1.3.0 (2026-03-12)

🚀 New Features

• add botnet category and IP abuser detection (#5913) (d307e26)
• graduate experimental_detectPromptInjection to detectPromptInjection (#5920) (0e0e4c1)
• set minimum timeout when detectPromptInjection rule present (#5922) (36ec27e)

🧹 Miscellaneous Chores

• publish packages in topological dependency order (#5911) (3068548)

🔨 Build System

• deps-dev: bump tar from 7.5.10 to 7.5.11 in /examples/nextjs-app-dir-validate-email (#5916) (22784d4)
• deps-dev: bump tar from 7.5.10 to 7.5.11 in /examples/nextjs-ip-details (#5914) (e7f14ee)
• deps-dev: bump tar from 7.5.10 to 7.5.11 in /examples/nextjs-pages-wrap (#5915) (46a94ee)

1.2.0 (2026-03-06)

🚀 New Features

• add detect_prompt_injection rule (#5871) (b801a6b)
• filter: add support for local filter fields (#5819) (42e1a06)

🪲 Bug Fixes

• arcjet: better protectSignup error messages (#5797) (06267d9)
• arcjet: better error w/o rules (#5799) (57be82b)

🧹 Miscellaneous Chores

• add new bots to well-known bots list (#5801) (b4d3c32)
• remove nextjs-14-nextauth-4 example (#5820) (216543f)
• rename to reasonPromptInjection (#5902) (7b78000)

📚 Tests

• arcjet: remove unneeded type casts (#5798) (42616a9)

1.1.0 (2026-02-05)

🧹 Miscellaneous Chores

• add protect signup to astro example (#5785) (9a7880d)
• enable workflows on GH merge queue (#5786) (71a322c)
• fix semgrep alert in publish workflow (#5783) (0cc7a85)
• trunk fmt hasher.ts (#5784) (040b5e6)
• use a stable release again (db7d2a6)

⌨️ Code Refactoring

• use named exports (#5780) (bc3868d)

📚 Tests

• arcjet: add protectSignup tests (#5779) (006b368)
• arcjet: cover all lines (#5782) (79b4c18)
• arcjet: rework core tests (#5764) (64e37c2)
• protocol: update tests (#5770) (4401380)
• transport: add (#5781) (c0531fa)

1.1.0-rc (2026-02-03)

🚀 New Features

• arcjet: add support for serializable characeristics, fields (#5715) (9cff098)

🪲 Bug Fixes

• ip: prefer x-forwarded-for on unknown platforms (#5744) (9c02f9b)

📝 Documentation

• deno: link to sdk docs on website (#5731) (43ce456)
• fastify: link to sdk docs on website (#5734) (0507085)
• update example links in readmes (#5735) (6f10658)

🧹 Miscellaneous Chores

• add prerelease-type (#5751) (df66720)
• arcjet: add some clarifying notes (#5709) (48f6e33)
• arcjet: remove warning on zero local rules (#5726) (f3ae009)
• fastify: use Cidr type, remove unneeded comment (#5732) (9cf122e)
• fix example, docs, test use of protocol field (#5708) (e63ab49)
• fix typo, it’s ip.src (#5754) (750c217)
• protocol: client should get full request details (#5711) (88a1259)
• react-router: remove unneeded import (#5733) (5f9d1b6)
• react-router: remove unused type (#5736) (4dc9715)
• use prerelease versioning (#5743) (c56afa8)

⌨️ Code Refactoring

• arcjet: simplify internal code (#5703) (567b11b)
• examples: move characteristics to rules where possible (#4753) (ec55834)

📚 Tests

• analyze-wasm: add tests (#5690) (3f396f8)
• arcjet: add tests for allowing and denying invalid emails (#5769) (ed652f5)
• arcjet: rework validate email tests (#5742) (5823bde)
• bun: add (#5701) (cfcc825)
• deno: add (#5702) (3a25858)
• fastify: add (#5710) (3266158)
• node: add (#5713) (b0e4fd4)
• split arcjet.test.ts (#5689) (b4a7c14)

🔨 Build System

• add npm tag input for publish workflow (#5771) (1ffba81)
• deps-dev: bump fastify from 5.7.1 to 5.7.3 in /arcjet-fastify (#5755) (c996a0b)
• deps: bump tar from 7.5.6 to 7.5.7 in /examples/nuxt (#5727) (afee0e0)
• enable ignore-scripts (#5211) (2c14ff3)

1.0.0-beta.18 (2026-01-22)

⚠ BREAKING CHANGES

• arcjet: validate request details (#5655)

🚀 New Features

• sensitiveInfo: add sensitiveInfoValue field (#5678) (2263df7)

🪲 Bug Fixes

• arcjet: validate request details (#5655) (d43a4dc)

📝 Documentation

• contributing: describe publish flow (#5622) (6921e4c)

🧹 Miscellaneous Chores

• deprecate automatic body reading (#5679) (5f45291)
• examples: remove 3rd party examples (#5633) (1423f4f)
• tests: make simple server responses more granular (#5594) (5325949)

📚 Tests

• add tests for custom rules with no, optional, required extra fields (#5669) (3444528)
• logger: add tests (#5644) (6664747)

