released v5.0.10 - fix: createResponse could pollute headers in Node …

…still, if given request as second arg

CHANGELOG.md

@@ -1,5 +1,7 @@
 ## Changelog
 
+- **v5.0.10**
+  - fixed: response formatters in finally stage could still cross pollute headers in Node
 - **v5.0.9**
   - fixed: cors preflight should reflect requested headers as the default (required for credentials)
 - **v5.0.7**

package.json

@@ -1,6 +1,6 @@
 {
   "name": "itty-router",
-  "version": "5.0.9",
+  "version": "5.0.10",
   "description": "A tiny, zero-dependency router, designed to make beautiful APIs in any environment.",
   "main": "./index.js",
   "module": "./index.mjs",

src/createResponse.spec.ts

@@ -75,13 +75,10 @@ describe('createResponse(mimeType: string, transform?: Function)', () => {
     expect(r2).toBeUndefined()
   })
 
-  it('will not apply a Request as 2nd options argument (using Request.url check method)', async () => {
+  it('will not apply a Request as 2nd options argument', async () => {
     const request = new Request('http://foo.bar', { headers: { foo: 'bar' }})
     const response = json(1, request)
-    // const { ...restCheck } = request
 
-    // expect(restCheck.url).toBe('http://foo.bar/')
-    // expect(request.url).toBe('http://foo.bar/')
     expect(response.headers.get('foo')).toBe(null)
   })
 

src/createResponse.ts

@@ -5,10 +5,11 @@ import { ResponseFormatter } from './types'
     format = 'text/plain; charset=utf-8',
     transform?: (body: any) => any,
   ): ResponseFormatter =>
-  (body, { ...options } = {}) => {
+  (body, options = {}) => {
     if (body === undefined || body instanceof Response) return body
 
-    const response = new Response(transform?.(body) ?? body, options)
+    // @ts-ignore
+    const response = new Response(transform?.(body) ?? body, options.url ? undefined : options)
     response.headers.set('content-type', format)
     return response
   }