AdonisJS Framework

@adonisjs.com

A fully featured @nodejs.org framework for creating bespoke backend applications in record time. Created by @iamvirk.bsky.social. Learn on @adocasts.com

We've released security fixes addressing two vulnerabilities in AdonisJS multipart body parsing (Prototype Pollution & DoS). Update now: - v6 users → adonisjs/core 6.20.0 - v7 users → adonisjs/core 7.0.0-next.28

We've published a security fix for a Path Traversal vulnerability affecting multipart file uploads in AdonisJS (CVE-2026-21440). Update now: - v6 users → adonisjs/core 6.19.2 - v7 users → adonisjs/core 7.0.0-next.18 github.com/adonisjs/cor...

AdonisJS Path Traversal in Multipart File Handling

### Summary **Description** A Path Traversal (CWE-22) vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server...

github.com

The next AdonisJS docs will ship with dedicated LLM endpoints. Not just an llms.txt listing pages. Actual cheat sheets crafted for AI assistants. Minimal context, maximum accuracy. Your AI pair programmer is about to get much better at AdonisJS 🤖

AdonisJS documentation about routing with LLM only text

Shipping a new ESLint rule: no-backend-import-in-frontend Catches accidental backend imports in your Inertia frontend files at lint time. Type imports still allowed, and you can whitelist shared paths. One less runtime surprise 🙌

// ❌ Error: Importing backend code in frontend files is not allowed
import User from '#models/user'
import { UserService } from '../../app/services/user_service'


// ✅ Correct - type-only imports are allowed
import type { User } from '#models/user'
import type { UserService } from '../../app/services/user_service'

// ✅ Correct - imports pointing to inertia/ are allowed
import { Button } from '#components/button' // if #components/* -> ./inertia/components/*
import { utils } from '../utils'

Just kicked off a new project with AdonisJS 7 and finally using all our codegen work in a real app feels insane. Type-safety basically everywhere, the DX is wild.

There's a common misconception that frameworks like @adonisjs.com or NestJS are inherently "heavy" compared to Express. Both start with a very small core and let you opt-in to official (or third-party) modules as you need them.

A new lesson just dropped in our Adding an API series! We'll remove the modules show route from our resource using except, then refactor to add a GetModules action for our modules index & courses show routes. Get started ↓ buff.ly/r5xoN1K

🚨 In 30 minutes, Harminder will be live on GitHub’s Open Source Friday! Tune in to hear about the motivation behind AdonisJS, the design choices that shaped it, and what sets it apart from other frameworks.

Open Source Friday with AdonisJS creator Harminder Virk

Building a JavaScript framework from scratch is no small feat—especially one as developer-focused and feature-rich as AdonisJS. In this episode of Open Source Friday, Karan M V from GitHub hosts Harm...

youtube.com

After a year of uncertainty, the TypeScript team has officially confirmed that spec-compliant decorators will not support emitting type metadata. Since decorators are used sparingly in AdonisJS, migrating away from the experimental syntax will mostly affect Dependency Injection.

RyanCavanaugh writting : "I don't think we're going to have decorator metadata in ES decorators. It's unlikely. Not impossible, but very unlikely. We are increasingly moving away from any type-based emit in all forms; it's slow, error-prone, impossible for third-party tools to replicate, and not standardized.

emitDecoratorMetadata is documented as experimental, and also requires you to set another flag with experimental in the name. Features don't stop becoming experimental due to the passage of time -- if we thought they were not experimental, we would have renamed them. They're still experimental, and it's still up to each developer to understand the consequences of taking dependencies on features that are not considered stable.

We tried for a very long time to align the TC39 decorator proposal with the experimental decorators that originated in TypeScript. The committee didn't land on something that exactly aligns with what we have, with one...."

Coming in the next version of Lucid: First-class support for Multi-Tenant applications! With built-in Dependency Injection, you can effortlessly create a custom QueryClient that automatically applies the right query constraints for each tenant. Learn more 👇