Meteor 3.5.2-rc.0: Rspack reliability, Cordova Android 15, and DDP connection fixes

announce releases
1

Meteor 3.5 introduced MongoDB Change Streams, DDP session resumption, pluggable transports, and Node.js 24. Meteor 3.5.1 then strengthened Meteor runtime, Rspack and reconnection behavior.

Meteor 3.5.2-rc.0 continues that reliability work by refining Rspack builds, updating the Cordova Android toolchain, strengthening runtime defaults, and addressing community reports and reproductions.

Please test this beta in development or staging, especially if your application uses Rspack, Cordova, HttpOnly cookies, custom MongoDB TLS settings, or a large local package warehouse. Your feedback will help us catch regressions across real-world projects and deliver a more reliable Meteor 3.5.2 stable release.

Getting Started

Create a New App


meteor create my-app --release 3.5.2-rc.0

Update Your App


meteor update --release 3.5.2-rc.0

As with every beta, test before updating production applications and keep current project and database backups.

Highlights

Rspack and build tooling

  • Full-app tests preserve top-level await and build the correct client and server bundles (PRs #14405, #14643, #14653, and #14678).

  • Development, test, and app-test builds are isolated when they share an application directory (PRs #14576 and #14678).

  • Persistent caches stay valid across modes, TypeScript configuration changes invalidate the right work, and linker caches are cleaned correctly (PRs #14569, #14645, and #14646).

  • Meteor resolves hoisted Rspack CLI installations, limits ignored-extension scanning, loads SWC only when needed, and fails immediately if Rspack exits before its first compilation (PRs #14578, #14581, #14641, and #14643).

  • The new tools-core dependency manager streamlines setup by installing required Rspack npm dependencies automatically (PR #14492).

Thank you to @ToyboxZach, @jdgjsag67251, @MaxTwentythree, and @Nefleex for detailed reports and reproductions. We also thank @perbergland and @miamagana for their investigations and proposed fixes, and @hexsprite and @vlasky for implementing and validating the bundle, cache, watcher, and startup improvements.

These improvements ship through rspack@1.3.0-beta352.0 and @meteorjs/rspack@2.2.0-beta.0.

:link: Meteor Rspack integration guide

Cordova and Android

:link: Meteor Cordova guide

Runtime security and MongoDB

  • HttpOnly cookie endpoints are exposed only when useHttpOnlyCookies is enabled, and oversized request bodies are rejected (PR #14657).

  • Invalid MONGO_URL warnings redact credentials, and startup compatibility checks respect connection-string TLS settings (PR #14658).

Thank you to @italojs for these security and diagnostics improvements.

DDP and client integrity

  • DDP follows the browser page protocol when deriving its default connection URL, preventing mismatches between the page and ROOT_URL (PR #14640). Thank you to @dupontbertrand.

  • Client manifest sizes, hashes, and SRI values now match the exact bytes written to disk after source-map URL processing (PR #14482). Thank you to @mitar for the original report and reproduction.

File watching and package testing

  • Meteor no longer watches immutable package warehouse files, reducing native watcher usage and preventing macOS FSEvent exhaustion (PR #14672). Thank you to @hexsprite.

  • test-in-browser no longer supplies jQuery transitively, allowing Blaze tests to run with or without jQuery when it is declared explicitly (PR #14308). Thank you to @jankapunkt.

What Else Is New in Meteor 3.5.2-rc.0?

Breaking Changes

Meteor patch releases normally avoid breaking changes. These two migration steps are intentionally narrow: one keeps Cordova Android builds aligned with an external platform requirement, and the other corrects an implicit test-only dependency. Most Meteor applications are unaffected.

  • Cordova Android only. cordova-android@15.1.0 targets API 36 so apps can meet Google Play’s annual target API policy. This requires Android SDK Platform 36 and Build Tools 36.0.0, but only projects that build for Cordova Android need to act (PR #14487).

sdkmanager 'platforms;android-36' 'build-tools;36.0.0'
  • Tests relying on implicit jQuery only. test-in-browser@1.6.0-beta352.0 no longer supplies jQuery transitively. This makes the dependency explicit and lets Blaze test its jQuery-free path. Application runtime code is unaffected; test suites that need jQuery must declare it or run with --extra-packages=jquery (PR #14308).

This beta also includes more improvements and package updates. See the Meteor 3.5.2 changelog for the full details, or review the pull requests merged into release-3.5.2 through beta.0 for the complete implementation history.

Big Thanks to Our Contributors and Sponsors

Thank you to @nachocodoner, @italojs, @Grubba27, @hexsprite, @dupontbertrand, @jankapunkt, @vlasky, @perbergland, @miamagana, @a4xrbj1, @boomfly, @harryadel, @9Morello, @zodern, and @sblaisot for authoring, contributing to, and reviewing this release.

