storage

Summary The stale-if-error cache expiry check in was inverted, causing stale-if-error caches to \\never expire\\ — they would indefinitely serve stale content regardless of how much time passed. Bug The condition compared: This evaluates to for any positive because is always in the future. The cache entry time is always less than a future timestamp, so stale content is served forever. Fix Changed the comparison (in both and ) to: This correctly checks whether has exceeded the cache entry time plus the stale-if-error window — only serving stale content when the window has not yet elapsed. Test Added a regression test: after advancing time past the stale-if-error window (11s past a 10s ), a network-fault fetch should throw — not serve stale content. The test fails before the fix and passes after.

Summary Multipart uploads fail for files larger than 80 GiB because the part size is hardcoded to 8 MiB, and the Vercel Blob API enforces a maximum of 10,000 parts per upload (8 MiB × 10,000 = 80 GiB). This contradicts the advertised 5 TB support for multipart uploads. The fix scales the part size up for bodies with a known size above 80 GiB so the part count always stays at or under 10,000, e.g. a 100 GiB body now uploads with ~10.2 MiB parts instead of failing at part 10,001. Changes Added : returns the 8 MiB default for bodies at or under 80 GiB, otherwise . now derives the part size from instead of the module-level constant. Decoupled the read-ahead memory bound () from the part size. It previously scaled with the part size (2 parts × concurrency), which would buffer gigabytes for the larger part sizes now used on big uploads; it stays at the previous 128 MiB ceiling. — new tests: keeps 8 MiB at/under the 80 GiB ceiling. Part size scales above 80 GiB and keeps the part count ≤ 10,000 (including for a 5 TiB body). An upload above 80 GiB produces one scaled part instead of many 8 MiB parts. Small bodies still split into 8 MiB parts (no regression). Bodies with an unknown size (streams) keep the 8 MiB default, since the total length isn't known upfront. Tests — 6 suites, 176 tests, 20 snapshots ✅ — 1 suite, 1 test, 2 snapshots ✅ — 3 suites, 19 tests, 3 snapshots ✅ Fixes #1067

Summary Raises the dependency floor for from to . The previous range () still resolves versions affected by CVE-2026-12151 (GHSA-vxpw-j846-p89q), a request-smuggling vulnerability in undici. Pinning the floor to guarantees any install of pulls a patched undici, without forcing a breaking major upgrade. Changes : → : synced via — now resolves (undici-only diff) Tests All three test environments pass on : — 6 suites, 172 tests, 20 snapshots ✅ — 1 suite, 1 test, 2 snapshots ✅ — 3 suites, 19 tests, 3 snapshots ✅ Fixes #1090