chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates by dependabot[bot] · Pull Request #28 · SathiaAI/KnoTrack

dependabot · 2026-10-12T22:44:07Z

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package	From	To
fastify	`5.12.1`	`5.12.5`
brace-expansion	`1.1.18`	`1.1.21`
fast-uri	`3.1.6`	`3.1.8`
fast-uri	`4.1.3`	`4.2.2`
@vitest/mocker	`3.2.7`	`5.0.4`
hono	`4.13.3`	`4.13.13`
ip-address	`10.5.0`	`10.7.4`
js-yaml	`4.3.1`	`4.3.2`
qs	`6.15.3`	`6.16.0`

Updates fastify from 5.12.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

[Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in fastify/fastify#7019

[Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

Fix for GHSA-9q9j-q6p8-xq58

Fix for GHSA-hwr6-493r-vm6h

Fix for GHSA-p68q-wchp-6fh7

Fix for GHSA-667r-xxjv-c9mm

What's Changed

[Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in fastify/fastify#6973

[Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

ba235fd Bumped v5.12.5
ad06a4c Merge commit from fork
7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
1690e35 Bumped v5.12.4
1c991c4 Bumped v5.12.3
942a2be Bumped v5.12.2
853f6e2 test(validation): cover normalization and async branches
f02d8d4 fix(validation): do not unwrap async validator results
93c239a fix: reject malformed URLs before custom 404 handlers
Additional commits viewable in compare view

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
See full diff in compare view

Updates fast-uri from 3.1.6 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
See full diff in compare view

Updates fast-uri from 4.1.3 to 4.2.2

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
See full diff in compare view

Updates @vitest/mocker from 3.2.7 to 5.0.4

Release notes

Sourced from @vitest/mocker's releases.

v5.0.4

🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

Close the mock route interception race - by @cplieger and @sheremet-va in vitest-dev/vitest#8339 and vitest-dev/vitest#11083 (d6620)

Allow toHaveTextContent without arguments - by @nomadical in vitest-dev/vitest#11425 (8ebcf)

Apply API options without browser config - by @sheremet-va in vitest-dev/vitest#10852 (ad055)

Preserve undefined command arguments - by @sheremet-va and @AriPerkkio in vitest-dev/vitest#11497 (1576d)

Wait for setup mocks before importing a test file - by @kasperpeulen in vitest-dev/vitest#11520 (b61d1)

Avoid extra scroll outside the iframe - by @sheremet-va in vitest-dev/vitest#11523 (662e8)

Run browser instances as workers - by @sheremet-va in vitest-dev/vitest#11525 (bf04b)

Open one cdp session per tester - by @sheremet-va in vitest-dev/vitest#11542 (69e63)

Clean up unmocked and pending mocks - by @sheremet-va in vitest-dev/vitest#11537 (5c955)

coverage:

V8 browser memory leak between test files - by @AriPerkkio in vitest-dev/vitest#11466 (2297d)

allowExternal fails to include uncovered files - by @AriPerkkio in vitest-dev/vitest#11513 (4ef00)

Filenames containing brackets incorrectly showing as uncovered - by @AriPerkkio in vitest-dev/vitest#11531 (0fa80)

Istanbul coverage wrong when module transform warmups - by @AriPerkkio in vitest-dev/vitest#11529 (9f61d)

deps:

Update all non-major dependencies - by @sheremet-va in vitest-dev/vitest#11167 (c74e0)

expect:

Fix Map and Set deep equality in some assertions - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11402 (b4e79)

Check value in chai-style returned - by @sheremet-va in vitest-dev/vitest#11500 (1aca0)

mocker:

Fix native loader mocking edge cases - by @sheremet-va in vitest-dev/vitest#11540 (cd423)

pretty-format:

Support boxed symbols - by @lehni in vitest-dev/vitest#11445 and vitest-dev/vitest#11446 (eba44)

... (truncated)

Commits

6a11cf6 chore: release v5.0.4 (#11554)
58c86ed chore(deps): update all non-major dependencies (#11550)
5c95521 fix(browser): clean up unmocked and pending mocks (#11537)
cd423ba fix(mocker): fix native loader mocking edge cases (#11540)
36d19cb fix: wrap module mocks during in-source testing (#11505)
fe025b2 chore(deps): update dependency msw to v3 (#11482)
b0f2b3b fix: track project files and mocks with --changed (#11432)
33cadea chore: release v5.0.3 (#11409)
15cc006 fix: don't print an interceptor warning in browser mode (#11377)
1c3888b fix(browser): check mock path boundaries (fix #11361) (#11362)
Additional commits viewable in compare view

