bro.js v3.0.0 – What’s new

Tired of flaky state leaking between tests or worrying about insecure defaults?

bro.js just hit v3.0.0 and brings a bunch of practical upgrades that let you focus on code, not on runtime quirks.

Edge & Web Standard Runtime

• Separate entry points for Node (bro-framework), Next.js (bro-framework/next), and Edge/worker (bro-framework/edge).
• No more node:crypto or node:fs in Edge – it now uses the native Web Crypto API and Response.json().
• Guarded process.env lookups make the runtime portable for Cloudflare Workers and Next.js Edge.

Immutable Instance‑Scoped Engine

• All global singletons are gone. State lives inside the createBro(config) or createServer() instance, giving you true isolation per request or tenant.

Strict TypeScript Contracts

• Core context is generic‑typed via AppContext. No more any – you can type ctx.db, ctx.env, and ctx.user precisely.
• Updated declaration files (src/index.d.ts, src/next.d.ts) now compile with zero errors.

Contract Studio (bro studio)

• Generates strongly‑typed React Query hooks and MSW handlers straight from Zod schemas.
• OpenAPI output now includes request/auth/multipart metadata and RFC 9457 problem details.

In‑Process Testing (bro.test())

• A self‑contained HTTP testing harness that shuts down cleanly.
• testRoute() lets you call a handler directly without starting a server.
• Built‑in hooks for DB transaction rollbacks and fake timers.

Production Observability & Security

• OpenTelemetry spans, metrics, and W3C trace propagation.
• createPinoAdapter redacts PII (Authorization, Cookie) by default.
• Scaffolding no longer embeds literal secrets. In production, a missing or short JWT secret crashes the app early.
• CORS is now strict – you must provide an explicit allowlist.
• API keys are hashed; OIDC and JWKS caching via jose.

Lifecycle Adapters & CLI

• TaskManager now handles workers, dead‑letter queues, exponential backoff, and Redis lease locks.
• PostgresAdapter is production‑ready, and S3/Local upload adapters are secure.
• bro init scaffolds bro.config.js, a Dockerfile, Vitest config, and an example env file.
• CLI commands (bro doctor, bro sdk, bro studio) all target the default routes/ folder.

All of this is aimed at making bro.js a solid, secure, and edge‑ready framework for production workloads. Give it a spin and let us know how it fits your stack!