Meteor.js

An open-source framework for building Web, Mobile, and Desktop applications ☄️

[Meteor.js @meteorjs]

☄️ Meteor Agent Skills are officially here!

17 AI skills for building, debugging and shipping Meteor 3 apps with Codex, Claude Code and more.

npx skills add meteor/agent-skills

https://t.co/Fp3IvbchPR

[Meteor.js @meteorjs]

🚀 Meteor 3.6 is out and is now the recommended release.

Here’s what you can try in 3.6:

• Rspack 2 with @meteorjs/rspack 3.0.0. Meteor can install compatible build dependencies on the first run when automatic installation is enabled. New React apps start with React 19.2.
• Native TypeScript types for Meteor packages. Run meteor types to generate declarations under .meteor/types. Existing apps can keep their current type provider.
• Node.js 26.13.0 and npm 11.20.0, plus MongoDB 8.0.29 for local development.
• New starters for pnpm workspaces and installable Blaze PWAs. The CLI also gets interactive package selection and shell completion for Bash and Zsh.
• A new read-only instrumentation package for observing Meteor methods, publications, and DDP connections.

Upgrading an app with an existing local MongoDB 7 database? Back it up and confirm that its feature compatibility version (FCV) is 7.0 while it’s still running on MongoDB 7. Check the platform requirements and rebuild any native npm dependencies against Node.js 26 before deploying.

Update an existing app
meteor update --release 3.6

Create a new app
meteor create my-app --release 3.6

Thanks to everyone who tested the betas and release candidates, shared reproductions, and contributed fixes. Read the migration notes and tell us how the upgrade goes in the Meteor Forum.

https://t.co/VMuemAysnz

[italojs @italojs_]

☄️ @meteorjs 3.3.3, 3.4.2 and 3.5.3 are now available as security patch releases.

The same six fixes are available across all three release lines:

• Google and Facebook OAuth token validation.
• DDP protocol-handler failures.
• Allow/deny field authorization.
• Dynamic-import request limits and batching.
• Private shell history and compilation caches.
• Trusted deploy destinations before sending credentials.
Each patch preserves its release line’s existing Node and npm versions, allowing applications to receive these fixes within their current Meteor line.

Choose the update matching your application:
3.3 → meteor update --release 3.3.3
3.4 → meteor update --release 3.4.2
3.5 → meteor update --release 3.5.3
Review the migration guidance before deploying, especially if your application uses native Google sign-in, large dynamic-import graphs, field validators or custom deploy servers.

CVE identifiers for the security issues addressed in these releases will be published soon. The fixed versions are already available.

Full announcement and migration guidance:
https://t.co/Z95Kj2RVE3

Thank you to @CloudByGalaxy , @inputlogic and @coderabbitai for their ongoing support of Meteor, and to everyone who reported, implemented, reviewed and tested these fixes.

Please validate the affected flows in your applications and share your upgrade experience.

[italojs @italojs_]

🚀 Meteor 3.6 is out and is now the recommended release.

Here’s what you can try in 3.6:

• Rspack 2 with @meteorjs/rspack 3.0.0. Meteor can install compatible build dependencies on the first run when automatic installation is enabled. New React apps start with React 19.2.
• Native TypeScript types for Meteor packages. Run meteor types to generate declarations under .meteor/types. Existing apps can keep their current type provider.
• Node.js 26.13.0 and npm 11.20.0, plus MongoDB 8.0.29 for local development.
• New starters for pnpm workspaces and installable Blaze PWAs. The CLI also gets interactive package selection and shell completion for Bash and Zsh.
• A new read-only instrumentation package for observing Meteor methods, publications, and DDP connections.

Upgrading an app with an existing local MongoDB 7 database? Back it up and confirm that its feature compatibility version (FCV) is 7.0 while it’s still running on MongoDB 7. Check the platform requirements and rebuild any native npm dependencies against Node.js 26 before deploying.

Update an existing app
meteor update --release 3.6

Create a new app
meteor create my-app --release 3.6

Thanks to everyone who tested the betas and release candidates, shared reproductions, and contributed fixes. Read the migration notes and tell us how the upgrade goes in the Meteor Forum.

https://t.co/4iSyNvm3mx

[Meteor.js @meteorjs]

Meteor 3.3.4, 3.4.3 and 3.5.4 are out. They add the Node.js October security fixes to the Meteor fixes released on 21 October. Update within your release line, and if you manage Node.js separately, update that too.

https://t.co/aHUJTIz9yy

[Meteor.js @meteorjs]

Want to get more involved in Meteor? Our first governance document explains the project's roles and how decisions get made. It gives contributors a place to start when they want to take responsibility for part of the project.

https://t.co/1dcHfesa0V

[Meteor.js @meteorjs]

Meteor Agent Skills 1.1.0-beta.0 gives your coding assistant guidance for the 3.6 beta, including Rspack migration and pnpm workspaces. Our release notes also cover the checks we've run and remaining test gaps.

https://t.co/m7gYF8en7w

[Meteor.js @meteorjs]

Meteor 3.6-beta.0 is here, and we'd love your help testing it. Rspack 2.x and a pnpm workspace starter are ready to try. Use a development or staging app, and check your custom Rspack loaders and configuration.

https://t.co/UcWjnLPVvp

[Meteor.js @meteorjs]

Meteor 3.5 ships accounts-express.

