What's New in AdonisJS - Week of May 31, 2026

The following is AI generated based on GitHub activity across the AdonisJS repositories.

Releases

Here's a quick look at what dropped this week:

• @adonisjs/core v7.3.4 — a backward-compatibility fix for the Legacy encryption driver

• @adonisjs/mail v10.3.0 — new Postmark and Cloudflare Email Service transports, plus a few transport fixes

• @adonisjs/i18n v3.0.1 — a fix for confirmed validation rule translation lookups

• edge-markdown v1.10.2 — the same dashCase bug fixed on the Edge side

Native Postmark and Cloudflare Email Transports

The big new feature this week comes from @adonisjs/mail v10.3.0, which ships two new mail transports: Postmark and Cloudflare Email Service.

Postmark is a popular transactional email provider that, up until now, required a workaround to use with AdonisJS. You can wire it up in config/mail.ts like this:

import env from '#start/env'
import { defineConfig, transports } from '@adonisjs/mail'

export default defineConfig({
  default: 'postmark',

  mailers: {
    postmark: transports.postmark({
      key: env.get('POSTMARK_API_KEY'),
      baseUrl: 'https://api.postmarkapp.com/email',
    }),
  },
})

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  
config
mail.ts

The Cloudflare Email Service transport is also in the codebase, but it's intentionally hidden from defineConfig for now. Cloudflare's service is still in beta, so the team is laying the groundwork ahead of time without surfacing it as a stable option. That's a nice pattern — you'll be able to opt in as soon as it's ready without waiting on the package to catch up.

Encryption Migration Fix in Core

If you've migrated an application from AdonisJS v5 to v6 or v7 and used the Legacy encryption driver to preserve compatibility with old encrypted data, this patch is for you.

The bug was subtle: the Legacy driver was generating initialization vectors (IVs) as raw 16-byte buffers instead of 16-character strings. That mismatch broke decryption of data that was originally encrypted by the old @adonisjs/encryption package. In practice, this means anything stored in your database or sessions that was encrypted under v5 couldn't be decrypted correctly in v7 — which is a pretty significant migration-breaker.

The fix makes the Legacy driver a true drop-in replacement for the old encrypter. If you hit this during a migration and put it on the backburner, now's a good time to revisit it.

make:model Flag Collision Fixed in Lucid

This one's a small but genuinely annoying bug if you've run into it. When using node ace make:model with the -mc flag shorthand, both --transformer and --controller were aliased to -c. That meant running:

node ace make:model -mc Price

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

would silently generate the model, migration, and transformer — but not the controller. And because -c was claimed by transformer, there was no way to combine --controller with the other flags at all.

The fix is simple: the transformer shorthand moves from -c to -t, so -c reliably means controller again. The updated flag layout looks like this:

# Before: -c was claimed by both transformer and controller
node ace make:model -mc Price        # model + migration + transformer (no controller)

# After: transformer now uses -t, so -c reliably means controller
node ace make:model -mtc Price       # model + migration + transformer + controller

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

Worth noting: this is technically a breaking change if anything in your scripts was explicitly relying on -c as the transformer shorthand, so keep that in mind when upgrading.

dashCase Bug Fixes in i18n and edge-markdown

Two separate packages got fixes for the same underlying issue this week, which makes it a fun one to explain.

The dashCase utility — which converts things like fieldName into field-name — has a quirk with alphanumeric strings like h2. When passed through dashCase, h2 was being rewritten to h-2, inserting a hyphen between the letter and the number.

i18n: confirmed validation messages

In @adonisjs/i18n, this bug bit the confirmed validation rule. If you had a field named something like h2, the translation lookup would look for the key h-2 instead of h2, and never find a match. Your custom translation strings for that field just wouldn't be picked up.

The fix corrects the transform so original field names resolve to the right translation keys. As a bonus, translateField is now also overridable when extending I18nMessagesProvider, which gives you more flexibility if you're doing anything custom with the messages provider.

edge-markdown: overriding heading components

The same bug showed up in edge-markdown. If you wanted to override how markdown headings render by creating a custom Edge component — say, h2.edge — it simply wouldn't work. The component discovery step was converting h2 to h-2, so your file was never matched to the element.

After the fix, you can define a component like this and it'll be picked up correctly:

<h2 class="text-2xl font-bold">
  {{ await $slots.default() }}
</h2>

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  
resources
views
components
h2.edge

Super handy if you're using edge-markdown and want consistent heading styles across your app without resorting to global CSS overrides.

Resend and Brevo Transport Fixes

Also bundled into the @adonisjs/mail v10.3.0 release: fixes for the Resend and Brevo transports. Both weren't forwarding custom and list headers on outgoing messages, and there were some edge cases where attachment content wasn't resolving correctly.

If you're using either of those transports, upgrading to v10.3.0 will grab these fixes along with everything else in the release.

New Docs: Protecting Subscription Routes and Testing Broadcasts

The @adonisjs/transmit README got a meaningful update with three previously-missing sections:

• How to protect subscription routes with auth middleware

• A full client-side guide covering beforeSubscribe and Bearer token setup

• A Japa testing section for asserting broadcasts and checking that unauthenticated subscriptions return 401s

If you're using Transmit for server-sent events and felt like the docs were leaving some gaps, this PR fills a lot of them in.

New Docs: Database Assertions for Testing

The v7 docs also got a new section on database assertions — useful for anyone writing Japa tests that need to verify database state after an operation. If that workflow is part of your test suite, it's worth a look.

Supply-Chain Security Hardening

Finally, a coordinated set of security improvements landed across @adonisjs/core, @adonisjs/i18n, and @adonisjs/mail this week. None of it changes runtime behavior, but it's meaningful work:

• npm Trusted Publishing via OIDC

• Pinned GitHub Action SHAs

• npm install --ignore-scripts for dependency installation

• npm audit signatures verification

• Dependabot enabled for GitHub Actions

This kind of infrastructure work is easy to overlook because it's invisible when it's working — but it meaningfully tightens the supply-chain posture of the packages most AdonisJS apps depend on directly. Good to see the team giving it attention.

So, all in all, a solid maintenance week for the ecosystem. The encryption migration fix and the dashCase bugs are probably the most impactful if you've been quietly dealing with either of them, and Postmark support is a welcome addition for anyone on that stack. vinejs, flydrive-js, japa, and Julien-R44's tuyau, hot-hook, and verrou were all quiet this week — so if those are your main dependencies, no action needed.