opusdev/vector-similarity-api
1
14.22.1 / 2025-12-012==========3 4 * Revert security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))5 64.22.0 / 2025-12-017==========8 * Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))9 * deps: use tilde notation for dependencies10 * deps: qs@6.14.011 124.21.2 / 2024-11-0613==========14 15 * deps: path-to-regexp@0.1.1216 - Fix backtracking protection17 * deps: path-to-regexp@0.1.1118 - Throws an error on invalid path values19 204.21.1 / 2024-10-0821==========22 23 * Backported a fix for [CVE-2024-47764](https://nvd.nist.gov/vuln/detail/CVE-2024-47764)24 25 264.21.0 / 2024-09-1127==========28 29 * Deprecate `res.location("back")` and `res.redirect("back")` magic string30 * deps: serve-static@1.16.231 * includes send@0.19.032 * deps: finalhandler@1.3.133 * deps: qs@6.13.034 354.20.0 / 2024-09-1036==========37 * deps: serve-static@0.16.038 * Remove link renderization in html while redirecting39 * deps: send@0.19.040 * Remove link renderization in html while redirecting41 * deps: body-parser@0.6.042 * add `depth` option to customize the depth level in the parser43 * IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`)44 * Remove link renderization in html while using `res.redirect`45 * deps: path-to-regexp@0.1.1046 - Adds support for named matching groups in the routes using a regex47 - Adds backtracking protection to parameters without regexes defined48 * deps: encodeurl@~2.0.049 - Removes encoding of `\`, `|`, and `^` to align better with URL spec50 * Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie`51 - Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie52 534.19.2 / 2024-03-2554==========55 56 * Improved fix for open redirect allow list bypass57 584.19.1 / 2024-03-2059==========60 61 * Allow passing non-strings to res.location with new encoding handling checks62 634.19.0 / 2024-03-2064==========65 66 * Prevent open redirect allow list bypass due to encodeurl67 * deps: cookie@0.6.068 694.18.3 / 2024-02-2970==========71 72 * Fix routing requests without method73 * deps: body-parser@1.20.274 - Fix strict json error message on Node.js 19+75 - deps: content-type@~1.0.576 - deps: raw-body@2.5.277 * deps: cookie@0.6.078 - Add `partitioned` option79 804.18.2 / 2022-10-0881===================82 83 * Fix regression routing a large stack in a single route84 * deps: body-parser@1.20.185 - deps: qs@6.11.086 - perf: remove unnecessary object clone87 * deps: qs@6.11.088 894.18.1 / 2022-04-2990===================91 92 * Fix hanging on large stack of sync routes93 944.18.0 / 2022-04-2595===================96 97 * Add "root" option to `res.download`98 * Allow `options` without `filename` in `res.download`99 * Deprecate string and non-integer arguments to `res.status`100 * Fix behavior of `null`/`undefined` as `maxAge` in `res.cookie`101 * Fix handling very large stacks of sync middleware102 * Ignore `Object.prototype` values in settings through `app.set`/`app.get`103 * Invoke `default` with same arguments as types in `res.format`104 * Support proper 205 responses using `res.send`105 * Use `http-errors` for `res.format` error106 * deps: body-parser@1.20.0107 - Fix error message for json parse whitespace in `strict`108 - Fix internal error when inflated body exceeds limit109 - Prevent loss of async hooks context110 - Prevent hanging when request already read111 - deps: depd@2.0.0112 - deps: http-errors@2.0.0113 - deps: on-finished@2.4.1114 - deps: qs@6.10.3115 - deps: raw-body@2.5.1116 * deps: cookie@0.5.0117 - Add `priority` option118 - Fix `expires` option to reject invalid dates119 * deps: depd@2.0.0120 - Replace internal `eval` usage with `Function` constructor121 - Use instance methods on `process` to check for listeners122 * deps: finalhandler@1.2.0123 - Remove set content headers that break response124 - deps: on-finished@2.4.1125 - deps: statuses@2.0.1126 * deps: on-finished@2.4.1127 - Prevent loss of async hooks context128 * deps: qs@6.10.3129 * deps: send@0.18.0130 - Fix emitted 416 error missing headers property131 - Limit the headers removed for 304 response132 - deps: depd@2.0.0133 - deps: destroy@1.2.0134 - deps: http-errors@2.0.0135 - deps: on-finished@2.4.1136 - deps: statuses@2.0.1137 * deps: serve-static@1.15.0138 - deps: send@0.18.0139 * deps: statuses@2.0.1140 - Remove code 306141 - Rename `425 Unordered Collection` to standard `425 Too Early`142 1434.17.3 / 2022-02-16144===================145 146 * deps: accepts@~1.3.8147 - deps: mime-types@~2.1.34148 - deps: negotiator@0.6.3149 * deps: body-parser@1.19.2150 - deps: bytes@3.1.2151 - deps: qs@6.9.7152 - deps: raw-body@2.4.3153 * deps: cookie@0.4.2154 * deps: qs@6.9.7155 * Fix handling of `__proto__` keys156 * pref: remove unnecessary regexp for trust proxy157 1584.17.2 / 