v2.2.1

Security

• Escape error, error_description, and error_uri on the callback error page. A crafted link to the local callback URL could otherwise inject script while the server was listening. error_uri is shown only for http(s) links (#50)
• Vulnerabilities can now be reported privately. See SECURITY.md

Bug Fixes

• Node.js: getAuthCode() no longer hangs for up to 60s after the callback, a timeout, or an abort when the browser keeps an idle preconnected socket open. The success page is still delivered in full (#36)
• fileStore(): concurrent set()/delete() calls on the same instance no longer overwrite each other and lose tokens. Separate instances or processes sharing a file are still not synchronized. Writes use a unique temp file flushed to disk before the rename. Token files are created 0600 and new directories 0700 (#38)
• Browser launch: the bundled open is updated to 11.0.3. Windows no longer kills the launched browser when the parent process exits. On WSL, launching no longer fails when the working directory is unreachable from Windows (#45)

Upgrade Notes

• Requires Node.js 18.2+, the first release with server.closeAllConnections().
• Custom errorHtml placeholders are now HTML-escaped, and {{error_uri}} is empty unless it is an http(s) URL. Templates that relied on raw HTML in a placeholder will render it as text.

Thanks @mina-asham and @AbhikRao (first contribution, #37 and #38)!

Full Changelog: v2.2.0...v2.2.1