v4.0.0-beta.1

compare changes

🚀 Enhancements

• Add unflatten handler (#248)
• server: Add parseURL option to customize URL parsing (#320)
• server: Answer etag revalidation before image processing (52d0000)
• server: Send X-Content-Type-Options: nosniff header (85290d9)
• handlers: Add opacity and the missing sharp operation modifiers (#322)
• http: Support opt-in blockPrivateIPs (f23c374)
• fs: ⚠️ Reject symlinks resolving outside the served dir (488fcf5)

🩹 Fixes

• handlers: Parse all modulate args and add lightness (#317)
• Use svg pass-thru when requested format is svg (#262)
• Add extendWith arg to extend modifier (#315)
• ⚠️ Always sanitize svg sources (#319)
• handlers: Validate all modifier arguments (#321)
• handlers: Clamp output dimensions with maxOutputDimension option (013c144)
• storage/http: Return 400 for unparseable ids instead of 500 (aeaae5b)
• storage/http: ⚠️ Only follow redirects within the domain allowlist (97e6eb7)
• ipx: Compare handler order numerically when sorting (9446f68)
• handlers: Apply maxOutputDimension to extend after a resize (5606f0f)
• fs: Dir fall-through and maxAge handling (933b0d6)
• fs: Accept non-JSON env values and guard process access (725a63c)

💅 Refactors

• Use node:path (c73f3c1)

📖 Documentation

• Add samples (5204d9c)

📦 Build

• Add engines field to package.json (c7227fb)

🤖 CI

• Run tests on macos and windows too (8ddca9b)

❤️ Contributors

• Pooya Parsa (@pi0)
• Damian Głowala (@DamianGlowala])
• Simon Garner (@sgarner)
• Nathan Chase (@nathanchase)