Key Points
- ReDoS mitigation in accept parsing
- JSX renderer supports function-based options
- Avoid deprecation on Node.js 24 for lambda-edge
Summary
Release v4.12.6 (2026-03-10) contains several bug fixes and small features focused on security, JSX compatibility, build configuration, and AWS Lambda@Edge behavior. Upgrade to pick up a ReDoS mitigation, improved JSX renderer options, and compatibility fixes for React 19 and Node.js 24 edge runtimes.
Key Points
- Security: replaced a regex-based split to mitigate a potential ReDoS vector (fix #4758). Action: update dependency and run security scans.
- JSX: renderer now supports function-based options and aligns link hoisting/dedupe behavior with React 19 (feat #4780, fix #4792). Action: review JSX renderer usage and test with React 19.
- Lambda@Edge: avoid using callback-style handlers that trigger deprecation warnings on NODEJS_24_X (fix #4782). Action: verify edge handler signatures when targeting Node.js 24.
- Build/dev: added tsconfig project references and a tsconfig.spec.json to improve TypeScript builds and tests (chore #4797, #4798). Action: re-run builds/tests and adjust local TypeScript config if necessary.
- Misc: several small fixes and contributor updates; see changelog for full details.