parcel-bundler/parcel v2.16.2 → v2.16.4

This release is a small security and bugfix update on top of v2.16.3. The main user-facing change is a new dev server flag to turn off CORS headers, alongside a fix for <svg> handling in optimized builds.

What's new

  • Adds a --no-cors option for the dev server and HMR server so you can disable CORS headers when needed. This addresses the information-exposure issue tracked in #10216 and closes #10138. (#10268)
  • Fixes RSC behavior in a few places: module cache keys now include the pipeline so a require does not return the wrong exports, transformers that set inlineType: 'string' work with RSC, and CSS is preloaded as soon as the RSC payload loads instead of waiting for mount. (#10245)

Fixes

  • Preserves sibling elements after an <svg> tag in optimized builds, where <p> siblings could disappear during parcel build. (#10234)

Other notable changes

  • Bumps react-server-dom-parcel from 19.1.0 to 19.1.2. (#10244)
  • Bumps node-forge from 1.3.1 to 1.3.2. (#10242)

Contributors

@devongovett @TjeuKayim @dependabot[bot]

View on GitHub →