2021-12-16159===================160 161 * Fix handling of `undefined` in `res.jsonp`162 * Fix handling of `undefined` when `"json escape"` is enabled163 * Fix incorrect middleware execution with unanchored `RegExp`s164 * Fix `res.jsonp(obj, status)` deprecation message165 * Fix typo in `res.is` JSDoc166 * deps: body-parser@1.19.1167 - deps: bytes@3.1.1168 - deps: http-errors@1.8.1169 - deps: qs@6.9.6170 - deps: raw-body@2.4.2171 - deps: safe-buffer@5.2.1172 - deps: type-is@~1.6.18173 * deps: content-disposition@0.5.4174 - deps: safe-buffer@5.2.1175 * deps: cookie@0.4.1176 - Fix `maxAge` option to reject invalid values177 * deps: proxy-addr@~2.0.7178 - Use `req.socket` over deprecated `req.connection`179 - deps: forwarded@0.2.0180 - deps: ipaddr.js@1.9.1181 * deps: qs@6.9.6182 * deps: safe-buffer@5.2.1183 * deps: send@0.17.2184 - deps: http-errors@1.8.1185 - deps: ms@2.1.3186 - pref: ignore empty http tokens187 * deps: serve-static@1.14.2188 - deps: send@0.17.2189 * deps: setprototypeof@1.2.0190 1914.17.1 / 2019-05-25192===================193 194 * Revert "Improve error message for `null`/`undefined` to `res.status`"195 1964.17.0 / 2019-05-16197===================198 199 * Add `express.raw` to parse bodies into `Buffer`200 * Add `express.text` to parse bodies into string201 * Improve error message for non-strings to `res.sendFile`202 * Improve error message for `null`/`undefined` to `res.status`203 * Support multiple hosts in `X-Forwarded-Host`204 * deps: accepts@~1.3.7205 * deps: body-parser@1.19.0206 - Add encoding MIK207 - Add petabyte (`pb`) support208 - Fix parsing array brackets after index209 - deps: bytes@3.1.0210 - deps: http-errors@1.7.2211 - deps: iconv-lite@0.4.24212 - deps: qs@6.7.0213 - deps: raw-body@2.4.0214 - deps: type-is@~1.6.17215 * deps: content-disposition@0.5.3216 * deps: cookie@0.4.0217 - Add `SameSite=None` support218 * deps: finalhandler@~1.1.2219 - Set stricter `Content-Security-Policy` header220 - deps: parseurl@~1.3.3221 - deps: statuses@~1.5.0222 * deps: parseurl@~1.3.3223 * deps: proxy-addr@~2.0.5224 - deps: ipaddr.js@1.9.0225 * deps: qs@6.7.0226 - Fix parsing array brackets after index227 * deps: range-parser@~1.2.1228 * deps: send@0.17.1229 - Set stricter CSP header in redirect & error responses230 - deps: http-errors@~1.7.2231 - deps: mime@1.6.0232 - deps: ms@2.1.1233 - deps: range-parser@~1.2.1234 - deps: statuses@~1.5.0235 - perf: remove redundant `path.normalize` call236 * deps: serve-static@1.14.1237 - Set stricter CSP header in redirect response238 - deps: parseurl@~1.3.3239 - deps: send@0.17.1240 * deps: setprototypeof@1.1.1241 * deps: statuses@~1.5.0242 - Add `103 Early Hints`243 * deps: type-is@~1.6.18244 - deps: mime-types@~2.1.24245 - perf: prevent internal `throw` on invalid type246 2474.16.4 / 2018-10-10248===================249 250 * Fix issue where `"Request aborted"` may be logged in `res.sendfile`251 * Fix JSDoc for `Router` constructor252 * deps: body-parser@1.18.3253 - Fix deprecation warnings on Node.js 10+254 - Fix stack trace for strict json parse error255 - deps: depd@~1.1.2256 - deps: http-errors@~1.6.3257 - deps: iconv-lite@0.4.23258 - deps: qs@6.5.2259 - deps: raw-body@2.3.3260 - deps: type-is@~1.6.16261 * deps: proxy-addr@~2.0.4262 - deps: ipaddr.js@1.8.0263 * deps: qs@6.5.2264 * deps: safe-buffer@5.1.2265 2664.16.3 / 2018-03-12267===================268 269 * deps: accepts@~1.3.5270 - deps: mime-types@~2.1.18271 * deps: depd@~1.1.2272 - perf: remove argument reassignment273 * deps: encodeurl@~1.0.2274 - Fix encoding `%` as last character275 * deps: finalhandler@1.1.1276 - Fix 404 output for bad / missing pathnames277 - deps: encodeurl@~1.0.2278 - deps: statuses@~1.4.0279 * deps: proxy-addr@~2.0.3280 - deps: ipaddr.js@1.6.0281 * deps: send@0.16.2282 - Fix incorrect end tag in default error & redirects283 - deps: depd@~1.1.2284 - deps: encodeurl@~1.0.2285 - deps: statuses@~1.4.0286 * deps: serve-static@1.13.2287 - Fix incorrect end tag in redirects288 - deps: encodeurl@~1.0.2289 - deps: send@0.16.2290 * deps: statuses@~1.4.0291 * deps: type-is@~1.6.16292 - deps: mime-types@~2.1.18293 2944.16.2 / 2017-10-09295===================296 297 * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set298 * perf: skip parsing of entire `X-Forwarded-Proto` header299 3004.16.1 / 2017-09-29301===================302 303 * deps: send@0.16.1304 * deps: serve-static@1.13.1305 - Fix regression when `root` is incorrectly set to a file306 - deps: send@0.16.1307 3084.16.0 / 2017-09-28309===================310 311 * Add `"json escape"` setting for `res.json` and `res.jsonp`312 * Add `express.json` and `express.urlencoded` to parse bodies313 * Add `options` argument to `res.download`314 * Improve error message when autoloading invalid view engine315 * Improve error messages