Roadmap

Devora.js is early and pre-1.0, built by one person. This page says what has shipped, version by version, and what is next. Every block below is taken from the changelog and the git tags (v0.3.2, v0.3.4 and v0.3.5 are the only tags).

The same content lives in ROADMAP.md on GitHub; the long, dated account of how each piece was built is the build log.

Done, by version

1. 0.3.5

   2026-10-16tag v0.3.5
   • Faster request handling in devora start: work that never changes per request is done once. Interleaved A/B on one machine: +15% JSON list, +32% authenticated GET, +21% POST, +41% pre-rendered page, +23% server-rendered page; form POST about 32,000 to 82,000 req/s. No security default weakened.
   • A missing session store or secret stops devora start with one clear line; the header brand link's accessible name contains its visible text.
   • Guides for Live updates (WebSockets) and Background jobs, a new examples/background-jobs, backend benchmark scenarios, and a restored roadmap.
   • Packages: @devorajs/core 0.3.5, @devorajs/cli 0.3.5, create-devora 0.3.3; the adapters are unchanged.

   Release post · CHANGELOG: 0.3.5

2. 0.3.4

   2026-10-16tag v0.3.4
   • Catch-all routes ([...slug], [[...slug]]) for pages and API routes; ctx.params stays a string, the array is ctx.catchAll.
   • Faster pre-rendered pages (served from memory with ETag and compression), correct content types, sitemap URLs from getStaticParams().
   • A documented live-updates pattern with a runnable example; publish scripts refuse to publish an empty dist/.

   Release post · CHANGELOG: 0.3.4

3. 0.3.3

   Never published
   • Prepared and rolled into 0.3.4.

   CHANGELOG: 0.3.4 (says so)

4. 0.3.2

   2026-10-12tag v0.3.2
   • Request access in loaders and actions, action results (fail(), 303 redirects), error pages, the head API, uploads, CORS, .env loading.
   • Cookie and proxy settings; the Vercel runtime is no longer hard-coded; the first published @devorajs/adapter-node.
   • Adapters 0.2.0 and 0.2.2 had been published without their build output and were replaced by 0.2.1 and 0.2.3.

   CHANGELOG: 0.3.2

5. 0.3.1

   2026-09-24
   • create-devora scope: --scope=fullstack|frontend|backend; devora --version reports the real version.
   • The Vercel and Netlify adapters no longer fail on a backend-only app.

   CHANGELOG: 0.3.1

6. 0.3.0

   2026-09-23
   • Breaking: unified session auth — opaque IDs in a SessionStore you provide, one lookup for cookie and Bearer, revocation.
   • api/** always answers JSON; devora dev --host; dev ports start at 10000.

   CHANGELOG: 0.3.0

7. 0.2.2 and 0.2.1

   2026-09-16
   • @devorajs/core 0.2.1 (footer structure in the branding component) and 0.2.2 (footer styles and a package exports restructure). The CHANGELOG notes for them were reconstructed from git history and npm publish times.

   CHANGELOG: reconstructed notes

8. 0.2.0

   2026-09-16
   • The v2 backend: defineModule(), API routes, middleware, backend-only apps, getStaticParams() for ssg/isr.
   • Repo-splitting (devora split, sync, status) and the streaming render mode.
   • A security audit pass: cross-app cookie binding, request-body caps, path-traversal fixes, a 405 for undeclared API methods.

   CHANGELOG: 2026-09-16

9. 0.1.x

   • 0.1.1 and @devorajs/cli 0.1.2 (2026-09-08): the npm scope became @devorajs, the shared scaffold package, per-package READMEs.
   • @devorajs/core 0.1.2 (2026-09-09): dynamic routes and the devora deploy fixes of that day; its CHANGELOG note was reconstructed from git history.
   • 0.1.0: the CHANGELOG records only the initial commit, 2026-09-07 (SSR/SSG/CSR/ISR, islands, sessions, security headers, SEO, the CLI, the three adapters), without a version number.
   • 2026-09-09 has an entry (a CI fix, docs) with no version bump.

   CHANGELOG: 2026-09-08

What is ahead

Next: open findings, proposed order

A proposal for the maintainer to confirm or change, ranked by impact. Nothing here has a version or a date. Y1, Y6 and O2 stay Unconfirmed and are not ranked.

Vision (not started, no dates)

A desktop app and a native mobile app. If they happen, business logic, the backend client, validation and design tokens would be shared and the UI would be platform-specific. React was chosen partly to keep that door open.

Ideas (open, not promised)

Nothing here is planned, scheduled or numbered.

• Example: an idea goes here as one line, with no version and no date.

Performance program

The aim is to close the gaps and publish measured results, including where Devora.js is behind. Numbers come from the benchmark harness and are never edited by hand. After the first pass (published 0.3.5; a difference inside a framework's own run-to-run spread counts as a tie), Devora.js is ahead of the other four frameworks on the pre-rendered page, the server-rendered page and the form POST; on the JSON API scenarios it is behind Fastify, Hono and NestJS on Fastify, and level with four frameworks on the 2 ms async scenario (findings S1 to S4).

Definition of success

From architecture-v1 §14: v1 is "done" when a solo or small team can build a real project with a marketing site, an app and an admin panel sharing auth and a core, deploy each independently, get good SEO out of the box, and not hit a single window is not defined crash from a client library, all without reading framework internals to understand why something cached or didn't. Five things must all be true at once:

1. Routes actually render (SSR, SSG, CSR, streaming, ISR per renderMode). SSR and SSG/CSR/ISR were done in v1; streaming was deferred from v1 and shipped in v2.
2. Auth and session context is real, shared by default, isolable per app. Done.
3. Client-only libraries (three.js, fabric.js) never crash on the server. Done; clientOnly() is verified with a real negative control.
4. Each app deploys independently to at least one real target. Done: adapter-node, Vercel and Netlify were deployed live by the maintainer with releases before 0.3.2, by git integration and by devora deploy. 0.3.4 is not yet verified on a live deployment by this project.
5. SEO primitives work: OG tags and a per-app opt-in sitemap.xml, both verified.

Status board

The 14 work items

Each is described in the build log as it was when it landed.

Live deployment history

• Vercel, git integration: all three demo apps live with releases before 0.3.2. Two bugs only a live deploy found were fixed: Cannot find package 'react' and jsxDEV is not a function (NODE_ENV unset in the build step).
• Netlify, git integration: all three demo apps live, before 0.3.2. Found live and fixed: Could not resolve entry module "index.html" (a build-output-only netlify.toml), then package.json and node_modules in included_files (2026-09-16).
• devora deploy: a real authenticated deploy on both platforms, before 0.3.2. Domain auto-binding not built.
• Docker: real build, run and compose; login, CSRF and tampered-cookie regression inside the container; all three apps concurrently. Container platforms (Cloud Run, App Runner, Azure Container Apps) not verified.
• VPS: devora generate:proxy verified against a real local nginx and caddy validate. The systemd unit template is untested on a host.
• CI: builds every app under npm, Yarn and pnpm, both adapter targets, and typechecks fresh scaffolds.
• 0.3.5 live: not yet verified on a live deployment by this project. Generated functions were run outside the monorepo only.

Findings

88 findings from the pre-v3 hotfix list, hotfix round 3 and VERIFICATION.md. Fixed means a release plus a file, test or changelog line that proves it; Unconfirmed means never reproduced or checked, and is not guessed.