DEV Community

Yass1n
Yass1n

Posted on

bro.js v3.0.0 – What’s new

#javascript #node #typescript #web

Tired of flaky state leaking between tests or worrying about insecure defaults?

bro.js just hit v3.0.0 and brings a bunch of practical upgrades that let you focus on code, not on runtime quirks.

Edge & Web Standard Runtime

  • Separate entry points for Node (bro-framework), Next.js (bro-framework/next), and Edge/worker (bro-framework/edge).
  • No more node:crypto or node:fs in Edge – it now uses the native Web Crypto API and Response.json().
  • Guarded process.env lookups make the runtime portable for Cloudflare Workers and Next.js Edge.

Immutable Instance‑Scoped Engine

  • All global singletons are gone. State lives inside the createBro(config) or createServer() instance, giving you true isolation per request or tenant.

Strict TypeScript Contracts

  • Core context is generic‑typed via AppContext. No more any – you can type ctx.db, ctx.env, and ctx.user precisely.
  • Updated declaration files (src/index.d.ts, src/next.d.ts) now compile with zero errors.

Contract Studio (bro studio)

  • Generates strongly‑typed React Query hooks and MSW handlers straight from Zod schemas.
  • OpenAPI output now includes request/auth/multipart metadata and RFC 9457 problem details.

In‑Process Testing (bro.test())

  • A self‑contained HTTP testing harness that shuts down cleanly.
  • testRoute() lets you call a handler directly without starting a server.
  • Built‑in hooks for DB transaction rollbacks and fake timers.

Production Observability & Security

  • OpenTelemetry spans, metrics, and W3C trace propagation.
  • createPinoAdapter redacts PII (Authorization, Cookie) by default.
  • Scaffolding no longer embeds literal secrets. In production, a missing or short JWT secret crashes the app early.
  • CORS is now strict – you must provide an explicit allowlist.
  • API keys are hashed; OIDC and JWKS caching via jose.

Lifecycle Adapters & CLI

  • TaskManager now handles workers, dead‑letter queues, exponential backoff, and Redis lease locks.
  • PostgresAdapter is production‑ready, and S3/Local upload adapters are secure.
  • bro init scaffolds bro.config.js, a Dockerfile, Vitest config, and an example env file.
  • CLI commands (bro doctor, bro sdk, bro studio) all target the default routes/ folder.

All of this is aimed at making bro.js a solid, secure, and edge‑ready framework for production workloads. Give it a spin and let us know how it fits your stack!

Top comments (0)