when non-function provided as middleware316 * Skip `Buffer` encoding when not generating ETag for small response317 * Use `safe-buffer` for improved Buffer API318 * deps: accepts@~1.3.4319 - deps: mime-types@~2.1.16320 * deps: content-type@~1.0.4321 - perf: remove argument reassignment322 - perf: skip parameter parsing when no parameters323 * deps: etag@~1.8.1324 - perf: replace regular expression with substring325 * deps: finalhandler@1.1.0326 - Use `res.headersSent` when available327 * deps: parseurl@~1.3.2328 - perf: reduce overhead for full URLs329 - perf: unroll the "fast-path" `RegExp`330 * deps: proxy-addr@~2.0.2331 - Fix trimming leading / trailing OWS in `X-Forwarded-For`332 - deps: forwarded@~0.1.2333 - deps: ipaddr.js@1.5.2334 - perf: reduce overhead when no `X-Forwarded-For` header335 * deps: qs@6.5.1336 - Fix parsing & compacting very deep objects337 * deps: send@0.16.0338 - Add 70 new types for file extensions339 - Add `immutable` option340 - Fix missing `</html>` in default error & redirects341 - Set charset as "UTF-8" for .js and .json342 - Use instance methods on steam to check for listeners343 - deps: mime@1.4.1344 - perf: improve path validation speed345 * deps: serve-static@1.13.0346 - Add 70 new types for file extensions347 - Add `immutable` option348 - Set charset as "UTF-8" for .js and .json349 - deps: send@0.16.0350 * deps: setprototypeof@1.1.0351 * deps: utils-merge@1.0.1352 * deps: vary@~1.1.2353 - perf: improve header token parsing speed354 * perf: re-use options object when generating ETags355 * perf: remove dead `.charset` set in `res.jsonp`356 3574.15.5 / 2017-09-24358===================359 360 * deps: debug@2.6.9361 * deps: finalhandler@~1.0.6362 - deps: debug@2.6.9363 - deps: parseurl@~1.3.2364 * deps: fresh@0.5.2365 - Fix handling of modified headers with invalid dates366 - perf: improve ETag match loop367 - perf: improve `If-None-Match` token parsing368 * deps: send@0.15.6369 - Fix handling of modified headers with invalid dates370 - deps: debug@2.6.9371 - deps: etag@~1.8.1372 - deps: fresh@0.5.2373 - perf: improve `If-Match` token parsing374 * deps: serve-static@1.12.6375 - deps: parseurl@~1.3.2376 - deps: send@0.15.6377 - perf: improve slash collapsing378 3794.15.4 / 2017-08-06380===================381 382 * deps: debug@2.6.8383 * deps: depd@~1.1.1384 - Remove unnecessary `Buffer` loading385 * deps: finalhandler@~1.0.4386 - deps: debug@2.6.8387 * deps: proxy-addr@~1.1.5388 - Fix array argument being altered389 - deps: ipaddr.js@1.4.0390 * deps: qs@6.5.0391 * deps: send@0.15.4392 - deps: debug@2.6.8393 - deps: depd@~1.1.1394 - deps: http-errors@~1.6.2395 * deps: serve-static@1.12.4396 - deps: send@0.15.4397 3984.15.3 / 2017-05-16399===================400 401 * Fix error when `res.set` cannot add charset to `Content-Type`402 * deps: debug@2.6.7403 - Fix `DEBUG_MAX_ARRAY_LENGTH`404 - deps: ms@2.0.0405 * deps: finalhandler@~1.0.3406 - Fix missing `</html>` in HTML document407 - deps: debug@2.6.7408 * deps: proxy-addr@~1.1.4409 - deps: ipaddr.js@1.3.0410 * deps: send@0.15.3411 - deps: debug@2.6.7412 - deps: ms@2.0.0413 * deps: serve-static@1.12.3414 - deps: send@0.15.3415 * deps: type-is@~1.6.15416 - deps: mime-types@~2.1.15417 * deps: vary@~1.1.1418 - perf: hoist regular expression419 4204.15.2 / 2017-03-06421===================422 423 * deps: qs@6.4.0424 - Fix regression parsing keys starting with `[`425 4264.15.1 / 2017-03-05427===================428 429 * deps: send@0.15.1430 - Fix issue when `Date.parse` does not return `NaN` on invalid date431 - Fix strict violation in broken environments432 * deps: serve-static@1.12.1433 - Fix issue when `Date.parse` does not return `NaN` on invalid date434 - deps: send@0.15.1435 4364.15.0 / 2017-03-01437===================438 439 * Add debug message when loading view engine440 * Add `next("router")` to exit from router441 * Fix case where `router.use` skipped requests routes did not442 * Remove usage of `res._headers` private field443 - Improves compatibility with Node.js 8 nightly444 * Skip routing when `req.url` is not set445 * Use `%o` in path debug to tell types apart446 * Use `Object.create` to setup request & response prototypes447 * Use `setprototypeof` module to replace `__proto__` setting448 * Use `statuses` instead of `http` module for status messages449 * deps: debug@2.6.1450 - Allow colors in workers451 - Deprecated `DEBUG_FD` environment variable set to `3` or higher452 - Fix error when running under React Native453 - Use same color for same namespace454 - deps: ms@0.7.2455 * deps: etag@~1.8.0456 - Use SHA1 instead of MD5 for ETag hashing457 - Works with FIPS 140-2 OpenSSL configuration458 * deps: finalhandler@~1.0.0459 - Fix exception when `err` cannot be converted to a string460 - Fully URL-encode the