0.7
meteor-tool@3.3.0

Bumped NPM Packages

meteor-node-stubs@1.2.17

Special thanks to

✨✨✨

v3.2.2, 2025-05-02

Highlights

Improved parsing of x-forwarded-for headers in Session._clientAddress:
- Changed header splitting method to handle comma-separated values more reliably
- Added explicit trimming of IP addresses with map function
- Modified validation check to require exact match for httpForwardedCount

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.2.2

Bumped Meteor Packages

ddp-server@3.1.1

Bumped NPM Packages

Special thanks to

✨✨✨

v3.2.0, 2025-03-18

Highlights

Upgrade to Node 22.14.0 & Mongo 7.0.16.
Implement meteor profile command to show performance metrics of Meteor apps.
Fix Meteor profiler to handle promises and display metrics correctly.
Support for argon2 to improve password security over bcrypt. PR(https://github.com/meteor/meteor/pull/13554)
Improve and fix package resolution logic. PR(https://github.com/meteor/meteor/pull/13604)
Fix rare oplog issue that could cause data loss for clients. PR(https://github.com/meteor/meteor/pull/13603)

All detailed PRs can be found here: https://github.com/meteor/meteor/pulls?q=is%3Apr+is%3Amerged+base%3Arelease-3.2

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.2

Bumped Meteor Packages

accounts-base@3.1.0
accounts-password@3.1.0
ecmascript-runtime-client@0.12.3
facebook-oauth@1.11.6
fetch@0.1.6
logging@1.3.6
logic-solver@3.1.0
minifier-css@2.0.1
meteor-tool@3.2.0
modern-browsers@0.2.1
mongo@2.1.1
oauth@3.0.2
test-helpers@2.0.3

Bumped NPM Packages

meteor-node-stubs@1.2.13

Special thanks to

✨✨✨

v3.1.2, 2025-02-06

Highlights

Node upgrade: v22.13.1
Updated Meteor skeletons for Vue and Solid
Improved browser detection and related documentation
Security updates: nodemailer-openpgp and others in Meteor packages

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.1.2

Bumped Meteor Packages

email@3.1.2
meteor-tool@3.1.2
modern-browsers@0.2.0
webapp@2.0.5

Bumped NPM Packages

N/A

Special thanks to

✨✨✨

v3.1.1, 2025-01-15

Highlights

Node upgrade: v22.13.0
Real-time Performance Boost: Refactored AsynchronousQueue for parallel processing and optimized MongoDB observers for faster initial document handling.
Allow/Deny Rules Update: Deprecated async rules and updated documentation and types.
Mongo Driver Downgrade: Reverted to a stable version to prevent issues in Meteor.
Support for Meteor.deprecate: Added deprecation warnings with stack trace for outdated code usage.
OAuth Fixes: Resolved issues with cancel popup event and callback.
Windows Fixes: Fixed issues with running from folders with spaces and post-npm install build errors on Windows.
Security Updates: Upgraded json5 and semver from babel compiler.

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.1.1

Bumped Meteor Packages

accounts-base@3.0.4
accounts-oauth@1.4.6
accounts-passwordless@3.0.1
allow-deny@2.1.0
babel-compiler@7.11.3
ddp-client@3.1.0
ddp-server@3.1.0
meteor-tool@3.1.1
facebook-oauth@1.11.5
meteor@2.1.0
meteor-tool@3.1.1
mongo@2.1.0
npm-mongo@6.10.2
oauth@3.0.1
roles@@1.0.1
socket-stream-client@0.6.0

Bumped NPM Packages

N/A

Special thanks to

✨✨✨

v3.1.0, 2024-11-20

Highlights

Upgrade to Node v22
Upgrade Mongo Driver to v6
Upgrade Express to v5
HMR performance improvements
Bring the roles package into the core
Solve remaining issues with Top Level Await and Reify
Refactor part of the real-time code in the mongo package into TypeScript
Deprecate underscore and eliminate it from packages
Fix Cordova dependency issues
Simplify Meteor.EnvironmentVariable and make sure it works in all cases
Stop using Rosetta for development MongoDB on Apple Silicon
Test improvements
Bump http package to 3.0.0

Breaking Changes

Express is now at v5 and some it's APIs have changed.

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.1

Make sure to migrate userland code to use the new Express APIs:

https://expressjs.com/en/guide/migrating-5.html

The MongoDB Node.js driver implemented a significant breaking change regarding operation handling. Applications leveraging rawCollection() or rawDatabase() methods must now utilize Promise-based syntax exclusively, as the callback-pattern API has been deprecated and removed. This modification affects all direct MongoDB operations previously using callback functions.

Bumped Meteor Packages

accounts-password@3.0.3
babel-compiler@7.11.2
boilerplate-generator-tests@1.5.3
ddp-client@3.0.3
ddp-server@3.0.3
http@3.0.0
ecmascript@0.16.10
email@3.1.1
meteor-tool@3.1.0
meteor@2.0.2
minifier-js@3.0.1
minimongo@2.0.2
modules@0.20.3
mongo@2.0.3
coffeescript-compiler@2.4.2
coffeescript@2.7.2
mongo-decimal@0.2.0
npm-mongo@6.10.0
shell-server@0.6.1
test-helpers@2.0.2
test-in-console@2.0.1
tinytest@1.3.1
typescript@5.6.3
url@1.3.5
webapp@2.0.4

Bumped NPM Packages

meteor-babel@7.20.1
meteor-installer@3.1.0
meteor-node-stubs@1.2.12

Special thanks to

✨✨✨

v3.0.4, 2024-10-15

Highlights

Node 20.18.0 & Typescript 5.6.2
Updated webapp dependencies.
DDP-server and DDP-client removed underscore
Remove dependencies on Blaze packages when using static-html
Fix Cordova on Windows
Fix Cordova build on using plugins describing dependencies
Various Windows specific fixes

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.0.4

Meteor Version Release

Bumped packages:
- accounts-base@3.0.3
- babel-compiler@7.11.1
- caching-compiler@2.0.1
- check@1.4.4
- ddp-client@3.0.2
- ddp-server@3.0.2
- ecmascript-runtime@0.8.3
- modules@0.20.2
- static-html-tools@1.0.0
- static-html@1.4.0
- url@1.3.4
- webapp@2.0.3
- meteor-tool@3.0.4

Special thanks to

N/A

v3.0.3, 2024-09-11

Highlights

Fixed Meteor.userId only being invoked with bindEnvironment.
Updated to Node 20.17.x.
Fixed an issue where meteor --open opens the browser before the app is started.
Investigated and addressed the error when installing the jam:method package.
Improved the message for new available versions when running an app.
Updated the documentation link inside install.sh.
Resolved the issue where subscriptions stopped after a parameter change.
Added MongoDB connection telemetry.
Bumped the email package to prevent update errors.
Cordova package updates

Breaking Changes

N/A

Internal API changes

Some internal changes to how async contexts are handled, ensuring better performance and garbage collection.

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.0.3

If you've had your Meteor installation for over a year, we suggest reinstalling it to avoid any package installation issues. You can do this by running a few quick commands:

bash

npx meteor uninstall // or rm -rf ~/.meteor
npx meteor

Meteor Version Release

Bumped packages:
- accounts-base@3.0.2
- accounts-password@3.0.2
- email@3.1.0
- mongo@2.0.2

Special thanks to

v3.0.2, 2024-08-14

Highlights

Bump the patch for some packages, so we publish them using Meteor 3 tooling. PR
Fix subscription still resetting documents PR
Fix auth sub sending ready twice on load PR
Remove version constraints from http package in accounts-twitter PR
Deprecate Meteor.user() usage on server side PR

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.0.2

Meteor Version Release

Bumped packages:
- accounts-2fa@3.0.1
- accounts-base@3.0.1
- accounts-password@3.0.1
- accounts-twitter@1.5.2
- ddp-client@3.0.1
- ddp-common@1.4.4
- ddp-server@3.0.1
- email@3.0.1
- meteor@2.0.1
- minimongo@2.0.1
- mongo@2.0.1
- npm-mongo@4.17.4
- test-helpers@2.0.1
- webapp@2.0.1

