Vayu 0.45.0

What's new in 0.45.0

0.45.0 - 2026-10-22
Read before updating: this version upgrades the workspace database in a way
earlier versions refuse, changes which files a request may send from disk, and
makes a collection run carry on after a script error or a failed connection.
Vayu now sends a request-body file only when you picked it in Vayu on this
machine or it lies under a folder allowed in Settings > Files, and nothing else
can claim a file was chosen. New: the real uuid, lodash, moment,
csv-parse and xml2js libraries in scripts, Postman's legacy script globals,
and History charts that open quickly on a 24-hour run.
Added
- require() runs the libraries Postman scripts use. require('uuid'),
require('lodash') with the _ global, require('moment'),
require('csv-parse/lib/sync') and require('xml2js') with xml2Json run
the real npm libraries (#2650, #2651, #2652, #2653, #2654).
require('crypto-js') and the CryptoJS global cover the MD5, SHA-1 and
SHA-2 hashes, their HMACs and the Hex, Latin1, Utf8 and Base64 encoders
(#2578). Any other module, and any other CryptoJS member such as AES, still
throws and is named in the import notice.
- Postman's legacy script API runs (#2577): tests[...], postman.*,
responseBody, setTimeout and the other timers, and await at the top of
a script. These scripts used to throw at their first line.
- pm.environment, pm.globals and pm.collectionVariables accept a third
argument to set (#2664). set(name, value, { secret: true }) creates a
secret variable, and a type string ('string', 'number', 'boolean',
'json') sets the type. A secret is masked from the next run on, not inside
the run that created it.
- pm.variables.set, unset and clear write a run-local scope that is never
stored (#2564). pm.request.url.addQueryParams and removeQueryParams work
(#2662).
- Import tells you what will not run. The preview names the Postman
requests whose scripts use APIs Vayu does not run (#2576), and the notice
follows CryptoJS members reached through an alias or a destructure (#2628).
It also names the GET body Postman never sends, and the Data file picker has
Read numbers as numbers to match Newman's CSV reading (#2540). The
"file changed since this run" hint also notices a different number reading
(#2644).
- A Postman OAuth 2.0 collection keeps its audience, resource and other
token request parameters (#2536). The OAuth 2.0 token and refresh tables
choose per row whether it goes in the body, the query or a header (#2571). …

Full release notes »