What's new in each version of GioJS. Updated on every release and patch.
0.1.0-beta.7
latest
Partial prerendering - cached shell, per-user Suspense holes streamed into the same response - and standalone deploys: one self-contained folder that runs on any server with only Node installed.
Partial prerendering (PPR)
export const shell = 'cache' next to revalidate splits a Suspense page: the pre-Suspense shell is cached in Rust and served instantly, while the holes re-render per request (getServerSideProps reruns with the requester's own cookies) and stream in behind it. The contract: the shell renders identically for every visitor - only Suspense content may be personalized.
Degrades gracefully - a failed holes render ends the body after the shell with the Suspense fallbacks still visible - and X-Gio-Cache reports it all: ppr; shell=stored / hit / stale.
Standalone deploys
gio build standalone packages the app into one folder: the Rust server binary, the whole Node side bundled to a single worker.js (React included, no tsx/esbuild at runtime), a run.mjs launcher, hydration chunks, and public/. Copy it to any server with only Node installed and run node run.mjs - no node_modules, no npm install.
--target cross-builds for any installed @gio.js/server-<platform> package: build on Windows or macOS, deploy to a Linux VPS.
Fixed
latest-tag promotion retries through npm registry propagation lag instead of silently skipping, and the scaffold's typecheck config was fixed (Bundler moduleResolution + @types/node).
0.1.0-beta.6
Repaired npm publishing (beta.5 shipped broken packages), cache-poisoning and SSRF fixes, and a developer-experience wave: Rust-executed middleware rules, streaming SSR, typed routes, cache observability, gio bench, and a smarter dev overlay.
Release integrity & security
Emergency npm repair: beta.5 published @gio.js/react without dist/ and create-giojs without its bin targets. The release workflow now builds before publishing, a tarball gate refuses to publish packages with missing entry points or binaries, tag pushes run the full test matrix first, and latest-tag promotion covers the platform binaries.
Security: background revalidation can no longer cache a cookie-personalized page under the shared key (cache poisoning); the image optimizer allowlist is WHATWG-parsed, closing an SSRF that reached internal IPs through crafted URLs; plus decode limits, rate-limited /_gio/image, and header sanitization fixes.
A restart no longer throws away the disk cache: deployment IDs are content-derived (pin with GIO_DEPLOYMENT_ID), so identical builds keep their cache warm.
Developer experience
Middleware: declarative redirects, rewrites, response headers, and cookie guards from gio.toml and/or middleware.ts (defineMiddleware), with :param / *rest patterns and substitution - compiled and executed in Rust before routing, so no request header can bypass them.
Streaming SSR: personalized (uncacheable) pages flush React's shell as soon as it renders and stream Suspense content in the same response, instead of buffering the full document - cacheable pages keep the buffered path and serve from cache at memory speed.
Typed routes: .gio/routes.d.ts is generated from your app/ directory at boot, and href('/posts/:id', { id }) autocompletes and typechecks with zero annotations.
Cache observability: every response carries X-Gio-Cache (hit / stale / miss / bypass / static with ttl and age details), and gio cache explain <url> decodes it in plain English.
gio bench: a zero-dependency load generator reporting req/s, p50/p90/p99/max latency, and the X-Gio-Cache label of what it measured - single URL or --suite table mode.
The dev error overlay shows codeframes for project frames, and stack file:line links open your editor (GIO_EDITOR/VISUAL/EDITOR).
/_gio/health now reports deploymentId, nodeReady, cacheEntries, and uptimeSecs; <GioLink prefetch="viewport"> prefetches when a link scrolls into view; the docs serve llms.txt and scaffolds include AGENTS.md.
0.1.0-beta.5
The big one: client-side hydration, API routes, dev watch mode, worker supervision, and a hardened Rust↔Node boundary.
New
Client-side hydration: per-route esbuild bundles, a #__gio hydration boundary, and props serialized safely into the page - interactive React with zero hydration-mismatch surface. getServerSideProps and its server-only imports are stripped from client bundles.
API routes: route.ts files export GET/POST/PUT/PATCH/DELETE handlers receiving params, query, headers, parsed cookies, and the request body - return JSON, a web Response, or a GioEventStream (SSE). Unexported methods get a proper 405.
getServerSideProps now receives the full request (method, path, headers, cookies) and can return response headers like set-cookie - such pages are automatically uncacheable.
app/not-found.tsx and app/error.tsx render real 404/500 pages through your layouts; static export writes 404.html so hosts like Cloudflare Pages return a real 404 for unknown URLs instead of the home page.
Dev watch mode: edit a file and the server clears caches, restarts the worker, and reloads your browser - about 1.5 seconds edit-to-browser.
Alpine/musl Linux binaries (@gio.js/server-linux-x64-musl) with automatic libc detection.
Reliability & security
The Node worker is supervised: crashes respawn in ~300 ms instead of taking the server down, and a hard-killed server can never orphan the worker (Windows Job Objects).
Renders are never shared across users: coalescing is credential-aware and only ever shares explicitly cacheable pages.
The IPC boundary is versioned (enforced at handshake), authenticated with per-instance tokens, and carries request bodies - binary-safe - plus vary/cacheTags/cancel frames.
Client disconnects and timeouts now abort in-flight React renders instead of finishing work nobody reads.
All @gio.js/* packages, platform binaries, and templates are version-locked; releases publish with npm provenance; CI runs a real Rust↔Node integration suite on Linux and Windows.
0.1.0-beta.4
Packaging and clean-install fixes following beta.3.
Fixed
Clean-install issues found while testing the published packages end-to-end: tsx as a runtime dependency, package file lists, and template fixes.
0.1.0-beta.3
SEO-ready static exports.
New
Static export auto-generates robots.txt and a full sitemap.xml (absolute URLs from GIO_SITE_URL).
Exported pages no longer reference a client bootstrap script that 404s on static hosts.
0.1.0-beta.2
Static export - build to plain HTML and deploy anywhere, for free.
New
Static export: gio export pre-renders your whole app to out/ as plain HTML - deploy free to Cloudflare Pages, GitHub Pages, or any static host.
create-giojs now asks "Server app or Static site?" and wires npm run build accordingly (gio export for static).
getStaticPaths() convention to pre-render dynamic routes during export.
getServerSideProps runs at build time, baking its data into the exported HTML.
0.1.0-beta.1
First public beta on npm, published under the @gio.js scope.
Highlights
Published to npm: @gio.js/server, @gio.js/core, @gio.js/react, create-giojs, and prebuilt platform binaries (linux-x64, win32-x64, darwin-x64, darwin-arm64).
npm create giojs@latest - interactive scaffolder with an arrow-key picker for TypeScript / JavaScript.
Framework
Rust HTTP/2 server with brotli/gzip compression, static file serving, and rustls TLS.
Image optimization endpoint (/_gio/image): AVIF → WebP → JPEG with a two-layer cache.
ISR page cache with stale-while-revalidate and deployment-aware invalidation.
React SSR via renderToReadableStream, getServerSideProps, nested layouts, and file-based routing for .tsx / .jsx / .js.
Route handlers, Server-Sent Events, and WebSockets over a dedicated IPC pipe.
Self-hosted fonts (WOFF2), i18n routing, Prometheus metrics, and a dev dashboard.
Subscribe on GitHub to be notified when a new version ships.
GioJS