Special thanks to

For making this great framework even better!

v3.0.1, 2024-07-16

Highlights

Bump the patch for some packages, so we publish them using Meteor 3 tooling. PR

Breaking Changes

N/A

Internal API changes

N/A

Migration Steps

Please run the following command to update your project:

bash


meteor update --release 3.0.1

Meteor Version Release

Bumped packages:
- accounts-ui-unstyled@1.7.2
- crosswalk@1.7.3
- facebook-oauth@1.11.4
- npm-mongo@4.17.3
- package-version-parser@3.2.3
- twitter-config-ui@1.0.2

Special thanks to

@denihs.

For making this great framework even better!

v3.0, 2024-07-15

Highlights

Breaking Changes

Meteor tool
- 'meteor reset' command only affects the local project cache. Use --db option to also remove the local database.
accounts-2fa@3.0.0:
- Some methods are now async. See below:
- Accounts._is2faEnabledForUser
- (Meteor Method) - generate2faActivationQrCode
- (Meteor Method) - enableUser2fa
- (Meteor Method) - disableUser2fa
- (Meteor Method) - has2faEnabled
accounts-base@3.0.0:
- methods.removeOtherTokens is now async
- Accounts.destroyToken is now async
- Accounts.insertUserDoc is now async
- Accounts.updateOrCreateUserFromExternalService is now async
- Accounts.expirePasswordToken is now async
- Accounts.setupUsersCollection is now async
- Meteor.user is now async in server
accounts-facebook@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-github@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-google@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-meetup@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-meteor-developer@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-oauth@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-password@3.0.0:
- Some server methods are now async:
- Accounts.sendResetPasswordEmail
- Accounts.sendEnrollmentEmail
- Accounts.sendVerificationEmail
- Accounts.addEmail
- Accounts.removeEmail
- Accounts.replaceEmailAsync
- Accounts.verifyEmail
- Accounts.createUserVerifyingEmail
- Accounts.createUser
- Accounts.generateVerificationToken
- Accounts.generateResetToken
- Accounts.forgotPassword
- Accounts.setPassword -- no longer exists, you should use Accounts.setPasswordAsync PR
- Accounts.changePassword
- Accounts.setUsername
- Accounts.findUserByEmail
- Accounts.findUserByUsername
accounts-passwordless@3.0.0:
- Accounts.sendLoginTokenEmail is now async.
accounts-twitter@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-ui-unstyled@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
accounts-weibo@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
allow-deny@2.0.0:
- Updated to accept async functions.
appcache@2.0.0:
- Updated internal api to use handlers
audit-argument-checks@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
autopublish@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
autoupdate@2.0.0:
- Updated api to be async, with asyncronous queueing.
babel-compiler@8.0.0:
- Removed Promise.await default transform.
- Added top-level-await to packages.
babel-runtime@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
base64@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
binary-heap@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
Build system:
- removed Assets.getText
- removed Assets.getBinary
blaze@3.0.0:
- Todo
boilerplate-generator-tests@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
boilerplate-generator@2.0.0:
- toHTML is no longer available (it was already deprecated). Use toHTMLStream instead.
- Updated to use handlers
browser-policy-common@2.0.0:
- Updated to use handlers
browser-policy-content@2.0.0:
- Some methods are now async. See below:
  - BrowserPolicy.content.setPolicy
  - BrowserPolicy.content.allowInlineScripts
  - BrowserPolicy.content.disallowInlineScripts
  - BrowserPolicy.content.disallowAll
  - BrowserPolicy.setDefaultPolicy
browser-policy-framing@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
browser-policy@2.0.0: Updated to use async methods from browser-policy-common and browser-policy-content.
caching-compiler@2.0.0:
- afterLink is now async.
- Updated to use now async API.
