v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @otnc in #371
• fix(serve-static): correct Range header parsing edge cases by @otnc in #372
• fix: recover complete request bodies after client disconnect by @usualoma in #375

New Contributors

• @otnc made their first contribution in #371

Full Changelog: v2.0.8...v2.0.9

v2.0.8

What's Changed

• ci(release): add --no-git-checks option for pnpm stage publish by @yusukebe in #369

Full Changelog: v2.0.7...v2.0.8

v2.0.7

What's Changed

• chore: migrate to pnpm by @BlankParticle in #367
• fix(serve-static): serve precompressed files for application/octet-stream by @yusukebe in #366
• chore: bump supertest by @yusukebe in #368

Full Changelog: v2.0.6...v2.0.7

v2.0.6

What's Changed

• ci: publish to npm from CI with OIDC trusted publishing and bump np by @yusukebe in #361
• ci: use npm Staged publishing by @yusukebe in #364
• fix: preserve status and statusText when cloning a Response with liveheaders by @usualoma in #363

Full Changelog: v2.0.5...v2.0.6

v2.0.5

Security Fix

Fixed a security issue in Serve Static Middleware where prefix-mounted middleware could be bypassed on Windows. This only affects applications running on Windows that use Serve Static Middleware. Affected users are encouraged to upgrade to this version.

See GHSA-frvp-7c67-39w9 for details.

v2.0.4

What's Changed

• fix: stub ws types to prevent them leaking in public types by @BlankParticle in #359

Full Changelog: v2.0.3...v2.0.4

v2.0.3

What's Changed

• chore(ci): update GitHub Actions versions by @BlankParticle in #352
• docs: Align the ServeStaticOptions comment with the current spec by @kakkokari-gtyih in #356
• fix: preserve headers mutated after raw Response construction by @abdulmunimjemal in #357

New Contributors

• @kakkokari-gtyih made their first contribution in #356
• @abdulmunimjemal made their first contribution in #357

Full Changelog: v2.0.2...v2.0.3

v2.0.2

What's Changed

• fix(serve-static): stop using file birthtime for Date header by @usualoma in #350
• fix: handle serveStatic stream fallback backpressure by @usualoma in #351

Full Changelog: v2.0.1...v2.0.2

v2.0.1

What's Changed

• fix: forward Hono response headers during WebSocket upgrade by @gentamura in #346

New Contributors

• @gentamura made their first contribution in #346

Full Changelog: v2.0.0...v2.0.1