unreleased

deps: http-errors@~1.6.3
- deps: depd@~1.1.2
- deps: setprototypeof@1.1.0
- deps: statuses@'>= 1.4.0 < 2'

1.4.0 / 2018-02-13

Fix resolving paths with certain special characters
deps: http-errors@~1.6.2
- Make message property enumerable for HttpErrors
- deps: depd@1.1.1
- deps: setprototypeof@1.0.3

1.3.3 / 2016-11-14

deps: path-is-absolute@1.0.1

1.3.2 / 2016-06-17

deps: http-errors@~1.5.0
- Use setprototypeof module to replace __proto__ setting
- deps: inherits@2.0.1
- deps: statuses@'>= 1.3.0 < 2'
- perf: enable strict mode

1.3.1 / 2016-02-28

deps: http-errors@~1.4.0

1.3.0 / 2015-06-15

Use path-is-absolute to better detect absolute paths
perf: enable strict mode
perf: skip a variable reassignment

1.2.2 / 2015-02-16

deps: http-errors@~1.3.1
- Construct errors using defined constructors from createError
- Fix error names that are not identifiers
- Set a meaningful name property on constructed errors

1.2.1 / 2015-01-19

Fix root path disclosure

1.2.0 / 2015-01-05

Change error to 403 Forbidden when outside root
Fix argument type errors to be consistent
Fix path traversal vulnerability
Use http-errors module directly

1.1.0 / 2014-12-27

Resolve the root path argument
Use http-assert module

1.0.0 / 2014-03-23

Initial release