- Fix multiple set-cookie headers #3508
- Replace aws-serverless-express with @h4ad/serverless-adapter #3325
- Added Hybrid Proxy support for local and ODS hybrid development [#3409] (#3409)
- Add extensibility hooks for SLAS private client proxy with
onSLASPrivateProxyReqandonSLASPrivateProxyRescallbacks #3411 - Remove exception when transfer-encoding: chunked #3439
- Fix chunked encoding option name #3440
- Add support for environment level base paths on /mobify routes #2892
- This feature introduces an AI-powered shopping assistant that integrates Salesforce Embedded Messaging Service with PWA Kit applications. The shopper agent provides real-time chat support, search assistance, and personalized shopping guidance directly within the e-commerce experience. #2658
- Disallow the SLAS private client proxy from handling trusted system on behalf of requests #3042
- Mask user not found messages to prevent user enumeration from passwordless login #3113
- Fix the logger so that it will now print out details of the given Error object #2486
- Only allow requests for
/shopper/auth/through the SLAS private client proxy. Also stop the proxy from swallowing SLAS errors #2608
- Disable CloudWatch metrics sender retries #2304
- Update PWA-Kit SDKs to v3.9.1 #2301
- Remove forced garbage collection on each invocation. Set
FORCE_GC=truefor the old behavior. #2285
- Fix stale service worker file that could cause requests to still use old Content-Security-Policy #2191
- Support Node 22 #2218
- Support Social Login, Passwordless Login, and Password Reset: update the default value for
applySLASPrivateClientToEndpointsoption #2250
- Add proxy handling for trusted agent on behalf of (TAOB) requests #2077
- Encode non ASCII HTTP headers when
encodeNonAsciiHttpHeadersflag is set to true inssr.jsin the retail react app #2009 - Add x-forwarded-host header into res locals, which can be used to build an app origin #2050
- Add logger to print logs generated by PWA Kit packages #1822
- Memoize
getConfigon the server-side #1800 - Added the
x-correlation-idresponse header, which is set to the MRT correlation ID. This enhances traceability by including the correlation ID from the request in the response. #1787 - Keep API Gateway headers in proxied requests #1772
- Hide x-sfdc-access-control header #1805
- Update SLAS private proxy path #1752
- Update engine compatibility to include npm 10 #1597
- Revert mandatory enforcement of Content-Security-Policy headers. Provide middleware as an opt-in replacement. #1528
// your-project/app/ssr.js
import {defaultPwaKitSecurityHeaders} from '@salesforce/pwa-kit-runtime/utils/middleware'
const {handler} = runtime.createHandler(options, (app) => {
app.use(defaultPwaKitSecurityHeaders)
// ...
}- Move Content-Security-Policy logic to pwa-kit-runtime #1457
- Allow setting cookies using the
MRT_ALLOW_COOKIESenvironment variable #1318 - Fix potential security vulnerability in
semverdependency #1358
- Package name changed to
@salesforce/pwa-kit-runtime - Changes to accomodate Template Extensibility. Read the upgrade guide [#1224]the upgrade guide
- Remove usage of
detect-device-typedue to deprecation of user agent string. #1168 - Update engines to drop npm 7, and requires Node to start from version 16.11 #1166
The older versions below were published without the @salesforce namespace.
- Add optional parameter to override configuration folder used in
getConfig#1049 - Moved the MRT reference app to the SDKs, so that we can verify eg. Node support #966
- Support Node 16 #965
- Security package updates
- Logging cid from res header isntead of req in local development #821
- Replace morgan stream to use console.log #847
- Performance: Skip retries when flushing CloudWatch metrics, prioritize returning a response instead. 720
- Add Correlation ID to SCAPI requests. #728
- Drop node 12 support for #589
- Improve test coverage #550
- Make the createApp API idiomatic for Express, fix service-worker loading. #536
- Add environment specific configuration support via
getConfig. #447 - Remove legacy remote proxy, which allowed remote environments to use proxy configs in package.json #425
- Remove default
body-parsermiddleware from express server. #444