🔨 Build System

• deps-dev: bump tar from 7.4.3 to 7.5.3 in /examples/nextjs-bot-categories (#5652) (a83b417)
• deps-dev: bump tar from 7.4.3 to 7.5.3 in /examples/nextjs-pages-wrap (#5645) (dab263e)
• deps-dev: bump tar from 7.4.3 to 7.5.4 in /examples/nextjs-decorate (#5663) (b84e811)
• deps-dev: bump tar from 7.4.3 to 7.5.6 in /examples/nextjs-sensitive-info (#5668) (56e6356)
• deps-dev: bump tar from 7.5.3 to 7.5.6 in /examples/nextjs-pages-wrap (#5667) (6cf1bd6)
• deps: bump devalue from 5.3.2 to 5.6.2 in /examples/nuxt (#5641) (3a3ffba)
• deps: bump devalue from 5.5.0 to 5.6.2 in /examples/astro-integration (#5637) (7da77c2)
• deps: bump diff and astro in /examples/astro (#5664) (f17bb62)
• deps: bump h3 from 1.15.4 to 1.15.5 in /examples/astro-integration (#5653) (c2d1048)
• deps: bump h3 from 1.15.4 to 1.15.5 in /examples/nuxt (#5640) (740fdf1)
• deps: bump tar from 7.5.2 to 7.5.3 in /examples/nuxt (#5646) (b980e07)
• publish: remove tag event (#5623) (83df410)

1.0.0 (2026-01-22)

🧹 Miscellaneous Chores

• remove some unused code (a79cd5f)
• use stable versioning in release please (91a6f67)

✅ Continuous Integration

• Add missing linked packages (3702080)

1.0.0-beta.17 (2026-01-13)

⚠ BREAKING CHANGES

• add support for limits to web streams (#5589)
• arcjet: remove validateEmail block parameter (#5618)
• arcjet: improve types around custom entities (#5584)

🚀 New Features

• add support for limits to web streams (#5589) (effef3b)
• body: make limit optional (#5601) (b870932)

🪲 Bug Fixes

• arcjet: make getBody result required, use errors for problems (#5608) (7ed47a9)
• body: handle NaN in options (#5599) (37e0497)
• body: improve error messages (#5607) (a41c37f)
• bun: fail explicitly when body already read (#5579) (67b6400)

🏎️ Performance Improvements

• body: exit early if expected size exceeds limit (#5600) (3900caf)

📝 Documentation

• link to intro pages (#5597) (15b0510)
• link to list of sdks (#5598) (a5041d1)
• update links and lists in monorepo readme (#5596) (43de924)

🧹 Miscellaneous Chores

• add publish workflow (#5578) (8261c10)
• arcjet: remove validateEmail block parameter (#5618) (29788d0)

⌨️ Code Refactoring

• arcjet: improve types around custom entities (#5584) (f6951b7)

🔨 Build System

• examples: add @arcjet/body as a bun workspace entry (#5621) (2ba0305)
• only test built JavaScript files (#5581) (9770281)
• remove --dry-run in publish.yml (#5620) (9576a0b)

✅ Continuous Integration

• Add stub workflow to validate deployment environment (#5593) (32b8568)

1.0.0-beta.16 (2026-01-06)

⚠ BREAKING CHANGES

• env: remove unused apiKey utility function (#5454)

🚀 New Features

• astro: export ArcjetOptions type (#5583) (5bdc766)
• sync lists of env variables (#5456) (dfa9fd2)

🪲 Bug Fixes

• bun, deno: do not read from process.env (#5458) (e90d277)

🧹 Miscellaneous Chores

• env: remove unused apiKey utility function (#5454) (059c226)
• regenerate WebAssembly (#5526) (c97076b)
• Update WebAssembly for dependency upgrades (c7b4d7e)

📚 Tests

• add some tests for reading the request body (#5519) (b370ceb)

🔨 Build System

• type check all TypeScript files (#5582) (17769ee)
• update allowed-endpoints for step security (#5588) (960bdc4)

✅ Continuous Integration

• Allow release-please to run for 2 minutes (#5498) (d1cbac6)
• fix trunk hanging (#5467) (9338402)

1.0.0-beta.15 (2025-11-07)

⚠ BREAKING CHANGES

• handle phone numbers with paren groups while restricting groups (#5362)

🚀 New Features

• add x-arcjet-ip header in development (#5397) (b40da4f)
• ip: support cidr strings in proxies (#5394) (adf20ea)
• support firebase platform (#5392) (ca46d50)

🪲 Bug Fixes

• handle phone numbers with paren groups while restricting groups (#5362) (49658da)

1.0.0-beta.14 (2025-11-04)

⚠ BREAKING CHANGES

• drop Node.js 18 (#5364)

🧹 Miscellaneous Chores

• drop Node.js 18 (#5364) (9e4db59)

📚 Tests

• redact-wasm: add some end to end tests (#5309) (ee1b386), closes #5352

🔨 Build System

• deps-dev: bump vite from 6.3.6 to 6.4.1 in /examples/remix-express (#5353) (c2ce6a5)
• deps-dev: bump vite from 7.1.5 to 7.1.11 in /examples/react-router-middleware (#5313) (5ad6983)
• deps: bump better-auth and @better-auth/cli in /examples/nextjs-better-auth (#5287) (87b370c)
• deps: bump next-auth from 4.24.11 to 4.24.12 in /examples/nextjs-14-nextauth-4 (#5344) (d8415f4)
• deps: bump next-auth from 5.0.0-beta.29 to 5.0.0-beta.30 in /examples/nextjs-authjs-nosecone (#5343) (2c4c90b)
• deps: bump tar from 7.5.1 to 7.5.2 in /examples/nuxt (#5349) (66a7b80)
• deps: bump vite from 7.1.7 to 7.1.12 in /examples/nuxt (#5361) (d10b635)
• remove tsconfig from .release-please-manifest (#5274) (6fb42e6)
• remove unused env variable (#5304) (bfde88a)