meteor/meteor release/METEOR@3.5.5 on GitHub

v3.5.5, 2026-11-12

Update Node.js to 24.22.3, preserving this release line’s Node major, with the November 11 security fixes.
Harden archive extraction, including symlink containment, and update the dev bundle to tar-fs 2.1.5.
Expire email verification tokens, restrict client-side OAuth configuration in production, and reject malformed DDP messages without stalling connections.
Fall back to MongoDB polling for selectors that cannot be safely re-evaluated locally, and preserve top-level __proto__ data in oplog conversion.
Prevent credential leakage through the HMR server and remove deployment settings from the legacy deployment information URL.
Update the Cordova webapp plugin to reject unsafe asset paths and update the HTTP query parser.
Update the npm installer dependencies and protect its JavaScript extraction fallback against paths and links escaping the installation directory.
Validate malformed passwordless login requests before user lookup and preserve custom user data.
Fix the Rspack static-asset manifest and legacy warehouse handling.
Restrict automatic accounts-express credential forwarding to trusted origins.
Require server opt-in for HttpOnly cookie endpoints, validate request origins, rate-limit requests, and restore client retry behavior.

No general API removals. Security restrictions on previously unsafe behavior are described in Migration Steps.

N/A

Please run the following command to update your project:

meteor update --release 3.5.5

Email verification tokens now expire after three days. Configure emailVerificationTokenExpirationInDays or emailVerificationTokenExpiration through Accounts.config on the server when a different lifetime is required.
Configure OAuth services on the server or through settings in production. Client calls to configureLoginService require explicit server opt-in with allowClientServiceConfiguration.
Queries using selectors that cannot be safely matched locally may use polling; monitor query load after updating.
Unsafe archive or Cordova asset paths are rejected. Keep assets and extraction links within their intended directories.
For automatic authentication to a separate trusted API origin, configure Meteor.settings.public.packages["accounts-express"].authFetchAllowedOrigins. Explicit Authorization headers remain supported.
If using HttpOnly login cookies, enable them on the server as well as the client. Configure httpOnlyCookieAllowedOrigins for additional trusted origins and review the default endpoint rate limit of 30 requests per 10 seconds.