Patch Changes
-
🐞🩹 limit request bodies to 10 MiB by default in the Node, Deno, Bun, Cloudflare Pages, Netlify Edge and Vercel Edge adapters (and AWS Lambda / Firebase through Node); configurable with the new
requestBodyLimitoption (by @github-actions in #9074) -
🐞🩹 prevent private responses from entering shared Cloudflare caches (by @Varixo in
0585c24) -
🐞🩹 prevent excessive array lengths from form field indexes (by @Varixo in
b40324c) -
🐞🩹 catch-all route matching no longer hangs on paths containing
//(by @wmertens in #9072) -
🐞🩹
redirect()now strips ASCII tab/LF/CR from the URL, so targets like/<TAB>/example.comcan no longer redirect to another origin (by @github-actions in #9074)