v9.0.1

Highlights

• Blocks dot-prefixed static path segments by default, including encoded and nested paths, hidden index and SPA targets, and symlink aliases.
• Adds explicit server.allowDotfiles: true and --allow-dotfiles opt-ins for deliberate content such as /.well-known.
• Includes 33 behavior tests and project-owned native V8 coverage through vanilla-test@2.1.0.

Verification

• Node.js 22.12 and 24 CI
• 92.83% lines, 98.24% functions, 89.97% branches
• Zero runtime dependencies
• Packed CommonJS, ESM, CLI, and dotfile-policy smoke tests