Security fixes
This release includes a fix for the following security issue:
serveStatic with allowPercentInPath still allows the double-decode middleware bypass
Affects: serveStatic with allowPercentInPath: true. The fix for GHSA-rmxm-3fg6-px4f rejects a path containing %, but the allowPercentInPath option skipped that check entirely. A malformed percent sequence such as /static/%%36%31dmin/secret.txt was routed as /static/%61dmin/secret.txt, so middleware on /static/admin/* did not run, and serveStatic then decoded %61 to a and served static/admin/secret.txt. The default configuration was already fixed in 2.1.3. GHSA-fj57-4f93-cfw6
serveStatic now accepts the second decode only when its result equals the routed path with %25 replaced by %. File names containing a literal %, requested as %25, are served as before.
The same fix ships in hono v4.13.18 (GHSA-74fm-fwc7-3fwp).
Full Changelog: v2.1.6...v2.1.7