[dependabot]

Bumps the farm group with 1 update in the /website directory: @farm.js/core.

Updates @farm.js/core from 0.1.0 to 0.1.37

Release notes

Sourced from @​farm.js/core's releases.

Farm.js 0.1.37

build

• route evaluation no longer fails with transport invoke timed out after 60000ms when the production build keeps a small machine busy (a large docs site on a 2-core vercel builder) (#2275)
• server-only layouts stay out of the client entry (#2263)

security

• links refuse javascript: hrefs (#2276)
• middleware: function guards match on the route path (#2277)
• markdown: page guards decide source access (#2279), mirrors re-enter through the request entry (#2278), the anonymous check drops the client address (#2268)
• netlify: credentialed isr responses stay off the CDN (#2280)
• mcp: tool input elements capped (#2269), pages read through the request entry (#2267), dev tool dispatch pinned to its own server (#2266)
• deps: zod and better-auth floors raised (#2274), cli installs a patched @auth/core (#2270), vue 3.5.44 (#2271)

fixes

• route data: staleTime: 0 skips the cache (#2281)
• ppr: server function request reads count (#2282)
• create-app: new apps start on docs 0.2.130 (#2235)

react compiler

• faster scope analysis and row updates (#2143, #2154, #2260, #2030, #2193, #2194)

packages

• shared group 0.1.37; react beta.32, preact beta.34, vue beta.33; plugins pinning core moved to their next beta (sync beta.38, mcp beta.34, otel beta.61, ...)

Farm.js 0.1.36

next.js app router parity

• a page that renders an async server component hydrates that component's client components as islands, and an async page keeps client components that receive react elements (server tree below a hydrating layout) (#2248)
• page content with id="root", such as a heading titled "Root", no longer takes a full-document layout's hydration root (#2249)
• the node server runs with NODE_ENV=production unless the host sets it, as next start does (#2250)
• react: controlled input reset values stay current (#2183)

agents

• read-only mcp server served by default (#2247)
• /.well-known/farmjs served publicly (#2246), and at /.well-known/farmjs.json with the old path kept (#2233)
• default sitemap.xml of static pages (#2240)
• mcp: batch size capped (#2243), endpoint tools run middleware (#2242)
• agent check: only asks outdated farm.js sites to update (#2245), warns when the server html has little text (#2237)

fixes

• dev reloads api routes when an import changes (#2189)
• auth0: exact session cookie max-age (#2251)
• auth: random dev secrets (#2232)

... (truncated)

Commits

• 7607e1e chore: release v0.1.37
• 87e5476 fix(ppr): count server function request reads (#2282)
• 3bc4d03 fix(build): no runner timeout during route evaluation (#2275)
• f818305 fix(routes): staleTime 0 skips the route data cache (#2281)
• 101bb97 fix(netlify): keep credentialed isr responses off the CDN (#2280)
• 5472df6 fix(markdown): page guards decide source access (#2279)
• db1df89 fix(markdown): re-enter through the request entry (#2278)
• 3d340d6 fix(middleware): match function guards on the route path (#2277)
• 068c433 fix(link): refuse javascript: hrefs (#2276)
• c38a820 fix(mcp): cap tool input elements (#2269)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
jevia	Ready	Preview	Oct 29, 2026 9:57am UTC