v2.0.1-rc.27

compare changes

🚀 Enhancements

• New route rules engine (#1524) (docs)
• session: Add opt-in idleTimeout for sliding expiration (#1513)

🩹 Fixes

• session: Encode large payloads outside node-compatible runtimes (#1515)
• event: ⚠️ Decode only needless escapes in the pathname (#1526)
• middleware: Match use() route filters with rou3 (d9d3124)
• response: Sanitize status and statusText (8e69593)
• Normalize route patterns as pathnames (cbd5c73)
• middleware: Compare method scopes case-insensitively (850f25c)
• request: Compare methods case-insensitively in isMethod (#1528)
• proxy: Keep internal targets on the app origin (07d22ec)
• json-rpc: ⚠️ Require JSON content-type, validate origin and cap batch size (72d8e05)
• fingerprint: ⚠️ Default to SHA-256 and disambiguate components (51e68cd)
• cookie: Keep unparseable set-cookie headers when merging (175ba5c)
• static: Keep encoded backslashes opaque in the asset id (ab3f23c)
• request: Keep the request proxy cache from shadowing real properties (c71f5c0)
• proxy: ⚠️ xfwd must not let client x-forwarded-* headers win (0c7429e)
• response: Keep prepared headers from accumulating on reused Responses (9f766d9)
• request: Keep a malformed x-forwarded-host from stripping the real port (429b994)
• request: ⚠️ Keep the host header from steering the synthesized URL (2b59a3a)
• rules: Keep a route-scoped cache rule from deadlocking the request (484ec58)
• route: Keep removeRoute from unregistering sibling routes (94d0edd)

📖 Documentation

• Clarify getRouterParams decode is a single pass (44621f3)
• rules: Cache rule ends the global middleware chain on misses too (9f3eea3)

📦 Build

• Prevent malformed pathname guard from being tree-shaken (fa00775)

❤️ Contributors

• Shree Bohara (@ShreeBohara)
• Pooya Parsa (@pi0 @pi0x)
• Vijay Misal (@vjymisal0)
• Jayesh Bhade (@Jaybhade)