nitrojs/nitro v2.13.6

on GitHub

compare changes

🔒 Security

This release contains 3 security fixes and additional hardening for cache, proxy and redirect route rules. If you're on nitropack v2 (including Nuxt 3 and 4), please upgrade.

• GHSA-39r7-wfcx-99xg: Cached event handlers might share entries across HTTP methods or replay per-user Set-Cookie headers
• GHSA-rhhp-7488-3qwf: Proxy route rule scope bypass via empty // segment and prefix re-entry
• GHSA-pqxc-r4h5-jc95: Open redirect via backslash and control characters in wildcard redirect route rules

🔥 Performance

• externals: Memoize tryResolve per importer directory in node-externals (v2) (#4800)

🩹 Fixes

• Add typeFrom support for autoimports exports generation (#3963)
• cache: Only cache GET/HEAD and never store per-user responses (9c2691d9)
• route-rules: Validate final proxy/redirect target scope (353eff5c)
• route-rules: Prevent open redirect via backslash and control characters in wildcard redirects (f16a4fad)

Dependencies

• Update archiver to v8 (#4936)

Preset Changes

• vercel: Support node.js 26 (#4968)

❤️ Contributors

• Pooya Parsa (@pi0)
• Ali Smesseim (@ali-vercel)
• Liang Xu (@lx3133584)
• Octavio Araiza (@8ctavio)
• @agustin18