16.x → 17.0.0, entry by entry
Three breaking entries, and all three are the same sweep: a numeric option that used to accept
NaN, ±Infinity, a fraction or a negative now refuses it. The refusal is at boot or at the call
boundary, never mid-request, so one bun test or one x verify surfaces every one of them at
once and each fix: line carries the edit.
An app passing real numbers is unaffected. An app that was passing NaN was not working: the
bound it declared was not being enforced, and nothing said so. ?? guards nullish, and NaN is
not nullish — so Number(process.env.X) on an unset variable walked past the default and landed on
the bound intact. Math.max, Math.min and Math.floor all propagate NaN, and this repo was
relying on all three as guards.
| # | Surface | Costs you an edit if |
|---|---|---|
| 1 | Every numeric option in the table under 17.0.0's Changed heading — across http, query, jobs, realtime, auth, ai, render, pwa, mail, manifest, mcp, notify, ui, scraping, testing, cli, admin, core, time | you pass one a value that is not finite, or is fractional or negative where the option counts things. Read the row for the floor: 0 stays legal wherever it means something — port: 0 asks the OS for a free port, timeout: 0 is one look, seed: 0 is a seed, maxAgeSeconds: 0 is "revalidate every time", concurrency: 0 is one worker |
| 2 | http.trustedProxyHops | you declare 0. That was the failure state, not a setting: forwarded.ts returns undefined for hops < 1, so a declared 0 silently trusted nothing while reading as configured. The domain is 1…64. It is a boot-owned key, so no app can write it — the blast radius is embedders calling defineHttpConfig directly |
| 3 | search().page(input, { first }) | your page would cut rows. A window narrower than the read is now served when nothing is dropped, and refused — naming both edits — when rows would be lost. This is a widening against 16.x for the common case: limit defaults to 20 and first has no default, so search({…}) + .page(input, { first: 10 }) used to mint a cursor that page two then threw on |
TRUSTED_PROXY_HOPS widened from 1–16 to 1–64 and is listed here only so the change is not a
surprise: it accepts strictly more than 16.x did, so no configuration that worked stops working.