v15.0.0 — Corrected major release for Node.js support

v15.0.0 — Corrected major release for Node.js support

This release establishes the SemVer-correct major version for the Node.js compatibility change introduced in v14.2.0.

v15.0.0 includes all functionality and security updates from v14.2.0 through v14.3.3. Compared with v14.3.3, there are no intended functional changes.

Breaking change

Supported Node.js versions are now:

• ^20.19.0
• ^22.12.0
• >=24.0.0

Node.js 12, 14, 16, 18, and earlier releases of Node 20 and 22 are no longer supported.

Deprecated releases

The following releases were published as 14.x despite this breaking runtime requirement and are now deprecated:

• v14.2.0
• v14.3.0
• v14.3.1
• v14.3.2
• v14.3.3

Upgrade

npm install @pkg-nec/http-server@^15.0.0

For global installation:

npm install --global @pkg-nec/http-server@^15.0.0

v14.3.3 - vulnerability patch

What's Changed

• test: e2e verification with v14.3.2 by @maw629 in #35
• test(e2e): add test for union response streaming and headers by @maw629 in #36
• Update dependabot PR reviewer by @maw629 in #39
• chore: update dependabot.yml - add cooldown for GHA by @maw629 in #40
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in #38
• chore(deps): bump union to ~0.6.0 to fix DEP0066 by @maw629 in #37
• deps: bump tar from 7.5.19 to 7.5.21 by @maw629 in #41
• ci: ossf-scorecard - add missing input to trigger results publish by @maw629 in #42
• chore: add OpenSSF Scorecard badge by @maw629 in #43
• chore: bump to version 14.3.3 by @maw629 in #44

Full Changelog: v14.3.2...v14.3.3

Deprecated: This release introduced a breaking Node.js support change under a 14.x version. Use @pkg-nec/http-server@^15.0.0 instead.

v14.3.2 - vulnerability patch

What's Changed

• ci: add OpenSSF Scorecard workflow by @maw629 in #26
• fix(ci): pin GHA versions by commit hash by @maw629 in #27
• fix(ci): add top-level permission by @maw629 in #28
• fix: update test files with using random ports to avoid EADDRINUSE err by @maw629 in #22
• feat: e2e tests by @maw629 in #25
• docs: add E2E testing badge and quality section to README by @maw629 in #31
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.1 by @dependabot[bot] in #29
• deps: bump brace-expansion and body-parser to fix npm vulnerabilities by @maw629 in #32
• docs: fix correct remarks for http-server-e2e in docs by @maw629 in #33
• chore: bump version to 14.3.2 by @maw629 in #34

Full Changelog: v14.3.1...v14.3.2

Deprecated: This release introduced a breaking Node.js support change under a 14.x version. Use @pkg-nec/http-server@^15.0.0 instead.

v14.3.1

What's Changed

• chore: rename default branch from trunk to main by @maw629 in #19
• chore: add Sponsor button by @maw629 in #20
• ci: harden "npm ci" command by using --ignore-scripts flag by @maw629 in #21
• chore: improve npm discoverability and add fork policy by @maw629 in #23
• chore: bump version to 14.3.1 by @maw629 in #24

Full Changelog: v14.3.0...v14.3.1

Deprecated: This release introduced a breaking Node.js support change under a 14.x version. Use @pkg-nec/http-server@^15.0.0 instead.

v14.3.0 - remove deprecated dependency request

What's Changed

• Add undici-based (built-in from Node 18) HTTP client utility for tests
• Migrate test files to undici-based HTTP client

Audit delta

-5 vulnerabilities (5 → 0 total). The package is now free of vulnerabilities.

Severity	Baseline	After	Delta
Critical	2	0	-2
High	0	0	0
Moderate	3	0	0
Low	0	0	0
Total	5	0	-5

Full Changelog: v14.2.0...v14.3.0

Deprecated: This release introduced a breaking Node.js support change under a 14.x version. Use @pkg-nec/http-server@^15.0.0 instead.

v14.2.0 - bump html-encoding-sniffer from 3.0.0 to 5.0.0

What's Changed

• chore: add dependabot configuration by @maw629 in #13
• ci: updates to node.js.yml workflow by @maw629 in #14
• ci: add dependency-review-action by @maw629 in #15
• fix: potential fix for code scanning alert no. 9: Workflow does not contain permissions by @maw629 in #16
• release: 14.2.0 - bump html-encoding-sniffer from 3.0.0 to 5.0.0 and bump node requirement as a result by @maw629 in #12

Full Changelog: v14.1.4...v14.2.0

Deprecated: This release introduced a breaking Node.js support change under a 14.x version. Use @pkg-nec/http-server@^15.0.0 instead.

v14.1.4 — vulnerability patch

What's Changed

• release: 14.1.4 — remove unused eslint, upgrade tap 14 → 21 by @maw629 in #9

Full Changelog: v14.1.3...v14.1.4

v14.1.3 — vulnerability patch

What's Changed

• release: 14.1.3 vulnerability patch by @maw629 in #8

Full Changelog: v14.1.2...v14.1.3

v14.1.2 — vulnerability patch

First substantive vulnerability patch of this fork. Per-dep same-major bumps to reduce audit surface without touching lib/, bin/, doc/.

Bumps

• minimist 1.2.6 → 1.2.8 (prototype-pollution fix, CVE-2021-44906)
• portfinder 1.0.28 → 1.0.38
• eol (dev) 0.9.1 → 0.10.0
• express (dev) 4.17.1 → 4.22.2

Audit delta: 54 → 47 (-7)

• Critical: 6 (unchanged)
• High: 20 → 16 (-4)
• Moderate: 20 (unchanged)
• Low: 8 → 5 (-3)

Preserved

• Shipped lib/, bin/, doc/ byte-identical to upstream v14.1.1.
• engines.node stays ">=12".
• No API surface changes.

See docs/superpowers/audits/2026-07-11-14.1.2-audit-delta.md for the full per-dep decision table and the list of deps explicitly deferred to 15.0.0.

Published under dist-tag latest — moves off 14.1.1-pkgnec.0 for the first time.

v14.1.1-pkgnec.1 — OIDC pipeline canary

Smoke-test release. Byte-identical to v14.1.1-pkgnec.0 under lib/, bin/, doc/. Retry after PR #5 pinned npm@11.10.0 in publish.yml for OIDC trusted publishing support. Will be deprecated post-verification. Not for production consumption.