- deps: http-errors@~1.6.3
- deps: depd@~1.1.2
- deps: setprototypeof@1.1.0
- deps: statuses@'>= 1.4.0 < 2'
- Fix resolving paths with certain special characters
- deps: http-errors@~1.6.2
- Make
messageproperty enumerable forHttpErrors - deps: depd@1.1.1
- deps: setprototypeof@1.0.3
- Make
- deps: path-is-absolute@1.0.1
- deps: http-errors@~1.5.0
- Use
setprototypeofmodule to replace__proto__setting - deps: inherits@2.0.1
- deps: statuses@'>= 1.3.0 < 2'
- perf: enable strict mode
- Use
- deps: http-errors@~1.4.0
- Use
path-is-absoluteto better detect absolute paths - perf: enable strict mode
- perf: skip a variable reassignment
- deps: http-errors@~1.3.1
- Construct errors using defined constructors from
createError - Fix error names that are not identifiers
- Set a meaningful
nameproperty on constructed errors
- Construct errors using defined constructors from
- Fix root path disclosure
- Change error to 403 Forbidden when outside root
- Fix argument type errors to be consistent
- Fix path traversal vulnerability
- Use
http-errorsmodule directly
- Resolve the root path argument
- Use
http-assertmodule
- Initial release