Summary

Release v4.12.32 delivers several bug fixes, CI improvements, and TypeScript type updates. Key items include improved CI reporting for type and bundle-size checks, added AWS Lambda API Gateway v2 types, a fix for SSE Last-Event-ID handling, safer parsing of query/headers/params, CSP callback scoping, and extra Cloudflare Workers websocket tests.

Key Points

• CI: enable reports for type and bundle-size checks (#5148) — CI now surfaces type errors and bundle-size regressions.
• aws-lambda: add jwt and lambda authorizer types for API Gateway v2 (#5142) — TypeScript typings improved for Lambda + API Gateway v2 authorizers.
• sse: emit empty id field to reset Last-Event-ID (#5138) — fixes persistent Last-Event-ID issues on clients by explicitly resetting the ID when needed.
• parsing: use Object.create(null) when parsing query, headers, and params (#5161) — parsed objects no longer inherit from Object.prototype, reducing risk of key collisions and prototype pollution.
• secure-headers: keep CSP callbacks scoped to their header (#5147) — Content-Security-Policy callbacks won't leak or affect other headers.
• tests: add Cloudflare Workers websocket coverage for onClose, onError, send, and close (#5145) — increases test coverage for the websocket adapter; no runtime changes expected.

Upgrade Notes

• No breaking changes reported. Update to v4.12.32 to get fixes and improved type/CI visibility.
• TypeScript users will benefit from the new aws-lambda types for API Gateway v2.
• Review any custom code that relied on inherited properties from parsed query/headers/params; parsed objects are now plain dictionaries created with Object.create(null).