🚀 Enhancements
- New route rules engine (#1524) (docs)
- session: Add opt-in
idleTimeoutfor sliding expiration (#1513)
🩹 Fixes
- session: Encode large payloads outside node-compatible runtimes (#1515)
- event: ⚠️ Decode only needless escapes in the pathname (#1526)
- middleware: Match
use()route filters with rou3 (d9d3124) - response: Sanitize
statusandstatusText(8e69593) - Normalize route patterns as pathnames (cbd5c73)
- middleware: Compare method scopes case-insensitively (850f25c)
- request: Compare methods case-insensitively in isMethod (#1528)
- proxy: Keep internal targets on the app origin (07d22ec)
- json-rpc: ⚠️ Require JSON content-type, validate origin and cap batch size (72d8e05)
- fingerprint: ⚠️ Default to
SHA-256and disambiguate components (51e68cd) - cookie: Keep unparseable set-cookie headers when merging (175ba5c)
- static: Keep encoded backslashes opaque in the asset id (ab3f23c)
- request: Keep the request proxy cache from shadowing real properties (c71f5c0)
- proxy: ⚠️ xfwd must not let client
x-forwarded-*headers win (0c7429e) - response: Keep prepared headers from accumulating on reused Responses (9f766d9)
- request: Keep a malformed
x-forwarded-hostfrom stripping the real port (429b994) - request: ⚠️ Keep the host header from steering the synthesized URL (2b59a3a)
- rules: Keep a route-scoped cache rule from deadlocking the request (484ec58)
- route: Keep
removeRoutefrom unregistering sibling routes (94d0edd)
📖 Documentation
- Clarify getRouterParams decode is a single pass (44621f3)
- rules: Cache rule ends the global middleware chain on misses too (9f3eea3)
📦 Build
- Prevent malformed pathname guard from being tree-shaken (fa00775)
❤️ Contributors
- Shree Bohara (@ShreeBohara)
- Pooya Parsa (@pi0 @pi0x)
- Vijay Misal (@vjymisal0)
- Jayesh Bhade (@Jaybhade)