Your Express routes can finally see who is logged in. The middleware reads the Meteor login token, sets req.userId and Meteor.userId(), and returns 401 on anonymous requests.

More details in the article: https://t.co/DrnEPGkYfg

[Meteor.js @meteorjs]

Meteor 3.5.2-beta.0 is out, and we need real apps to break it.

It's a reliability release: refined Rspack builds, updated Cordova Android toolchain ([email protected], targeting API 36), stronger runtime defaults, and DDP connection fixes that came straight from community reports and reproductions.

One command to try it: meteor update --release 3.5.2-beta.0

The feedback that helps most comes from apps using Rspack, Cordova, HttpOnly cookies, custom MongoDB TLS settings, or a large local package warehouse. Two narrow breaking changes to know about: Cordova Android builds need SDK Platform 36 and Build Tools 36.0.0, and test-in-browser no longer supplies jQuery transitively.

Test in dev or staging, keep your backups, and tell us what you find!

Full announcement on the forums: https://t.co/hqEwyZtqnN

[Ber' @dupont_bertrand]

I helped put that together, and it was really exciting 🥳What a great year for @meteorjs👯‍♂️

[Meteor.js @meteorjs]

For 13 years, every DDP message rode on SockJS.

Meteor 3.5 makes the WebSocket transport pluggable. uWebSockets.js is one env var away:

DDP_TRANSPORT=uws

Same method load, ~9% less CPU, ~11% less RAM, ~26% less GC pause. SockJS stays the default.

Check out this article for more: https://t.co/kHyxeSiIAD

[Meteor.js @meteorjs]

We're stoked to welcome Input Logic as a Supernova sponsor of Meteor!

Input Logic is a digital product studio based in British Columbia, Canada. Since 2011 they've been designing and building web and mobile apps end to end (strategy, brand, UX, frontend, backend) for teams like NYU, Consumer Reports, Netgear, Logitech and NASA, and more recently for founders building AI-native products.

They're the kind of company open source depends on but rarely hears from. A studio that ships real products year after year, and then decides to put something back into the tools that made it possible, either through funding or their own open source initiatives. Sponsorship is what turns "someone should fix that" into funded work. As we all know, that means releases shipped, issues answered, docs kept current.

Input Logic choosing to back Meteor means more of that. If you're building something and want a team that can take it from idea to launch, they're worth a conversation.

Thank you, Input Logic. Welcome aboard.

[Meteor.js @meteorjs]

Full walkthrough: what DDP is, how to observe it live, and five ways to keep subscriptions lean.

https://t.co/eGwf0LXW5w

[Meteor.js @meteorjs]

Most Meteor developers have never looked at what their publications actually send over the wire.

It takes a minute: DevTools, Network tab, filter by Sockets, Messages.

The raw DDP messages show exactly which fields go to every connected client, on every change.

[Meteor.js @meteorjs]

We're honored to welcome @coderabbitai as a sponsor of Meteor 🎉

CodeRabbit is an AI code reviewer for GitHub and GitLab. It reads a pull request against your entire codebase, not just the diff, and leaves line-by-line feedback with suggested fixes. It also runs inside VS Code, Cursor, and the terminal, so issues surface before the PR is even open.

And this isn't just a logo on a page. Our team uses CodeRabbit on Meteor every day. It reviews the pull requests that end up in the releases you install.

The part we like most is that it doesn't replace human review, it clears the way for it. First-pass nitpicks get handled automatically, and reviewers spend their attention on the decisions that actually need a person.

If you maintain a repo with more PRs than reviewers, you should definitely check it out: https://t.co/SFrWaOirk7

[Fred Maia @fredmaiaarantes]

One of the best parts of @meteorjs is the ability to deliver native apps.

Capacitor is a natural replacement for the Cordova integration and has finally been released for beta testing.

[Nacho Codoñer 👨🏻‍💻🧾☄️🚀 @nachocodoner]

CapacitorJS is a big step for Meteor.

It modernizes one of Meteor's core strengths: building real-time, synchronized, cross-platform applications from a single web codebase across browsers, Android, and iOS.

One codebase. Real-time, synchronized applications everywhere.

[Meteor.js @meteorjs]

CapacitorJS is coming to Meteor. The core integration is functional today: CLI, build system, native runtime, Hot Code Push, plus three example apps covering Android and iOS workflows.

Still experimental, still open to shaping. Try the checkout and report back: https://t.co/cSMvbHmKu3