We also thank @mt-resos, @koad, @ToyboxZach, @mitar, @MaxTwentythree, @Nefleex, @jdgjsag67251, @julio-rocketchat, @scharf, @nico014, and @ksinas for reporting issues and developing reproducible test cases.

Meteor’s continued modernization also depends on sponsors who make long-term investment in the framework possible. Thank you to our current sponsors: Galaxy, Input Logic, and CodeRabbit.

If Meteor has helped you build and grow, consider supporting what comes next through the Meteor Sponsorship Program.

What’s Next for Meteor and Beyond?

After Meteor 3.5.2 stabilizes, our next focus is taking Meteor 3.6 from beta to its official release.

  • Meteor 3.5.2 stabilization. Validate the beta across supported platforms, address regressions, and prepare the official release. Targeting Meteor 3.5.2 stable within a three-week cycle.

  • Built-in TypeScript. Deliver a solid integration for Meteor projects, with full Atmosphere package coverage. Planned for Meteor 3.6.

  • Rspack 2.x. Upgrade Rspack and continue refining the bundler integration. Planned for Meteor 3.6.

  • Node 26 and CLI. Include further Node.js and Meteor CLI improvements. Planned for Meteor 3.6.

  • CapacitorJS experimentation. Try Meteor’s modern native stack now through the experimental Meteor checkout. A public experimental beta may arrive during Meteor 3.6, with a stronger native focus planned for Meteor 3.7.

For more details on upcoming work and priorities, see the Meteor roadmap.

11 Likes
2
3

What does this mean practice?

Does this include some sort of blessed way of doing meteor methods whose return types and errors are known across the wire from server to client? All the community packages are hacks that try to deal with this issue.

For reference: oRPC’s queries/mutations tanstack start’s createServerFn

Going even further, something that would go well with react-query and meteor method adapter for that would be huge (Tanstack Query Integration For React - oRPC). I lot of the time I don’t want to subscribe to data via minimongo and still want to use meteor methods because of auth via local storage token, so state management via react-query instead of the subscribed data would be better IMO.

Thoughts?

4

Take a look at Meteor-RPC. I think it’s great, and it also uses React-Query

6

I use it and it has issues with running tsc on it, even with skipLibCheck. As I said, community packages are hacks around the underlying issue.

7

WeKan has Meteor 3.5.2-beta.0 in Production.

https://wekan.fi

1 Like
8

The best metric there’s :confetti_ball:

9

At least, as part of Meteor 3.6, we plan to integrate into core the TypeScript capabilities that currently depend on the zodern:types Atmosphere package, including native package type generation and meteor types. This is also an opportunity to address any specific issue you may find on that package in its adoption to the core.

We are also consolidating the broader TypeScript work for 3.6 here, including fuller type coverage and validation across Meteor core packages, so exposed APIs get proper typings and autocompletion works more directly out of the box:

Regarding meteor-rpc, I see your point. It already covers much of the developer experience you describe around typed RPCs and React Query, but if you are using it and still having tsc issues, then pointing to the community package does not necessarily address the underlying problem.

It would be useful to understand whether the tsc issue comes specifically from meteor-rpc, or whether it is exposing a limitation in Meteor’s current type generation or resolution. Since the Meteor 3.6 TypeScript work is touching that foundation, I would encourage you to open a detailed issue with the errors and, ideally, a minimal reproduction:

Then we can check whether the current TypeScript work already addresses it or whether additional core work is needed.

10

Sorry if I was unclear, but I was responding to @zayco recommending meteor-rpc.

tsc runs fine on vanilla, newer meteor version typescript projects. However, with vanilla meteor + typescript you can’t get type inference across the wire with meteor method calls, like I described with my earlier post, which is what packages like meteor-rpc try to achieve.

I do appreciate the efforts to achieve better type support from built in packages, but it’s a slightly different matter

1 Like
11

Published new version: 3.5.2-rc.0

Feedback from beta testing has already made 3.5.2-rc.0 stronger. It now includes:

The complete changes are available in the Meteor 3.5.2 changelog.

You can test the RC with:


meteor update --release 3.5.2-rc.0

Our CI and internal regression pipelines are currently green. We would now especially appreciate early testing with real-world Meteor applications to confirm the RC is stable across different application architectures, package combinations, and deployment environments. If you encounter a critical issue or regression, please report it with a reproduction when possible so we can investigate it before the final release.

Thanks again to everyone testing the release and sharing detailed reproductions.

Update: We also invite you to help us test the Meteor Agent Skills we are providing in parallel.

1 Like
13