GeezerVison

- [Security (1.17.2)](#security-1172)

- [Fixed (1.17.2)](#fixed-1172)

- [Changed (1.17.2)](#changed-1172)

- [\[1.17.1\] - 2026-09-28](#1171---2026-09-28)

- [\[1.17.1\] - 2026-09-30](#1171---2026-09-30)

- [Security (1.17.1)](#security-1171)

- [Fixed (1.17.1)](#fixed-1171)

- [Changed (1.17.1)](#changed-1171)

- **Server**: with the default cookie attributes the CSRF cookie is `__Host-bq.csrf` instead of `bq.csrf`. Server-side verification needs no change; a form rendered before the upgrade fails once with `403`, as after a secret rotation. Client code that reads the cookie directly (unsigned double-submit) must use the new name or pass `cookieName: 'bq.csrf'`.

- **Server**: with the default cookie attributes the session cookie is `__Host-bq.sid` instead of `bq.sid`. Sessions issued before the upgrade are not read any more, so **users are logged out once**. Accepting the old name as a fallback would reopen session swapping. To keep existing sessions for a transition period, pass `cookieName: 'bq.sid'` and switch later.

A security-and-correctness patch closing a full-codebase audit. Three security fixes in `server` and `ssr`, ten bug fixes across `core`, `router`, `server`, `reactive`, `forms`, `store`, `component` and `view`. No API removals and no module status transitions; the behaviour changes worth checking before upgrading are listed under [Changed](#changed-1171).

Version **1.17.1** is a security-and-correctness patch that closes a full-codebase audit of 1.17.0: three security fixes in `server` and `ssr`, and ten bug fixes across `core`, `router`, `server`, `reactive`, `forms`, `store`, `component` and `view`.

It contains **no API removals** and **no module status transitions**. A handful of fixes change observable behaviour; they are collected under [Upgrading](#upgrading).

::: tip

The full, per-entry list lives in the [CHANGELOG](https://github.com/bQuery/bQuery/blob/main/CHANGELOG.md#1171---2026-09-28). For how each affected API is meant to be used, follow the module guides linked from each section.

The full, per-entry list lives in the [CHANGELOG](https://github.com/bQuery/bQuery/blob/main/CHANGELOG.md#1171---2026-09-30). For how each affected API is meant to be used, follow the module guides linked from each section.

:::

- Full [CHANGELOG](https://github.com/bQuery/bQuery/blob/main/CHANGELOG.md#1171---2026-09-28)

- Full [CHANGELOG](https://github.com/bQuery/bQuery/blob/main/CHANGELOG.md#1171---2026-09-30)

- [1.17.0 release notes](/release-notes/1.17)

- [Security policy](https://github.com/bQuery/bQuery/blob/main/SECURITY.md) · [Supported Runtimes](/concepts/runtimes)

| Version | Date | Highlights |

| ------------------------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| [1.17.2](/release-notes/1.17.2) | 2026-10-01 | Security patch: `csrf()` and `session()` name their cookies `__Host-bq.csrf` and `__Host-bq.sid` by default, so a sibling subdomain can no longer plant them. Users are logged out once; client code that reads the CSRF cookie needs the new name. |

| [1.17.1](/release-notes/1.17.1) | 2026-09-28 | Security-and-correctness patch: `serveStatic` sidecar containment, Node adapter no longer crashes on a throwing handler and cancels streams on disconnect, signed CSRF tokens bound to the session. Router params decoded, encoded static routes match, `css()` camelCase, `toggle()` on `[hidden]`, Trusted Types for components, linear-time `email()`. |

| [1.17.1](/release-notes/1.17.1) | 2026-09-30 | Security-and-correctness patch: `serveStatic` sidecar containment, Node adapter no longer crashes on a throwing handler and cancels streams on disconnect, signed CSRF tokens bound to the session. Router params decoded, encoded static routes match, `css()` camelCase, `toggle()` on `[hidden]`, Trusted Types for components, linear-time `email()`. |

| [1.17.0](/release-notes/1.17) | 2026-09-25 | `server` gains `serveStatic()` and `rateLimit()`; `sanitizeHtml()` works without a DOM; opt-in glitch-free reactive scheduler plus a flush-ordering fix that applies to `batch()` by default. Packaging: `require('@bquery/bquery')` works, sub-path types resolve, JS source maps dropped. One path break — `dist/full.umd.js` is now `dist/full.umd.cjs`. |

| [1.16.1](/release-notes/1.16.1) | 2026-08-26 | Toolchain-and-build maintenance patch: Bun floor moves to `1.4.0`, dev dependencies refreshed, Vite configs build warning-free (`import.meta.dirname`, `node:http` stub). No source or API changes. |

| [1.16.0](/release-notes/1.16) | 2026-08-11 | Quality-and-performance release: batching spans transitive updates, computeds notify only on real value changes, hot-path allocation cuts across reactive/DOM/view, `undelegate()` leak and `bq-model` caret fixes, `watchThrottle` `trailing` option. No breaking changes. |