Past releases — Stoneware

The older released versions, newest first. Everything here is on npm and installable. 0.1.5 and 0.1.4 have their own page, and the current release is on what's new.

0.1.3

Three bugs found by running this site in production, and three features found by wanting to build something real with it. Each entry below says what you had to do before, because that is the only honest way to judge whether an addition earns its place.

Middleware

  before                          now
  ──────────────────────────      ──────────────────────────
  paste the check into every      routes/_middleware.ts
  route, and into every route     runs on every request
  added afterwards

an auth check across twelve routes

There was no way to run code across routes at all — no auth guard, no redirect rule, no request logging. That is the gap you hit within a day of building anything real, and copy-paste was the only answer. See middleware and APIs.

JSON errors and CORS

  before                          now
  ──────────────────────────      ──────────────────────────
  <!DOCTYPE html>...              { "error": "Not Found",
  the full error page               "status": 404 }
  and nothing parseable

what a fetch() got back from a failing route

API routes existed and worked, but everything around them was missing. Errors now negotiate on Accept, and cross-origin access is configurable — off by default, since an API only your own pages call never needed it.

notFound()

  before                          now
  ──────────────────────────      ──────────────────────────
  render "no such page"           notFound()
  and serve it with 200           renders _404 with a 404
  → a soft 404 Google indexes

a [slug] route asked for something that does not exist

routes/_404.tsx only fires when nothing matched. A [slug] route matches any slug, so it could only ever render not-found markup with a success status. This site had exactly that bug. See error pages.

Correct URLs behind a proxy

  before                          now
  ──────────────────────────      ──────────────────────────
  <link rel="canonical"           trustProxy: "proto"
    href="http://...">            → https:// everywhere
  every page, telling Google
  the insecure URL is real

a site served over https by Render

Every platform that terminates TLS forwards a plain HTTP request, so url.origin reported http:// on an https:// site. Off by default because those headers are forgeable; "proto" trusts only the scheme, which is safe anywhere and fixes the common case. See deploying.

Smaller things

stoneware dev walks to the next free port instead of refusing to start. Production still fails loudly, because a platform routes traffic to the port it assigned.
stoneware export writes non-HTML routes at their literal path. A sitemap.xml route used to land at sitemap.xml/index.html, where no crawler would find it.
New projects ship robots.txt, sitemap.xml, a favicon and the Stoneware mark, with SITE_URL wired through so absolute URLs are right from the first deploy.

0.1.2

Published 13 August 2026. Lazy hydration (client:visible, client:idle, client:media), static export, custom error pages, co-located CSS, a head export, <Image>, seo(), and browser diagnostics in development.

Production stopped rebuilding island chunks at boot, which was crashing serverless deploys against a read-only filesystem.
The server binds 0.0.0.0 in production, so platform health checks reach it.
public/ assets revalidate instead of going stale for an hour after a deploy, and HTML responses answer 304.

This site runs on the published package rather than a local checkout, so everything on this page is behaviour you can install — not behaviour that only exists in the repository.

Still on one of these? The deploying and CLI pages mark which behaviour belongs to which version, so nothing here needs cross-referencing against a changelog.