pathname in the 404461 - Only include the pathname in the 404 message462 - Send complete HTML document463 - Set `Content-Security-Policy: default-src 'self'` header464 - deps: debug@2.6.1465 * deps: fresh@0.5.0466 - Fix false detection of `no-cache` request directive467 - Fix incorrect result when `If-None-Match` has both `*` and ETags468 - Fix weak `ETag` matching to match spec469 - perf: delay reading header values until needed470 - perf: enable strict mode471 - perf: hoist regular expressions472 - perf: remove duplicate conditional473 - perf: remove unnecessary boolean coercions474 - perf: skip checking modified time if ETag check failed475 - perf: skip parsing `If-None-Match` when no `ETag` header476 - perf: use `Date.parse` instead of `new Date`477 * deps: qs@6.3.1478 - Fix array parsing from skipping empty values479 - Fix compacting nested arrays480 * deps: send@0.15.0481 - Fix false detection of `no-cache` request directive482 - Fix incorrect result when `If-None-Match` has both `*` and ETags483 - Fix weak `ETag` matching to match spec484 - Remove usage of `res._headers` private field485 - Support `If-Match` and `If-Unmodified-Since` headers486 - Use `res.getHeaderNames()` when available487 - Use `res.headersSent` when available488 - deps: debug@2.6.1489 - deps: etag@~1.8.0490 - deps: fresh@0.5.0491 - deps: http-errors@~1.6.1492 * deps: serve-static@1.12.0493 - Fix false detection of `no-cache` request directive494 - Fix incorrect result when `If-None-Match` has both `*` and ETags495 - Fix weak `ETag` matching to match spec496 - Remove usage of `res._headers` private field497 - Send complete HTML document in redirect response498 - Set default CSP header in redirect response499 - Support `If-Match` and `If-Unmodified-Since` headers500 - Use `res.getHeaderNames()` when available501 - Use `res.headersSent` when available502 - deps: send@0.15.0503 * perf: add fast match path for `*` route504 * perf: improve `req.ips` performance505 5064.14.1 / 2017-01-28507===================508 509 * deps: content-disposition@0.5.2510 * deps: finalhandler@0.5.1511 - Fix exception when `err.headers` is not an object512 - deps: statuses@~1.3.1513 - perf: hoist regular expressions514 - perf: remove duplicate validation path515 * deps: proxy-addr@~1.1.3516 - deps: ipaddr.js@1.2.0517 * deps: send@0.14.2518 - deps: http-errors@~1.5.1519 - deps: ms@0.7.2520 - deps: statuses@~1.3.1521 * deps: serve-static@~1.11.2522 - deps: send@0.14.2523 * deps: type-is@~1.6.14524 - deps: mime-types@~2.1.13525 5264.14.0 / 2016-06-16527===================528 529 * Add `acceptRanges` option to `res.sendFile`/`res.sendfile`530 * Add `cacheControl` option to `res.sendFile`/`res.sendfile`531 * Add `options` argument to `req.range`532 - Includes the `combine` option533 * Encode URL in `res.location`/`res.redirect` if not already encoded534 * Fix some redirect handling in `res.sendFile`/`res.sendfile`535 * Fix Windows absolute path check using forward slashes536 * Improve error with invalid arguments to `req.get()`537 * Improve performance for `res.json`/`res.jsonp` in most cases538 * Improve `Range` header handling in `res.sendFile`/`res.sendfile`539 * deps: accepts@~1.3.3540 - Fix including type extensions in parameters in `Accept` parsing541 - Fix parsing `Accept` parameters with quoted equals542 - Fix parsing `Accept` parameters with quoted semicolons543 - Many performance improvements544 - deps: mime-types@~2.1.11545 - deps: negotiator@0.6.1546 * deps: content-type@~1.0.2547 - perf: enable strict mode548 * deps: cookie@0.3.1549 - Add `sameSite` option550 - Fix cookie `Max-Age` to never be a floating point number551 - Improve error message when `encode` is not a function552 - Improve error message when `expires` is not a `Date`553 - Throw better error for invalid argument to parse554 - Throw on invalid values provided to `serialize`555 - perf: enable strict mode556 - perf: hoist regular expression557 - perf: use for loop in parse558 - perf: use string concatenation for serialization559 * deps: finalhandler@0.5.0560 - Change invalid or non-numeric status code to 500561 - Overwrite status message to match set status code562 - Prefer `err.statusCode` if `err.status` is invalid563 - Set response headers from `err.headers` object564 - Use `statuses` instead of `http` module for status messages565 * deps: proxy-addr@~1.1.2566 - Fix accepting various invalid netmasks567 - Fix IPv6-mapped IPv4 validation edge cases568 - IPv4 netmasks must be contiguous569 - IPv6 addresses cannot be used as a netmask570 - deps: ipaddr.js@1.1.1571 * deps: qs@6.2.0572 - Add `decoder` option in `parse` function573 * deps: range-parser@~1.2.0574 - Add `combine` option to combine overlapping ranges575 - Fix incorrectly returning -1 when there is at least one