Changelog

Version 0.3.2

Added

• Custom block on error message: New px_custom_block_on_error_message configuration to display a custom message on block pages served due to an error

Fixed

• URL host replacement in NextJSIncomingRequest now preserves the raw URL path without normalization (fixes raw URL tracking for paths containing dots or extra slashes)
• Form URL-encoded body parsing now clones the request before reading to allow the body stream to be consumed multiple times

Version 0.3.1

Added

• MCP Protection support: New configurations px_agentic_trust_enabled and px_agentic_trust_mcp_endpoint_path to protect MCP server endpoints
• Proxy support: New px_proxy_url configuration to route outbound requests through an HTTP proxy
• Added Hardblock support
• Response custom parameters 11–20: px_enrich_response_custom_parameters can now populate custom parameters 11 through 20, extracted from the origin response
• Data enrichment header: New px_data_enrichment_header_name configuration to specify the header used for data enrichment
• Async timeout: New px_async_timeout configuration that applies to async activities, telemetry, remote logger, and remote configuration requests
• Regex-formatted route strings: Route configurations (e.g. px_sensitive_routes, px_enforced_routes, px_filter_by_route, etc.) now accept strings in regex format (e.g. "/^\/api\/.*$/i") in addition to plain strings and RegExp objects

Version 0.3.0

Added

• Support for Next.js ^16.0.0. Use proxy.ts and export const proxy = perimeterx(pxConfig) (or export default) on Next.js 16+; middleware.ts remains supported but is deprecated there.

Version 0.2.3

Fixed

• onResponse signature updated for accuracy (changed response parameter to be type NextResponse)
• Fixed Next.js critical vulnerability by bumping version to 15.5.7

Version 0.2.2

Changed

• Upgraded JS Core to v0.24.2
• Updated to support NextJS versions ^14.2.7 || ^15.0.0
• Changed NextJS to be a peer dependency

Version 0.2.1

Changed

• Using CryptoJS to read _px3
• Supporting NextJS

Version 0.2.0

Changed

• Upgraded to js-core 0.21.4
• Added ci e2e tests
• Upgraded next js to 13.4.4

Version 0.1.6

Fixed

• Fixed context overriding between two different requests.

Version 0.1.5

Fixed

• Using host header to construct url, the default implementation (by Next.js) does not do that.

Version 0.1.4

Changed

• js-core version