serve-static
2.2.1 · 15 Dec 2025MIT202.2M / weekRepositoryHomepagenpmAtom feed
Upgrading serve-static From 1.9.3 to 1.10.0
1 release in betweenevery note read
- 1
- change to make
- 0
- advisories fixed
- 2
- new
- 1
- fix
Before you upgrade
Tick each one off as you go- breaking1.10.0
Security
1 advisory still affects 1.10.0
- serve-static vulnerable to template injection that can lead to XSSlow · GHSA-cm22-4g7w-348p
Upgrading to 1.16.0 clears it.
Release by release
- breaking
Remove argument reassignment
- new
Add
fallthroughoption - new
Enable strict mode
- fixed
Fix reading options from options prototype
- breaking
1 other line we could not sort, mostly version bumps
- 1.10.0
Improve the default redirect response headers
2 internal lines (docs, tests, tooling) left out.