valid range576 - perf: remove internal function577 * deps: send@0.14.1578 - Add `acceptRanges` option579 - Add `cacheControl` option580 - Attempt to combine multiple ranges into single range581 - Correctly inherit from `Stream` class582 - Fix `Content-Range` header in 416 responses when using `start`/`end` options583 - Fix `Content-Range` header missing from default 416 responses584 - Fix redirect error when `path` contains raw non-URL characters585 - Fix redirect when `path` starts with multiple forward slashes586 - Ignore non-byte `Range` headers587 - deps: http-errors@~1.5.0588 - deps: range-parser@~1.2.0589 - deps: statuses@~1.3.0590 - perf: remove argument reassignment591 * deps: serve-static@~1.11.1592 - Add `acceptRanges` option593 - Add `cacheControl` option594 - Attempt to combine multiple ranges into single range595 - Fix redirect error when `req.url` contains raw non-URL characters596 - Ignore non-byte `Range` headers597 - Use status code 301 for redirects598 - deps: send@0.14.1599 * deps: type-is@~1.6.13600 - Fix type error when given invalid type to match against601 - deps: mime-types@~2.1.11602 * deps: vary@~1.1.0603 - Only accept valid field names in the `field` argument604 * perf: use strict equality when possible605 6064.13.4 / 2016-01-21607===================608 609 * deps: content-disposition@0.5.1610 - perf: enable strict mode611 * deps: cookie@0.1.5612 - Throw on invalid values provided to `serialize`613 * deps: depd@~1.1.0614 - Support web browser loading615 - perf: enable strict mode616 * deps: escape-html@~1.0.3617 - perf: enable strict mode618 - perf: optimize string replacement619 - perf: use faster string coercion620 * deps: finalhandler@0.4.1621 - deps: escape-html@~1.0.3622 * deps: merge-descriptors@1.0.1623 - perf: enable strict mode624 * deps: methods@~1.1.2625 - perf: enable strict mode626 * deps: parseurl@~1.3.1627 - perf: enable strict mode628 * deps: proxy-addr@~1.0.10629 - deps: ipaddr.js@1.0.5630 - perf: enable strict mode631 * deps: range-parser@~1.0.3632 - perf: enable strict mode633 * deps: send@0.13.1634 - deps: depd@~1.1.0635 - deps: destroy@~1.0.4636 - deps: escape-html@~1.0.3637 - deps: range-parser@~1.0.3638 * deps: serve-static@~1.10.2639 - deps: escape-html@~1.0.3640 - deps: parseurl@~1.3.0641 - deps: send@0.13.1642 6434.13.3 / 2015-08-02644===================645 646 * Fix infinite loop condition using `mergeParams: true`647 * Fix inner numeric indices incorrectly altering parent `req.params`648 6494.13.2 / 2015-07-31650===================651 652 * deps: accepts@~1.2.12653 - deps: mime-types@~2.1.4654 * deps: array-flatten@1.1.1655 - perf: enable strict mode656 * deps: path-to-regexp@0.1.7657 - Fix regression with escaped round brackets and matching groups658 * deps: type-is@~1.6.6659 - deps: mime-types@~2.1.4660 6614.13.1 / 2015-07-05662===================663 664 * deps: accepts@~1.2.10665 - deps: mime-types@~2.1.2666 * deps: qs@4.0.0667 - Fix dropping parameters like `hasOwnProperty`668 - Fix various parsing edge cases669 * deps: type-is@~1.6.4670 - deps: mime-types@~2.1.2671 - perf: enable strict mode672 - perf: remove argument reassignment673 6744.13.0 / 2015-06-20675===================676 677 * Add settings to debug output678 * Fix `res.format` error when only `default` provided679 * Fix issue where `next('route')` in `app.param` would incorrectly skip values680 * Fix hiding platform issues with `decodeURIComponent`681 - Only `URIError`s are a 400682 * Fix using `*` before params in routes683 * Fix using capture groups before params in routes684 * Simplify `res.cookie` to call `res.append`685 * Use `array-flatten` module for flattening arrays686 * deps: accepts@~1.2.9687 - deps: mime-types@~2.1.1688 - perf: avoid argument reassignment & argument slice689 - perf: avoid negotiator recursive construction690 - perf: enable strict mode691 - perf: remove unnecessary bitwise operator692 * deps: cookie@0.1.3693 - perf: deduce the scope of try-catch deopt694 - perf: remove argument reassignments695 * deps: escape-html@1.0.2696 * deps: etag@~1.7.0697 - Always include entity length in ETags for hash length extensions698 - Generate non-Stats ETags using MD5 only (no longer CRC32)699 - Improve stat performance by removing hashing700 - Improve support for JXcore701 - Remove base64 padding in ETags to shorten702 - Support "fake" stats objects in environments without fs703 - Use MD5 instead of MD4 in weak ETags over 1KB704 * deps: finalhandler@0.4.0705 - Fix a false-positive when unpiping in Node.js 0.8706 - Support `statusCode` property on `Error` objects707 - Use `unpipe` module for unpiping requests708 - deps: escape-html@1.0.2709 - deps: on-finished@~2.3.0710 - perf: enable strict mode711 - perf: remove argument reassignment712 * deps: fresh@0.3.0713 - Add