bro.js v3.0.0 – What’s new

bro.js has released version 3.0.0, a major upgrade that promises to streamline development by eliminating runtime quirks and focusing on code quality. The new version introduces separate entry points for Node, Next.js, and Edge/worker environments, removing the need for outdated Node modules like crypto and fs in Edge. It also incorporates the Web Crypto API and Response.json() for enhanced security and compatibility.

To protect sensitive information, the runtime now features guarded process.env lookups, making it portable across various platforms such as Cloudflare Workers and Next.js Edge. Global singletons have been eliminated, with state now managed within the createBro(config) or createServer() instance to provide true isolation per request or tenant.

The core context is now strictly typed via AppContext using TypeScript, eliminating the use of 'any' and enabling precise typing for ctx.db, ctx.env, and ctx.user objects. Declaration files have been updated and now compile without errors.

Contract Studio, a new feature, automatically generates strongly-typed React Query hooks and MSW handlers based on Zod schemas. OpenAPI output includes request, authentication, and multipart metadata along with RFC 9457 problem details.

In-process testing has been simplified with bro.test(), allowing automated route calls without server startup. The framework also includes built-in hooks for DB transaction rollbacks and fake timers. In production, a missing or short JWT secret now causes the app to crash early, and CORS is strictly enforced with explicit allowlists.

Production observability and security have been improved with OpenTelemetry spans, metrics, and W3C trace propagation. createPinoAdapter automatically redacts PII from logs, and JWT secrets are no longer embedded in production scaffolds. CORS is now strict, requiring an explicit allowlist.

API keys are hashed, and OIDC and JWKS caching are handled via jose library. The Lifecycle Adapters & CLI TaskManager now supports workers, dead-letter queues, exponential backoff, and Redis lease locks. PostgresAdapter is production-ready, and S3/Local upload adapters are secure.

The bro init command simplifies project setup by creating bro.config.js, a Dockerfile, Vitest config, and an example env file. CLI commands like bro doctor, bro sdk, and bro studio target the default routes/ folder, making the framework more accessible to developers. With these improvements, bro.js is positioned as a robust, secure, and edge-ready framework for production workloads.