Updates hono from 4.13.3 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():
import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))
app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:
- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))
What's Changed

test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439

docs(request): fix jsdoc comments for some getters in honojs/hono#5445

fix(jsx): allow JSXNode function component results in honojs/hono#5476

feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485

test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486

fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475

fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487

fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391

chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits

08a023c 4.13.13
ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
f23b146 fix(jsx): allow JSXNode function component results (#5476)
6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
deff529 test(client): simulate network error for undefined route in parseResponse tes...
6abd35b 4.13.12
95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
Additional commits viewable in compare view

Updates ip-address from 10.5.0 to 10.7.4

Release notes

Sourced from ip-address's releases.

v10.7.4

Full Changelog: beaugunderson/ip-address@v10.7.3...v10.7.4

v10.7.3

What's Changed

Reject an in-addr.arpa name longer than 32 characters before splitting it by @beaugunderson in beaugunderson/ip-address#228

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

What's Changed

Accept an arpa suffix in any case and without the root dot in fromArpa by @beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

Bump js-yaml and brace-expansion in the lockfile by @beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

Commits

651c1dd 10.7.4
ec80fcd Find an IPv6 zone by index so a rejected zone costs one pass
e22eb4a Check generated docs without writing or hiding partial staging
c7f838e 10.7.3
09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
974b48d 10.7.2
4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
f0c25df 10.7.1
8b34a21 Merge commit from fork
13b6155 Merge commit from fork
Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
See full diff in compare view

Updates qs from 6.15.3 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

[New] stringify: add a depth option to bound recursion depth (default Infinity)

[Fix] stringify: serialize Date values when a filter is provided

[Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set

[Fix] parse: flatten a collection appended to an overflowed array (#571)

[Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer

[Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties

[Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)

[Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded

[Docs] clarify arrayLimit is a representation threshold, not an element-count cap

[Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit

[Tests] stringify: pin current encodeDotInKeys separator-dot behavior

[Dev Deps] update @ljharb/eslint-config, eslint

[Dev Deps] update eslint, evalmd

Commits

bb9379e v6.16.0
62fd254 [Fix] stringify: serialize Date values when a filter is provided
8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
d56f48c [Fix] parse: flatten a collection appended to an overflowed array
e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
9a76af2 [Dev Deps] update eslint, evalmd
3a890d4 [Dev Deps] update eslint, evalmd
b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [fastify](https://github.com/fastify/fastify) | `5.12.1` | `5.12.5` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.18` | `1.1.21` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.6` | `3.1.8` | | [fast-uri](https://github.com/fastify/fast-uri) | `4.1.3` | `4.2.2` | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `3.2.7` | `5.0.4` | | [hono](https://github.com/honojs/hono) | `4.13.3` | `4.13.13` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.5.0` | `10.7.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` | | [qs](https://github.com/ljharb/qs) | `6.15.3` | `6.16.0` | Updates `fastify` from 5.12.1 to 5.12.5 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.12.1...v5.12.5) Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21) Updates `fast-uri` from 3.1.6 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.6...v3.1.8) Updates `fast-uri` from 4.1.3 to 4.2.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.6...v3.1.8) Updates `@vitest/mocker` from 3.2.7 to 5.0.4 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.4/packages/mocker) Updates `hono` from 4.13.3 to 4.13.13 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.3...v4.13.13) Updates `ip-address` from 10.5.0 to 10.7.4 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.5.0...v10.7.4) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `qs` from 6.15.3 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.3...v6.16.0) --- updated-dependencies: - dependency-name: fastify dependency-version: 5.12.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 4.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 5.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.7.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-12T22:44:18Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 513ec749-a725-42cc-b3d8-6e515452f808

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates - #28

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates#28
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-10c45af094

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

coderabbitai Bot commented Oct 12, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 12, 2026

v5.12.5

⚠️ Security release

What's Changed

v5.12.4

v5.12.2

⚠️ Security release

What's Changed

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v5.0.4

🚀 Features

🐞 Bug Fixes

v4.13.13

Mount Middleware

What's Changed

v4.13.12

What's Changed

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

v10.7.4

v10.7.3

What's Changed

v10.7.2

What's Changed

v10.7.1

What's Changed

v10.7.0

What's Changed

v10.6.0

What's Changed

v10.5.1

4.3.2 - 2026-08-26

Changed

Security

6.16.0

Uh oh!

coderabbitai Bot commented Oct 12, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths