Fixed
- Extensionless exported routes such as
/changelog,/docs, and/privacynow resolve to theirindex.htmlfile instead of attempting to stream a directory and crashing the Linux HTTP process withEISDIR. - URL path components are decoded and basename-sanitized before filesystem lookup; dot, backslash, NUL, malformed-encoding, and out-of-root paths fail closed.
- Static candidates must resolve to regular files inside the landing root, and asynchronous read-stream failures are handled without terminating the server.
Validation
- 53 test files / 1,493 tests passed.
- 91.26% branch coverage.
- Full and production npm audits report zero vulnerabilities.
- CodeQL passed for Actions, C#, and JavaScript/TypeScript, with no new Advanced Security alerts.
- Windows and macOS Node 20/22/24 validation passed.
- Windows and macOS connector installer workflows passed.
- A real local HTTP process served root, no-slash routes, and nested Next.js assets at 200; encoded, backslash, and malformed traversal probes returned 404;
/healthremained 200 and unauthenticated/mcpremained 401.
Release contents
This patch includes the full v1.11 workflow set and updates the npm MCP package, signed CEP connector, direct UXP CCX, Claude Desktop MCPB, Codex/Claude plugins, landing site, and public documentation together.
Automated validation still does not establish behavior inside a licensed Premiere host.
Full Changelog: v1.11.0...v1.11.1