Packages

serve-static

2.2.1 · 15 Dec 2025MIT202.2M / weekRepositoryHomepagenpmAtom feed

Upgrading serve-static From 1.7.1 to 2.2.1

36 releases in betweennotes for 35

Other targets from 1.7.1Newest 1.x1.16.3Clears its 2 advisories1.16.0
2.0.0 has no release note on GitHub or in the repository's changelog, so its breaking changes are missing from the counts below.
  1. 1.7.1yours
  2. 1.7.2security
  3. 6 releases
  4. 1.10.0breaking
  5. 24 releases
  6. 2.0.0major
  7. 2 releases
  8. 2.2.1target
1+
change to make
2
advisories fixed
3+
new
5+
fixes

Counted from 35 of 36 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking1.10.0

Security

Fixes 2 advisories affecting 1.7.1

  • Fix potential open redirect when mounted at root

    1.7.2

Release by release

  1. 2.2.1

    15 Dec 20251 new
    • new

      Remove HISTORY.md from tarball content

  2. 1.14.0 – 2.2.011 releases, nothing new or fixed; 1 without a note

  3. 1.13.2

    7 Feb 20181 fix
    • fixed

      Fix incorrect end tag in redirects

  4. 1.13.1

    29 Sep 20171 fix
    • fixed

      Fix regression when root is incorrectly set to a file

  5. 1.11.2 – 1.13.09 releases, nothing new or fixed in the notes

  6. 1.11.1

    11 Jun 20161 fix
    • fixed

      Fix redirect error when req.url contains raw non-URL characters

  7. 1.10.1 – 1.11.04 releases, nothing new or fixed in the notes

  8. 1.10.0

    Migration needed18 Jun 20152 new · 1 fix
    • breaking

      Remove argument reassignment

    • new

      Add fallthrough option

    • new

      Enable strict mode

    • fixed

      Fix reading options from options prototype

13 other lines we could not sort, mostly version bumps

  • Refactor HISTORY.md header update to use String.prototype.repeat

    2.2.0

  • Conditionally set headers (if not already set) in redirect response

    2.2.0

  • Revert "feat: conditionally set headers (if not already set) in redirect response (#190)"

    2.2.0

  • Release 2.2.0

    2.2.0

  • Remove link renderization in html while redirecting (#173)

    2.1.0

  • Update dev deps

    2.1.0

  • Update prod deps for v2

    2.1.0

  • Release 2.0

    2.1.0

  • encodeurl@~2.0.0

    1.16.2

  • Set stricter CSP header in redirect response

    1.14.1

60 internal lines (docs, tests, tooling) left out.