callback-hook@2.0.0:
- Added forEachAsync method.
check@2.0.0:
- Removed fibers related tests.
constraint-solver@2.0.0:
- Some methods are now async. See below:
  - ConstraintSolver.getVersionCostSteps
  - ConstraintSolver.analyze
  - ConstraintSolver.resolve
- Updated tests to be async.
- Removed a few underscore usage.
- Added updated to use async methods
context@1.0.0:
- Removed fibers from package.
core-runtime@2.0.0:
- Created package to load packages and the app.
- This is the pakcages that sets up the Runtime.
crosswalk@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
ddp-client@3.0.0:
- Added isAsyncCall method to know if call is being made by a async method.
- Removed fibers from package.
- Updated tests to use async methods.
ddp-common@2.0.0:
- Added .fence option.
ddp-rate-limiter@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
ddp-server@3.0.0:
- Updated to use async methods.
- Removed fibers from package.
- Updated tests to use async methods.
- Turned server implementation to async.
ddp@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
diff-sequence@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
disable-oplog@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
ecmascript-runtime-client@1.0.0:
- Package was bumped due to a dependency update. No code changes were made.
ecmascript-runtime-server@1.0.0:
- Package was bumped due to a dependency update. No code changes were made.
ecmascript-runtime@1.0.0:
- Added dependency to @babel/runtime.
ecmascript@1.0.0:
- Added dependency to @babel/runtime.
- Moved runtime tests.
ejson@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
email@3.0.0:
- Email.send is no longer available. Use Email.sendAsync instead.
- Updated types to reflext async methods and Email.send depracation.
es5-shim@5.0.0:
- Package was bumped due to a dependency update. No code changes were made.
facebook-config-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
facebook-oauth@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
facts-base@2.0.0:
- turned unorderd deps on ddp to false.
facts-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
fetch@1.0.0:
- Package was bumped due to a dependency update. No code changes were made.
force-ssl-common@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
force-ssl@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
geojson-utils@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
github-config-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
github-oauth@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
google-config-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
google-oauth@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
hot-code-push@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
http@:
- Updated handlers to use handlers
id-map@2.0.0:
- Added forEachAsync method.
insecure@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
inter-process-messaging@1.0.0:
- Package was bumped due to a dependency update. No code changes were made.
launch-screen@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
localstorage@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
logging@2.0.0:
- Added dependency to @babel/runtime.
logic-solver@3.0.0: Logic.disablingAssertions is now async. minMaxWS is now async.
meetup-config-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
meetup-oauth@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
meteor-base@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
meteor-developer-config-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
meteor-developer-oauth@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
meteor-tool@3.0.0:
- Changes to how meteor apps are being created PR
meteor@2.0.0:
- Async local storage was added to help deal with async methods.
- Added promiseEmmiter to help with async methods.
- Removed fibers from package.
- Meteor.absoluteUrl in localhost uses 127.0.1 by default.
minifier-css@2.0.0:
- minifyCss is now async.
- Removed fibers from package.
minifier-js@3.0.0:
- minifyJs is now async.
- terserMinify no longer takes callbacks
- Removed fibers from package.