weak `ETag` matching support714 * deps: on-finished@~2.3.0715 - Add defined behavior for HTTP `CONNECT` requests716 - Add defined behavior for HTTP `Upgrade` requests717 - deps: ee-first@1.1.1718 * deps: path-to-regexp@0.1.6719 * deps: send@0.13.0720 - Allow Node.js HTTP server to set `Date` response header721 - Fix incorrectly removing `Content-Location` on 304 response722 - Improve the default redirect response headers723 - Send appropriate headers on default error response724 - Use `http-errors` for standard emitted errors725 - Use `statuses` instead of `http` module for status messages726 - deps: escape-html@1.0.2727 - deps: etag@~1.7.0728 - deps: fresh@0.3.0729 - deps: on-finished@~2.3.0730 - perf: enable strict mode731 - perf: remove unnecessary array allocations732 * deps: serve-static@~1.10.0733 - Add `fallthrough` option734 - Fix reading options from options prototype735 - Improve the default redirect response headers736 - Malformed URLs now `next()` instead of 400737 - deps: escape-html@1.0.2738 - deps: send@0.13.0739 - perf: enable strict mode740 - perf: remove argument reassignment741 * deps: type-is@~1.6.3742 - deps: mime-types@~2.1.1743 - perf: reduce try block size744 - perf: remove bitwise operations745 * perf: enable strict mode746 * perf: isolate `app.render` try block747 * perf: remove argument reassignments in application748 * perf: remove argument reassignments in request prototype749 * perf: remove argument reassignments in response prototype750 * perf: remove argument reassignments in routing751 * perf: remove argument reassignments in `View`752 * perf: skip attempting to decode zero length string753 * perf: use saved reference to `http.STATUS_CODES`754 7554.12.4 / 2015-05-17756===================757 758 * deps: accepts@~1.2.7759 - deps: mime-types@~2.0.11760 - deps: negotiator@0.5.3761 * deps: debug@~2.2.0762 - deps: ms@0.7.1763 * deps: depd@~1.0.1764 * deps: etag@~1.6.0765 - Improve support for JXcore766 - Support "fake" stats objects in environments without `fs`767 * deps: finalhandler@0.3.6768 - deps: debug@~2.2.0769 - deps: on-finished@~2.2.1770 * deps: on-finished@~2.2.1771 - Fix `isFinished(req)` when data buffered772 * deps: proxy-addr@~1.0.8773 - deps: ipaddr.js@1.0.1774 * deps: qs@2.4.2775 - Fix allowing parameters like `constructor`776 * deps: send@0.12.3777 - deps: debug@~2.2.0778 - deps: depd@~1.0.1779 - deps: etag@~1.6.0780 - deps: ms@0.7.1781 - deps: on-finished@~2.2.1782 * deps: serve-static@~1.9.3783 - deps: send@0.12.3784 * deps: type-is@~1.6.2785 - deps: mime-types@~2.0.11786 7874.12.3 / 2015-03-17788===================789 790 * deps: accepts@~1.2.5791 - deps: mime-types@~2.0.10792 * deps: debug@~2.1.3793 - Fix high intensity foreground color for bold794 - deps: ms@0.7.0795 * deps: finalhandler@0.3.4796 - deps: debug@~2.1.3797 * deps: proxy-addr@~1.0.7798 - deps: ipaddr.js@0.1.9799 * deps: qs@2.4.1800 - Fix error when parameter `hasOwnProperty` is present801 * deps: send@0.12.2802 - Throw errors early for invalid `extensions` or `index` options803 - deps: debug@~2.1.3804 * deps: serve-static@~1.9.2805 - deps: send@0.12.2806 * deps: type-is@~1.6.1807 - deps: mime-types@~2.0.10808 8094.12.2 / 2015-03-02810===================811 812 * Fix regression where `"Request aborted"` is logged using `res.sendFile`813 8144.12.1 / 2015-03-01815===================816 817 * Fix constructing application with non-configurable prototype properties818 * Fix `ECONNRESET` errors from `res.sendFile` usage819 * Fix `req.host` when using "trust proxy" hops count820 * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count821 * Fix wrong `code` on aborted connections from `res.sendFile`822 * deps: merge-descriptors@1.0.0823 8244.12.0 / 2015-02-23825===================826 827 * Fix `"trust proxy"` setting to inherit when app is mounted828 * Generate `ETag`s for all request responses829 - No longer restricted to only responses for `GET` and `HEAD` requests830 * Use `content-type` to parse `Content-Type` headers831 * deps: accepts@~1.2.4832 - Fix preference sorting to be stable for long acceptable lists833 - deps: mime-types@~2.0.9834 - deps: negotiator@0.5.1835 * deps: cookie-signature@1.0.6836 * deps: send@0.12.1837 - Always read the stat size from the file838 - Fix mutating passed-in `options`839 - deps: mime@1.3.4840 * deps: serve-static@~1.9.1841 - deps: send@0.12.1842 * deps: type-is@~1.6.0843 - fix argument reassignment844 - fix false-positives in `hasBody` `Transfer-Encoding` check845 - support wildcard for both type and subtype (`*/*`)846 - deps: mime-types@~2.0.9847 8484.11.2 / 2015-02-01849===================850 851 * Fix `res.redirect` double-calling `res.end` for `HEAD` requests852 * deps: accepts@~1.2.3853 - deps: mime-types@~2.0.8854 * deps: proxy-addr@~1.0.6855 - deps: ipaddr.js@0.1.8856 * deps: type-is@~1.5.6857 - deps: mime-types@~2.0.8858 8594.11.1 / 2015-01-20860===================861 862 * deps: send@0.11.1863 - Fix root path disclosure864 * deps: serve-static@~1.8.1865 - Fix redirect loop in Node.js 0.11.14866 - Fix root path disclosure867 - deps: send@0.11.1868 8694.11.0 / 2015-01-13870===================871 872 * Add `res.append(field, val)` to append headers873 * Deprecate leading `:` in `name` for `app.param(name, fn)`874 * Deprecate `req.param()` -- use `req.params`, `req.body`, or `req.query` instead875 * Deprecate `app.param(fn)`876 * Fix `OPTIONS` responses to include the `HEAD` method properly877 * Fix `res.sendFile` not always detecting aborted connection878 * Match routes iteratively to prevent stack overflows879 * deps: accepts@~1.2.2880 - deps: mime-types@~2.0.7881 - deps: negotiator@0.5.0882 * deps: send@0.11.0883 - deps: debug@~2.1.1884 - deps: etag@~1.5.1885 - deps: ms@0.7.0886 - deps: on-finished@~2.2.0887 * deps: serve-static@~1.8.0888 - deps: send@0.11.0889 8904.10.8 / 2015-01-13891===================892 893 * Fix crash from error within `OPTIONS` response handler894 * deps: proxy-addr@~1.0.5895 - deps: ipaddr.js@0.1.6896 8974.10.7 / 2015-01-04898===================899 900 * Fix `Allow` header for `OPTIONS` to not contain duplicate methods901 * Fix incorrect "Request aborted" for `res.sendFile` when `HEAD` or 304902 * deps: debug@~2.1.1903 * deps: finalhandler@0.3.3904 - deps: debug@~2.1.1905 - deps: on-finished@~2.2.0906 * deps: methods@~1.1.1907 * deps: on-finished@~2.2.0908 * deps: serve-static@~1.7.2909 - Fix potential open redirect when mounted at root910 * deps: type-is@~1.5.5911 - deps: mime-types@~2.0.7912 9134.10.6 / 2014-12-12914===================915 916 * Fix exception in `req.fresh`/`req.stale` without response headers917 9184.10.5 / 2014-12-10919===================920 921 * Fix `res.send` double-calling `res.end` for `HEAD` requests922 * deps: accepts@~1.1.4923 - deps: mime-types@~2.0.4924 * deps: type-is@~1.5.4925 - deps: mime-types@~2.0.4926 9274.10.4 / 2014-11-24928===================929 930 * Fix `res.sendfile` logging standard write errors931 9324.10.3 / 2014-11-23933===================934 935 * Fix `res.sendFile` logging standard write errors936 * deps: etag@~1.5.1937 * deps: proxy-addr@~1.0.4938 - deps: ipaddr.js@0.1.5939 * deps: qs@2.3.3940 - Fix `arrayLimit` behavior941 9424.10.2 / 2014-11-09943===================944 945 * Correctly invoke async router callback asynchronously946 * deps: accepts@~1.1.3947 - deps: mime-types@~2.0.3948 * deps: type-is@~1.5.3949 - deps: mime-types@~2.0.3950 9514.10.1 / 2014-10-28952===================953 954 * Fix handling of URLs containing `://` in the path955 * deps: qs@2.3.2956 - Fix parsing of mixed objects and values957 9584.10.0 / 2014-10-23959===================960 961 * Add support for `app.set('views', array)`962 - Views are looked up in sequence in array of directories963 * Fix `res.send(status)` to mention `res.sendStatus(status)`964 * Fix handling of invalid empty URLs965 * Use `content-disposition` module for `res.attachment`/`res.download`966 - Sends standards-compliant `Content-Disposition` header967 - Full Unicode support968 * Use `path.resolve` in view lookup969 * deps: debug@~2.1.0970 - Implement `DEBUG_FD` env variable support971 * deps: depd@~1.0.0972 * deps: etag@~1.5.0973 - Improve string performance974 - Slightly improve speed for weak ETags over 1KB975 * deps: finalhandler@0.3.2976 - Terminate in progress response only on error977 - Use `on-finished` to determine request status978 - deps: debug@~2.1.0979 - deps: on-finished@~2.1.1980 * deps: on-finished@~2.1.1981 - Fix handling of pipelined requests982 * deps: qs@2.3.0983 - Fix parsing of mixed implicit and explicit arrays984 * deps: send@0.10.1985 - deps: debug@~2.1.0986 - deps: depd@~1.0.0987 - deps: etag@~1.5.0988 - deps: on-finished@~2.1.1989 * deps: serve-static@~1.7.1990 - deps: send@0.10.1991 9924.9.8 / 2014-10-17993==================994 995 * Fix `res.redirect` body when redirect status specified996 * deps: accepts@~1.1.2997 - Fix error when media type has invalid parameter998 - deps: negotiator@0.4.9999 10004.9.7 / 2014-10-101001==================1002 1003 * Fix using same param name in array of paths1004 10054.9.6 / 2014-10-081006==================1007 1008 * deps: accepts@~1.1.11009 - deps: mime-types@~2.0.21010 - deps: negotiator@0.4.81011 * deps: serve-static@~1.6.41012 - Fix redirect loop when index file serving disabled1013 * deps: type-is@~1.5.21014 - deps: mime-types@~2.0.21015 10164.9.5 / 2014-09-241017==================1018 1019 * deps: etag@~1.4.01020 * deps: proxy-addr@~1.0.31021 - Use `forwarded` npm module1022 * deps: send@0.9.31023 - deps: etag@~1.4.01024 * deps: