{"full_name":"meteor/meteor","owner":"meteor","name":"meteor","url":"https://github.com/meteor/meteor","description":"Meteor, the JavaScript App Platform","homepage":"https://meteor.com","topics":[],"language":"JavaScript","license":"NOASSERTION","avatar":"https://avatars.githubusercontent.com/u/789528?v=4","created_at":"2012-01-19T01:58:17Z","pushed_at":"2026-11-09T16:25:11Z","metrics":{"stars":44797,"forks":5276,"watchers":1473,"issues":9417,"prs":5245,"releases":21,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":194},"growth":{"day":{"stars":1,"forks":0,"base_day":"2026-11-09"}},"history":{"dates":["2026-11-09","2026-11-10"],"stars":[44796,44797],"forks":[5276,5276],"watchers":[1473,1473],"issues_open":[null,null],"prs_open":[null,null]},"boards":{},"same_owner":[],"issues":[{"number":13108,"title":"Idle Crash in Development Mode","comments":66,"created_at":"2024-04-25T15:56:46Z"},{"number":11811,"title":"White screen of death when reopening iOS Cordova app","comments":55,"created_at":"2021-12-16T14:14:38Z"},{"number":10903,"title":"pnpm does not work with Meteor","comments":35,"created_at":"2020-02-08T11:45:15Z"},{"number":13812,"title":"Upgrade deprecated packages","comments":29,"created_at":"2025-06-25T07:32:01Z"},{"number":12019,"title":"Debug application built on local Meteor packages","comments":29,"created_at":"2022-04-26T10:05:58Z"},{"number":14655,"title":"[Rspack] meteor build OOMs while linking a large non-Blaze client bundle","comments":28,"created_at":"2026-08-10T09:57:13Z"},{"number":11578,"title":"Slow oplog tailing on ATLAS (reactivated issue)","comments":28,"created_at":"2021-08-10T16:26:31Z"},{"number":10704,"title":"Not possible to disable dynamic-import","comments":24,"created_at":"2019-09-23T23:12:02Z"}],"discussions":[{"number":14783,"title":"Solutions for a private Meteor package registry","comments":2,"category":"Feature Requests","created_at":"2026-09-22T21:50:42Z"},{"number":14738,"title":"Fallback to plain JSON if EJSON parse fails on an incoming DDP message","comments":0,"category":"Feature Requests","created_at":"2026-09-10T10:01:18Z"},{"number":14728,"title":"Feature request: native self-service email-change flow in `accounts-password`","comments":1,"category":"Feature Requests","created_at":"2026-09-08T19:14:08Z"},{"number":14727,"title":"`accounts-password` stores email-verification and password-reset tokens in plaintext (login tokens are hashed)","comments":1,"category":"Feature Requests","created_at":"2026-09-08T19:06:57Z"},{"number":14592,"title":"`meteor npm`/`meteor node` inside a built bundle should honor the bundle's release","comments":0,"category":"Feature Requests","created_at":"2026-07-15T20:59:03Z"},{"number":14549,"title":"RFC: An explicit lifecycle for server Sessions","comments":2,"category":"Feature Requests","created_at":"2026-07-06T21:22:14Z"},{"number":14451,"title":"Cooldown capability for the meteor node bundled npm version and Atmosphere packages","comments":2,"category":"Feature Requests","created_at":"2026-06-10T16:10:48Z"},{"number":14207,"title":"Should Meteor have an official router package maintained by the core team?","comments":2,"category":"Feature Requests","created_at":"2026-03-09T00:02:09Z"}],"latest_release":{"name":"Meteor 3.5.3","tag":"release/METEOR@3.5.3","published_at":"2026-10-16T18:08:25Z","body":"## v3.5.3, 2026-10-13\r\n\r\n### Highlights\r\n\r\n- Validate Google and Facebook direct-login tokens against the application's OAuth configuration, use provider-verified Google identity fields, and keep Facebook verification errors from exposing the app secret.\r\n- Prevent server crashes caused by invalid DDP protocol-handler names and unhandled asynchronous handler rejections.\r\n- Include all modified top-level fields in allow/deny checks, closing a field-authorization bypass.\r\n- Bound dynamic-import request size and complexity, batch large legitimate module graphs, and limit failed module reads and logging.\r\n- Keep `meteor shell` history and compilation caches private on POSIX systems, and keep the app running when private history persistence is unavailable.\r\n- Restrict deploy destinations returned by discovery to trusted HTTPS Galaxy servers before sending account credentials, while preserving HTTP discovery for first deploys.\r\n\r\n#### Breaking Changes\r\n\r\n- `google-oauth`: Native sign-in that directly supplies an iOS or Android access token without `serverAuthCode` must list that client in `additionalClientIds`, or supply a Google-validated `idToken` for an accepted client and the same user. Google email and picture data no longer fall back to client-supplied fields; apps must request the corresponding scopes.\r\n- `dynamic-import`: Oversized or malformed requests now receive HTTP 413 or 400. The updated client batches large valid graphs, but already-open clients running older code may need a refresh during a rolling deployment. Individual module paths must fit the new enforced limits.\r\n- `allow-deny`: Update validators now receive `__proto__` in the modified-field list instead of omitting it. Review validators that rely on that list.\r\n- Deploy discovery now rejects destinations outside Galaxy's HTTPS deploy domain. Custom deploy servers must be selected explicitly through `DEPLOY_HOSTNAME`; that override remains trusted with the account credentials.\r\n\r\n#### Internal API changes\r\n\r\n- DDP protocol dispatch accepts only string names for handlers defined directly on the handler table. Extensions that inherit protocol handlers must define them directly.\r\n\r\n#### Migration Steps\r\n\r\nPlease run the following command to update your project:\r\n\r\n```bash\r\nmeteor update --release 3.5.3\r\n```\r\n\r\n- **Google sign-in:** For native access-token sign-in without `serverAuthCode`, set `additionalClientIds` in the server's Google service configuration to your application's iOS and Android OAuth client IDs, or send a matching `idToken` that Google can validate for an accepted client. Request `email` and `profile` scopes if your app needs those fields. Allow outbound access to `oauth2.googleapis.com` when using ID-token validation, alongside the existing Google API endpoints. The standard server authorization-code flow exchanges the code for tokens before validation.\r\n- **Dynamic imports:** Deploy the updated client and server together. If older open clients fail to load a large uncached module graph after the server update, refresh them to load the client that batches requests.\r\n- **Allow/deny:** Check validators that restrict updates by field name, including applications that intentionally use a top-level `__proto__` field.\r\n- **Meteor shell:** If a permissions warning appears, check ownership and permission support for `.meteor/local/shell`. The shell continues without persistent history when it cannot ensure privacy, and compilation runs without disk caching when the cache cannot be made private.\r\n- **Deploy:** Review any `DEPLOY_HOSTNAME` override and trust its destination before supplying account credentials. Automatic discovery still tries HTTP when HTTPS discovery fails, including first deploys before a site has a certificate; the discovery-selected deploy server must use trusted Galaxy HTTPS.\r\n\r\n#### Bumped Meteor Packages\r\n\r\n- allow-deny@2.1.1\r\n- ddp-server@3.4.1\r\n- dynamic-import@0.8.0\r\n- facebook-oauth@1.12.0\r\n- google-oauth@1.5.0\r\n- shell-server@0"},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}