v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @bilal-azam in #378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @mohamedramadan14 in #383

New Contributors

• @bilal-azam made their first contribution in #378
• @mohamedramadan14 made their first contribution in #383

Full Changelog: v2.0.12...v2.1.0

v1.19.17

1.19.17

v2.0.12

What's Changed

• test: replace supertest by @BlankParticle in #379
• fix(response): copy headers when init is a foreign Response by @yusukebe in #382

Full Changelog: v2.0.11...v2.0.12

v2.0.11

What's Changed

• test: use a custom helper for path traversal tests by @BlankParticle in #377
• perf(request): fast-path QUERY methods by @usualoma in #376
• perf(request): fast-path PATCH method by @yusukebe in #380

Full Changelog: v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @otnc in #371
• fix(serve-static): correct Range header parsing edge cases by @otnc in #372
• fix: recover complete request bodies after client disconnect by @usualoma in #375

New Contributors

• @otnc made their first contribution in #371

Full Changelog: v2.0.8...v2.0.9

v2.0.8

What's Changed

• ci(release): add --no-git-checks option for pnpm stage publish by @yusukebe in #369

Full Changelog: v2.0.7...v2.0.8

v2.0.7

What's Changed

• chore: migrate to pnpm by @BlankParticle in #367
• fix(serve-static): serve precompressed files for application/octet-stream by @yusukebe in #366
• chore: bump supertest by @yusukebe in #368

Full Changelog: v2.0.6...v2.0.7

v2.0.6

What's Changed

• ci: publish to npm from CI with OIDC trusted publishing and bump np by @yusukebe in #361
• ci: use npm Staged publishing by @yusukebe in #364
• fix: preserve status and statusText when cloning a Response with liveheaders by @usualoma in #363

Full Changelog: v2.0.5...v2.0.6

v2.0.5

Security Fix

Fixed a security issue in Serve Static Middleware where prefix-mounted middleware could be bypassed on Windows. This only affects applications running on Windows that use Serve Static Middleware. Affected users are encouraged to upgrade to this version.

See GHSA-frvp-7c67-39w9 for details.