2.0.0: unified static middleware

Both npm packages now ship the same framework-independent middleware from master.

Changes

• Unified API for Node.js HTTP, Express 4/5 and Kelp: index, listDirectory and dotfiles.
• Decode request paths once and enforce both lexical and real filesystem containment, including symlinks.
• Escape directory listings, preserve mount prefixes in redirects, and support HEAD and conditional requests.
• Handle missing paths, I/O errors, stream errors and client disconnects consistently.
• Build both npm tarballs from one implementation; the CLI has no framework dependency.

Breaking changes

Node.js 20 or newer is required. Replace index: true with { index: false, listDirectory: true }. Index values must be a single filename or false. Dotfiles are hidden by default, directories redirect to a trailing slash, and missing files fall through normally. See README for full migration details.

Validation

28 test scenarios including HTTP and security regressions, Express 4/5 and Kelp integration, CLI behavior, and clean installation of both release tarballs. GitHub Actions passed on Linux, macOS and Windows with Node.js 20, 22 and 24.

Thanks to Alok Ranjan for privately reporting the original express-static path traversal and independently verifying the 1.2.7 fix.