Repository navigation
assets: v5.0.1
@routup/assets5.0.1 fixes first-request file serving and hardens lookups with scanning disabled. These notes coverassets-v5.0.0→assets-v5.0.1.
👀 Highlights
📂 Serve files on the first request
Requests now wait for the initial directory scan, including nested directories, instead of returning a premature 404 for files that exist. You do not need a startup delay after registering the plugin:
import { App } from 'routup';
import { assets } from '@routup/assets';
const app = new App();
app.use(assets('public'));
// Waits for the scan before looking up public/html/index.html.
const response = await app.fetch(new Request('http://localhost/html/index.html'));Dangling symlinks and entries removed during scanning are skipped rather than failing the whole scan. A missing or unreadable root directory still fails; that failure now reaches the request as a 500 instead of an unhandled rejection.
🔎 Safer lookups without a scan
With scan: false, lookup candidates whose resolved paths escape the configured directory are skipped. The default dotfile filter now applies even when you do not pass ignores: requests such as /.env are no longer served by default, while /.well-known/file.txt remains accessible.
Note
Symlinks inside the directory are still followed. The path check does not make the directory a symlink sandbox.
⚠️ Heads-Up Before Upgrading
| Change | What to do |
|---|---|
The Routup peer dependency moves from ^6.0.0 to ^6.1.0. |
Update Routup to a compatible 6.1+ version. |
Default dotfile filtering is enforced with scan: false. |
Check any routes that intentionally expose dotfiles; use dotFiles: true only if you intend to serve them. |
⬆️ Upgrading
npm install @routup/assets@^5.0.1 routup@^6.1.0