serve-static
2.2.1 · 15 Dec 2025MIT202.2M / weekRepositoryHomepagenpmAtom feed
Upgrading serve-static From 1.8.1 to 1.16.3
29 releases in betweenevery note read
Before you upgrade
Tick each one off as you go- breaking1.10.0
Security
Fixes 1 advisory affecting 1.8.1
- serve-static vulnerable to template injection that can lead to XSSlow · GHSA-cm22-4g7w-348p
Release by release
1.14.0 – 1.16.38 releases, nothing new or fixed in the notes
- fixed
Fix incorrect end tag in redirects
- fixed
- fixed
Fix regression when
rootis incorrectly set to a file
- fixed
1.11.2 – 1.13.09 releases, nothing new or fixed in the notes
- fixed
Fix redirect error when
req.urlcontains raw non-URL characters
- fixed
1.10.1 – 1.11.04 releases, nothing new or fixed in the notes
- breaking
Remove argument reassignment
- new
Add
fallthroughoption - new
Enable strict mode
- fixed
Fix reading options from options prototype
- breaking
1.9.0 – 1.9.34 releases, nothing new or fixed in the notes
6 other lines we could not sort, mostly version bumps
- 1.16.2
encodeurl@~2.0.0
- 1.16.0
Remove link renderization in html while redirecting (#173)
- 1.14.1
Set stricter CSP header in redirect response
- 1.12.0
Send complete HTML document in redirect response
- 1.11.0
Use status code 301 for redirects
- 1.10.0
Improve the default redirect response headers
26 internal lines (docs, tests, tooling) left out.