v1.15.11

compare changes

🏡 Chore

• Update defu to 6.1.6 (6125485)
• Update deps (4998dd8)
• Update cookie-es (d166186)

v2.0.1-rc.20

compare changes

💅 Refactors

• Pass single obj to serializeCookie (a0761e9)
• Mark new TextEncoder as pure (9e4e64e)

📦 Build

• Upgrade mdzilla to 0.2 (2907555)
• Update cookie-es (84bc9bc)

v2.0.1-rc.19

compare changes

🩹 Fixes

• body: Enforce stream-based body size check regardless of content-length header (708a3aa)

💅 Refactors

• Upgrade cookie-es to v3 (9d244a7)

📖 Documentation

• Remove await-thenable lint rule and fix invalid await usage (#1353)

📦 Build

• Move docs to dist (e87ceca)

❤️ Contributors

• Pooya Parsa (@pi0)
• Nick Spaargaren (@nickspaargaren)

v1.15.10

compare changes

🩹 Fixes

• Preserve percent-encoded req.url in app event handler (#1355)

❤️ Contributors

• Sergio Azócar (@sergioazoc)

v2.0.1-rc.18

compare changes

🩹 Fixes

• utils: Prevent open redirect via protocol-relative path in redirectBack() (459a1c6)
• cookie: Prevent unbounded chunked cookie count (399257c)

v2.0.1-rc.17

compare changes

🚀 Enhancements

• Add redirectBack utility (#1329)
• Add removeRoute (#1331)

🩹 Fixes

• cors: Preserve CORS headers on error responses (#1352)
• sse: Mark writer as closed on write failure (#1322)
• request: Include Allow header in 405 response (#1314)
• sse: Sanitize carriage returns in event stream data and comments (79cabe3)
• mount: Normalize percent-encoded pathname in requestWithBaseURL (0295f90)
• static: Prevent path traversal via double-encoded dot segments (8e9993f)
• mount: Enforce path segment boundary in startsWith check (7ccc9e2)

📖 Documentation

• Fix typo (#1351)
• Improve security notes about proxy utils (448e7eb)

🏡 Chore

• Enable type-aware linting with oxc-lint (#1349)

❤️ Contributors

• Pooya Parsa (@pi0)
• Wind (@productdevbook)
• Terminal Chai (@terminalchai)
• Nick Spaargaren (@nickspaargaren)
• Gabriel Trzimajewski (@Sn0wye)

v1.15.9

compare changes

🩹 Fixes

• Preserve %25 in pathname (1103df6)
• static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
• sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

• Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

• static: Narrow path traversal check to match .. as a path segment only (c049dc0)
• app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

• Remove implicit event handler conversion warning (#1340)

❤️ Contributors

• Pooya Parsa (@pi0)
• Wind (@productdevbook)

v2.0.1-rc.16

compare changes

📦 Dependencies

• Update rou3 to 0.8 (4701dc4) (release notes)
• Update srvx to 0.11.9 (05959e38) (release notes)