minimongo@2.0.0:
- cursor.observe now returns isReady and isReadyPromise wich indicates if the cursor is ready and if the callbacks are have been called. If you only use it in the Client or as a LocalCollection things have not changed.

mobile-experience@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
mobile-status-bar@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
modern-browsers@1.0.0:
- Package was bumped due to a dependency update. No code changes were made.
modules-runtime@1.0.0:
- Package was bumped due to a dependency update. No code changes were made.
modules@1.0.0:
- Updated reify version.
mongo-decimal@:
- Updated to use async methods.
mongo-dev-server@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
mongo-id@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
mongo-livedata@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
mongo@2.0.0:
- Updated to unify methods, update,insert,remove, fetch are now async, they are the same as their *Async counterpart.
- ensureIndex and createIndex are now async.
npm-mongo@5.0.0:
- Package was bumped due to a dependency update. No code changes were made.
oauth-encryption@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
oauth@:
- _endOfPopupResponseTemplate and _endOfRedirectResponseTemplate are no longer a property but now a function that returns a promise of the same value as before
- the following server methods are now async:
- OAuth._renderOauthResults
- OAuth._endOfLoginResponse
- OAuth.renderEndOfLoginResponse
- OAuth._storePendingCredential
- OAuth._retrievePendingCredential
- ensureConfigured
- _cleanStaleResults
oauth@3.0.0:
- Package was bumped due to a dependency update. No code changes were made.
oauth1@:
- the following server methods are now async:
- OAuth._storeRequestToken
- OAuth._retrieveRequestToken
oauth1@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
oauth2@:
- OAuth._requestHandlers['2'] is now async.
oauth2@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
ordered-dict@2.0.0:
- Added forEachAsync method.
package-stats-opt-out@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
package-version-parser@4.0.0:
- Package was bumped due to a dependency update. No code changes were made.
promise@1.0.0:
- Removed fibers usage
random@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
rate-limit@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
reactive-dict@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
reactive-var@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
reload-safetybelt@2.0.0:
- Added ecmascript package to package.js
reload@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
retry@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
routepolicy@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
server-render@1.0.0:
- Updated usage with getBoilerplate that are now async.
service-configuration@2.0.0:
- Updated to use createIndexAsync.
session@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
sha@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
shell-server@1.0.0:
- Updated to handle promises results.
socket-stream-client@1.0.0:
- Updated tests to handle async code.
spiderable@:
- Updated handlers to use handlers that are now using express
- removed fibers usage if flag is set to true
standard-minifier-css@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
standard-minifier-js@3.0.0:
- processFilesForBundle is now async.
standard-minifiers@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
static-html@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
test-helpers@2.0.0:
- Updated to use async methods.
- Removed fibers usage.
- Added possibliy to use async tests.
test-in-browser@2.0.0:
- Updated css to be in dark mode.
test-in-console@2.0.0:
- Updated log identation.
test-server-tests-in-console-once@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
tinytest-harness@1.0.0:
- Package was bumped due to a dependency update. No code changes were made.
tinytest@2.0.0:
- Added test name to logs.
- Removed fibers usage.
twitter-config-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
twitter-oauth@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
typescript@5.0.0:
- Package was bumped due to a dependency update. No code changes were made.
underscore-tests@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
underscore@2.0.0:
- Removed dependency in meteor package.
url@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
webapp-hashing@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
webapp@2.0.0:
- These methods are now async:
  - WebAppInternals.reloadClientPrograms()
  - WebAppInternals.pauseClient()
  - WebAppInternals.generateClientProgram()
  - WebAppInternals.generateBoilerplate()
  - WebAppInternals.setInlineScriptsAllowed()
  - WebAppInternals.enableSubresourceIntegrity()
  - WebAppInternals.setBundledJsCssUrlRewriteHook()
  - WebAppInternals.setBundledJsCssPrefix()
  - WebAppInternals.getBoilerplate
- Changed engine from connect to express and changed api naming to match express. See below:
- WebApp.connectHandlers.use(middleware) is now WebApp.handlers.use(middleware)
- WebApp.rawConnectHandlers.use(middleware) is now WebApp.rawHandlers.use(middleware)
- WebApp.connectApp is now WebApp.expressApp
- WebApp.addRuntimeConfigHook accepts async callbacks
weibo-config-ui@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.
weibo-oauth@2.0.0:
- Package was bumped due to a dependency update. No code changes were made.

New Public API

Build system PR:
- Assets.getTextAsync
- Assets.getBinaryAsync
accounts-base: (2.9+)
- Meteor.userAsync()
callback-hook:forEachAsync
- forEachAsync
ddp-server: (2.8+)
- Meteor.callAsync()
minifier-css: (2.9+)
- CssTools.minifyCssAsync()
mongo:
- Mongo.Collection: (2.8+)
  - createCappedCollectionAsync
  - createIndexAsync
  - dropCollectionAsync
  - dropIndexAsync
  - findOneAsync
  - insertAsync
  - removeAsync
  - updateAsync
  - upsertAsync
- Collection.Cursor: (2.8+)
  - countAsync
  - fetchAsync
  - forEachAsync
  - mapAsync
  - [Symbol.asyncIterator] so this code should work:
    js
```
for await (const document of collection.find(query, options)) /* ... */
```

Internal API changes

accounts-base:

_attemptLogin
_loginMethod
_runLoginHandlers

Upgraded node-gyp to v9.4.0
Upgraded node-pre-gyp to @mapbox/node-pre-gyp v1.0.11

New Internal API

accounts-password:

Accounts._checkPasswordAsync

Special thanks to

@StorytellerCZ

For making this great framework even better!

Changelog ​

v3.6.0, 2026-11-09 ​

Highlights ​

Features ​

Improvements ​

Fixes ​

Breaking Changes ​

Internal API changes ​

Migration Steps ​

Bumped Meteor Packages ​

Bumped NPM Packages ​

Special thanks to ​

v3.5.4, 2026-10-27 ​

Highlights ​

Breaking Changes ​

Internal API changes ​

Migration Steps ​

Bumped Meteor Packages ​

Bumped NPM Packages ​

Special thanks to ​

v3.5.3, 2026-10-13 ​

Highlights ​

Breaking Changes ​

Internal API changes ​

Migration Steps ​

Bumped Meteor Packages ​

Bumped NPM Packages ​

Special thanks to ​

v3.5.2, 2026-09-04 ​

Highlights ​

Breaking Changes ​

Internal API changes ​

Migration Steps ​

Bumped Meteor Packages ​

Bumped NPM Packages ​

Special thanks to ​

v3.5.1, 2026-08-04 ​

Highlights ​

Rspack ​

Change Streams & MongoDB ​

More reliable reconnections ​

Improvements ​

Fixes ​

Breaking Changes ​

Internal API changes ​

Migration Steps ​

Bumped Meteor Packages ​

Bumped NPM Packages ​

Our Sponsors ​

Special thanks to ​

v3.5.0, 2026-06-30 ​

Highlights ​

Features ​

Improvements ​

Fixes ​

Breaking Changes ​

Internal API changes ​

Migration Steps ​

Bumped Meteor Packages ​

Bumped NPM Packages ​

Special thanks to ​

v3.4.3, 2026-10-27 ​

Highlights ​

Breaking Changes ​

Internal API changes ​

Migration Steps ​

Bumped Meteor Packages ​

Bumped NPM Packages ​

Special thanks to ​

v3.4.2, 2026-10-13 ​

Highlights ​

Breaking Changes ​

Internal API changes ​

Migration Steps ​

Bumped Meteor Packages ​

Bumped NPM Packages ​

Special thanks to ​

v3.4.1, 2026-04-28 ​

Highlights ​

Rspack Improvements ​

Changelog

v3.6.0, 2026-11-09

Highlights

Features

Improvements

Fixes

Breaking Changes

Internal API changes

Migration Steps

Bumped Meteor Packages

Bumped NPM Packages

Special thanks to

v3.5.4, 2026-10-27

Highlights

Breaking Changes

Internal API changes

Migration Steps

Bumped Meteor Packages

Bumped NPM Packages

Special thanks to

v3.5.3, 2026-10-13

Highlights

Breaking Changes

Internal API changes

Migration Steps

Bumped Meteor Packages

Bumped NPM Packages

Special thanks to

v3.5.2, 2026-09-04

Highlights

Breaking Changes

Internal API changes

Migration Steps

Bumped Meteor Packages

Bumped NPM Packages

Special thanks to

v3.5.1, 2026-08-04

Highlights

Rspack

Change Streams & MongoDB

More reliable reconnections

Improvements

Fixes

Breaking Changes

Internal API changes

Migration Steps

Bumped Meteor Packages

Bumped NPM Packages

Our Sponsors

Special thanks to

v3.5.0, 2026-06-30

Highlights

Features

Improvements

Fixes

Breaking Changes

Internal API changes

Migration Steps

Bumped Meteor Packages

Bumped NPM Packages

Special thanks to

v3.4.3, 2026-10-27

Highlights

Breaking Changes

Internal API changes

Migration Steps

Bumped Meteor Packages

Bumped NPM Packages

Special thanks to

v3.4.2, 2026-10-13

Highlights

Breaking Changes

Internal API changes

Migration Steps

Bumped Meteor Packages

Bumped NPM Packages

Special thanks to

v3.4.1, 2026-04-28

Highlights

Rspack Improvements