v1.3.1

What's Changed

Follow-up hardening after the v1.3.0 security pass (#14).

Security

• Resolve . / .. after URI decoding so routing and excludePaths share one canonical path
• Write-once Symbol.for('0http.canonicalPath') — security middleware does not trust mutable req.path
• Logger and Prometheus excludePaths use exact/boundary matching (/health no longer skips /healthcheck)
• CORS: Vary: Origin on string-origin preflights; reject Origin: null for all non-wildcard configs
• Logger: sanitize request IDs; redact Set-Cookie / Authorization / Cookie / X-Api-Key
• MemoryStore and sliding window: maxKeys with fail-closed admission for new keys

Performance

• Skip path decode/collapse/dot work when unnecessary; reuse frozen empty query
• Middleware uses canonical path instead of new URL() per request
• JSON nesting scan short-circuits; custom jsonTypes parsers are cached

Ergonomics

• Types include req.path, req.body, req.files, logger options, errorHandler(err, req), maxKeys
• CI runs bun run lint instead of format

Full Changelog: v1.3.0...v1.3.1

npm publish was left for the maintainer.

v1.3.0

What's Changed

• Security Review 07/02/2026 by @jkyberneees in #13

Full Changelog: v1.2.2...v1.3.0

v1.2.2

What's Changed

• Adding prometheus middleware by @jkyberneees in #10
• Implement lazy loading for middleware dependencies by @jkyberneees in #11
• Updating docs by @jkyberneees in #12

Full Changelog: v1.2.1...v1.2.2

v1.2.1

Changes:

• Fixing rate-limit error handling
• Updating rate-limit middleware documentation

Full Changelog: v1.2.0...v1.2.1

v1.2.0

What's Changed

• Introducing built-in middlewares by @jkyberneees in #9

Full Changelog: v1.1.3...v1.2.0

v1.1.3

Changes:

• Updating README.md

Full Changelog: v1.1.2...v1.1.3

v1.1.2

What's Changed

• Performance and tests improvements by @jkyberneees in #8

Full Changelog: v1.1.1...v1.1.2

v1.1.1

What's Changed

• refactor: apply consistent formatting and update dependencies by @jkyberneees in #7

Full Changelog: v1.1.0...v1.1.1

v1.1.0

Full Changelog: v1.0.4...v1.1.0

Adding TypeScript types

What's Changed

• feat: adding github actions by @jkyberneees in #3
• feat: Adding TypeScript types by @jkyberneees in #4

Full Changelog: v1.0.3...v1.0.4