1.4.0

• Fix resolving paths with certain special characters
• deps: http-errors@~1.6.2
  • Make message property enumerable for HttpErrors
  • deps: depd@1.1.1
  • deps: setprototypeof@1.0.3

1.3.3

• deps: path-is-absolute@1.0.1

1.3.2

• deps: http-errors@~1.5.0
  • Use setprototypeof module to replace __proto__ setting
  • deps: inherits@2.0.1
  • deps: statuses@'>= 1.3.0 < 2'
  • perf: enable strict mode

1.3.1

• deps: http-errors@~1.4.0

1.3.0

• Use path-is-absolute to better detect absolute paths
• perf: enable strict mode
• perf: skip a variable reassignment

1.2.2

• deps: http-errors@~1.3.1
  • Construct errors using defined constructors from createError
  • Fix error names that are not identifiers
  • Set a meaningful name property on constructed errors

1.2.1

• Fix root path disclosure

1.2.0

• Change error to 403 Forbidden when outside root
• Fix argument type errors to be consistent
• Fix path traversal vulnerability
• Use http-errors module directly

1.1.0

• Resolve the root path argument
• Use http-assert module

1.0.0

• Initial release