serve-static@~1.6.31025 - deps: send@0.9.31026 10274.9.4 / 2014-09-191028==================1029 1030 * deps: qs@2.2.41031 - Fix issue with object keys starting with numbers truncated1032 10334.9.3 / 2014-09-181034==================1035 1036 * deps: proxy-addr@~1.0.21037 - Fix a global leak when multiple subnets are trusted1038 - deps: ipaddr.js@0.1.31039 10404.9.2 / 2014-09-171041==================1042 1043 * Fix regression for empty string `path` in `app.use`1044 * Fix `router.use` to accept array of middleware without path1045 * Improve error message for bad `app.use` arguments1046 10474.9.1 / 2014-09-161048==================1049 1050 * Fix `app.use` to accept array of middleware without path1051 * deps: depd@0.4.51052 * deps: etag@~1.3.11053 * deps: send@0.9.21054 - deps: depd@0.4.51055 - deps: etag@~1.3.11056 - deps: range-parser@~1.0.21057 * deps: serve-static@~1.6.21058 - deps: send@0.9.21059 10604.9.0 / 2014-09-081061==================1062 1063 * Add `res.sendStatus`1064 * Invoke callback for sendfile when client aborts1065 - Applies to `res.sendFile`, `res.sendfile`, and `res.download`1066 - `err` will be populated with request aborted error1067 * Support IP address host in `req.subdomains`1068 * Use `etag` to generate `ETag` headers1069 * deps: accepts@~1.1.01070 - update `mime-types`1071 * deps: cookie-signature@1.0.51072 * deps: debug@~2.0.01073 * deps: finalhandler@0.2.01074 - Set `X-Content-Type-Options: nosniff` header1075 - deps: debug@~2.0.01076 * deps: fresh@0.2.41077 * deps: media-typer@0.3.01078 - Throw error when parameter format invalid on parse1079 * deps: qs@2.2.31080 - Fix issue where first empty value in array is discarded1081 * deps: range-parser@~1.0.21082 * deps: send@0.9.11083 - Add `lastModified` option1084 - Use `etag` to generate `ETag` header1085 - deps: debug@~2.0.01086 - deps: fresh@0.2.41087 * deps: serve-static@~1.6.11088 - Add `lastModified` option1089 - deps: send@0.9.11090 * deps: type-is@~1.5.11091 - fix `hasbody` to be true for `content-length: 0`1092 - deps: media-typer@0.3.01093 - deps: mime-types@~2.0.11094 * deps: vary@~1.0.01095 - Accept valid `Vary` header string as `field`1096 10974.8.8 / 2014-09-041098==================1099 1100 * deps: send@0.8.51101 - Fix a path traversal issue when using `root`1102 - Fix malicious path detection for empty string path1103 * deps: serve-static@~1.5.41104 - deps: send@0.8.51105 11064.8.7 / 2014-08-291107==================1108 1109 * deps: qs@2.2.21110 - Remove unnecessary cloning1111 11124.8.6 / 2014-08-271113==================1114 1115 * deps: qs@2.2.01116 - Array parsing fix1117 - Performance improvements1118 11194.8.5 / 2014-08-181120==================1121 1122 * deps: send@0.8.31123 - deps: destroy@1.0.31124 - deps: on-finished@2.1.01125 * deps: serve-static@~1.5.31126 - deps: send@0.8.31127 11284.8.4 / 2014-08-141129==================1130 1131 * deps: qs@1.2.21132 * deps: send@0.8.21133 - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`1134 * deps: serve-static@~1.5.21135 - deps: send@0.8.21136 11374.8.3 / 2014-08-101138==================1139 1140 * deps: parseurl@~1.3.01141 * deps: qs@1.2.11142 * deps: serve-static@~1.5.11143 - Fix parsing of weird `req.originalUrl` values1144 - deps: parseurl@~1.3.01145 - deps: utils-merge@1.0.01146 11474.8.2 / 2014-08-071148==================1149 1150 * deps: qs@1.2.01151 - Fix parsing array of objects1152 11534.8.1 / 2014-08-061154==================1155 1156 * fix incorrect deprecation warnings on `res.download`1157 * deps: qs@1.1.01158 - Accept urlencoded square brackets1159 - Accept empty values in implicit array notation1160 11614.8.0 / 2014-08-051162==================1163 1164 * add `res.sendFile`1165 - accepts a file system path instead of a URL1166 - requires an absolute path or `root` option specified1167 * deprecate `res.sendfile` -- use `res.sendFile` instead1168 * support mounted app as any argument to `app.use()`1169 * deps: qs@1.0.21170 - Complete rewrite1171 - Limits array length to 201172 - Limits object depth to 51173 - Limits parameters to 1,0001174 * deps: send@0.8.11175 - Add `extensions` option1176 * deps: serve-static@~1.5.01177 - Add `extensions` option1178 - deps: send@0.8.11179 11804.7.4 / 2014-08-041181==================1182 1183 * fix `res.sendfile` regression for serving directory index files1184 * deps: send@0.7.41185 - Fix incorrect 403 on Windows and Node.js 0.111186 - Fix serving index files without root dir1187 * deps: serve-static@~1.4.41188 - deps: send@0.7.41189 11904.7.3 / 2014-08-041191==================1192 1193 * deps: send@0.7.31194 - Fix incorrect 403 on Windows and Node.js 0.111195 * deps: serve-static@~1.4.31196 - Fix incorrect 403 on Windows and Node.js 0.111197 - deps: send@0.7.31198 11994.7.2 / 2014-07-271200==================