lambder 11.0.1 → 11.1.1

package/CHANGELOG.md

@@ -9,6 +9,23 @@ sit on its first published patch, and later patches list only what they changed.
 Releases up to 3.2.6 carry git tags; the ones after it were published without
 one, so versions are not cross-linked to tag comparisons here.
 
+## [11.1.1] - 2026-09-30
+
+A minor for an app whose shell files sit behind a shared cache: a file whose
+name does not change when its bytes do is revalidated rather than kept.
+
+### Changed
+
+- **`servePublicFiles` answers a file its immutable rule does not match with
+  `Cache-Control: no-cache`**, where it answered `public, max-age=3600`. A
+  service worker, a web manifest or a favicon keeps its name across a deploy,
+  so a CDN or proxy honouring the hour served the old copy to everyone for up
+  to an hour afterwards, and an app behind one had to purge it on every
+  deploy. Every GET or HEAD 200 already carries an ETag, so a revalidation of
+  an unchanged file is a 304 with no body. Content-hashed build output keeps
+  `immutableCacheControl`, and an app that wants the old behaviour passes
+  `cacheControl: "public, max-age=3600"`.
+
 ## [11.0.1] - 2026-09-29
 
 A major for an app with many APIs: what one API costs the type checker no

package/dist/core/LambderPublicFiles.d.ts

@@ -13,7 +13,14 @@ export type LambderPublicFilesOptions = {
      * mapper. Return null/undefined to skip. Default: the file path as it is.
      */
     path?: (ctx: LambderRenderContext, filePath: string) => string | null | undefined;
-    /** Cache-Control for served files; the function receives the relative file path. Default: "public, max-age=3600". */
+    /**
+     * Cache-Control for served files that do not match immutablePattern; the
+     * function receives the relative file path. Default: "no-cache". Such a
+     * file keeps its name when its bytes change (a service worker, a web
+     * manifest, a favicon), so a shared cache holding it for a while serves
+     * the old copy after a deploy; revalidating instead costs a 304, since
+     * every GET or HEAD 200 carries an ETag.
+     */
     cacheControl?: string | ((ctx: LambderRenderContext, relativePath: string) => string);
     /** Relative paths matching this get immutableCacheControl. Default: content-hashed names in a bundler's output folder (assets/, static/, _next/static/). Set false to disable. */
     immutablePattern?: RegExp | false;

package/dist/core/LambderPublicFiles.js

@@ -29,7 +29,7 @@ const EXACT_BUNDLER_HASH = "-(?=[\\w-]{0,7}[a-z])(?:(?=[\\w-]{0,7}[A-Z])(?=[\\w-
 const LONG_BUNDLER_HASH = "[-.](?=\\w*[A-Za-z])(?=\\w*\\d)\\w{8,}";
 const DEFAULT_IMMUTABLE_PATTERN = new RegExp(`(?:^|/)_next/static/|(?:^|/)(?:assets|static)/(?:[^/]+/)*[^/]*(?:${EXACT_BUNDLER_HASH}|${LONG_BUNDLER_HASH})(?:\\.chunk)?\\.[A-Za-z0-9]+$`);
 const DEFAULT_IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
-const DEFAULT_CACHE_CONTROL = "public, max-age=3600";
+const DEFAULT_CACHE_CONTROL = "no-cache";
 /**
  * Terminal public-file handler registered via lambder.servePublicFiles().
  * Runs only when no route matched, so it can never shadow routes registered

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "11.0.1",
+  "version": "11.1.1",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [