4 * Set stricter CSP header in redirect response
6 - deps: range-parser@~1.2.1
11 * deps: parseurl@~1.3.3
13 - deps: http-errors@~1.7.2
16 - deps: statuses@~1.5.0
17 - perf: remove redundant `path.normalize` call
22 * Fix incorrect end tag in redirects
23 * deps: encodeurl@~1.0.2
24 - Fix encoding `%` as last character
27 - deps: encodeurl@~1.0.2
28 - deps: statuses@~1.4.0
33 * Fix regression when `root` is incorrectly set to a file
40 - Add 70 new types for file extensions
41 - Add `immutable` option
42 - Fix missing `</html>` in default error & redirects
43 - Set charset as "UTF-8" for .js and .json
44 - Use instance methods on steam to check for listeners
46 - perf: improve path validation speed
53 - perf: improve `If-Match` token parsing
54 * perf: improve slash collapsing
59 * deps: parseurl@~1.3.2
60 - perf: reduce overhead for full URLs
61 - perf: unroll the "fast-path" `RegExp`
63 - Fix handling of modified headers with invalid dates
73 - deps: http-errors@~1.6.2
91 - Fix issue when `Date.parse` does not return `NaN` on invalid date
92 - Fix strict violation in broken environments
97 * Send complete HTML document in redirect response
98 * Set default CSP header in redirect response
100 - Fix false detection of `no-cache` request directive
101 - Fix incorrect result when `If-None-Match` has both `*` and ETags
102 - Fix weak `ETag` matching to match spec
103 - Remove usage of `res._headers` private field
104 - Support `If-Match` and `If-Unmodified-Since` headers
105 - Use `res.getHeaderNames()` when available
106 - Use `res.headersSent` when available
110 - deps: http-errors@~1.6.1
116 - deps: http-errors@~1.5.1
118 - deps: statuses@~1.3.1
123 * Fix redirect error when `req.url` contains raw non-URL characters
129 * Use status code 301 for redirects
131 - Add `acceptRanges` option
132 - Add `cacheControl` option
133 - Attempt to combine multiple ranges into single range
134 - Correctly inherit from `Stream` class
135 - Fix `Content-Range` header in 416 responses when using `start`/`end` options
136 - Fix `Content-Range` header missing from default 416 responses
137 - Ignore non-byte `Range` headers
138 - deps: http-errors@~1.5.0
139 - deps: range-parser@~1.2.0
140 - deps: statuses@~1.3.0
141 - perf: remove argument reassignment
147 - Fix invalid `Content-Type` header when `send.mime.default_type` unset
152 * deps: parseurl@~1.3.1
153 - perf: enable strict mode
158 * deps: escape-html@~1.0.3
159 - perf: enable strict mode
160 - perf: optimize string replacement
161 - perf: use faster string coercion
164 - deps: destroy@~1.0.4
165 - deps: escape-html@~1.0.3
166 - deps: range-parser@~1.0.3
171 * Add `fallthrough` option
172 - Allows declaring this middleware is the final destination
173 - Provides better integration with Express patterns
174 * Fix reading options from options prototype
175 * Improve the default redirect response headers
176 * deps: escape-html@1.0.2
178 - Allow Node.js HTTP server to set `Date` response header
179 - Fix incorrectly removing `Content-Location` on 304 response
180 - Improve the default redirect response headers
181 - Send appropriate headers on default error response
182 - Use `http-errors` for standard emitted errors
183 - Use `statuses` instead of `http` module for status messages
184 - deps: escape-html@1.0.2
187 - deps: on-finished@~2.3.0
188 - perf: enable strict mode
189 - perf: remove unnecessary array allocations
190 * perf: enable strict mode
191 * perf: remove argument reassignment
201 - deps: on-finished@~2.2.1
207 - Throw errors early for invalid `extensions` or `index` options
214 - Fix regression sending zero-length files
220 - Always read the stat size from the file
221 - Fix mutating passed-in `options`
227 * Fix redirect loop in Node.js 0.11.14
229 - Fix root path disclosure
238 - deps: on-finished@~2.2.0
243 * Fix potential open redirect when mounted at root
249 - deps: on-finished@~2.1.1
262 * Fix potential open redirect when mounted at root
263 - Back-ported from v1.7.2
268 * Fix redirect loop when index file serving disabled
282 - deps: range-parser@~1.0.2
294 - Add `lastModified` option
295 - Use `etag` to generate `ETag` header
302 - Fix a path traversal issue when using `root`
303 - Fix malicious path detection for empty string path
314 - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`
319 * Fix parsing of weird `req.originalUrl` values
320 * deps: parseurl@~1.3.0
321 * deps: utils-merge@1.0.0
327 - Add `extensions` option
333 - Fix serving index files without root dir
339 - Fix incorrect 403 on Windows and Node.js 0.11
356 * deps: parseurl@~1.2.0
357 - Cache URLs based on original value
358 - Remove no-longer-needed URL mis-parse work-around
359 - Simplify the "fast-path" `RegExp`
361 - Add `dotfiles` option
369 - Cap `maxAge` value to 1 year
375 * deps: parseurl@~1.1.3
376 - faster parsing of href-only URLs
381 * Add `setHeaders` option
382 * Include HTML link in redirect response
384 - Accept string for `maxAge` (converted by `ms`)
390 - Do not throw un-catchable error on file open race condition
391 - Use `escape-html` for HTML escaping
393 - deps: finished@1.2.2
400 - fix "event emitter leak" warnings
402 - deps: finished@1.2.1
407 * use `escape-html` for escaping
409 - Send `max-age` in `Cache-Control` in correct format
415 - Calculate ETag with md5 for reduced collisions
416 - Fix wrong behavior when index file matches directory
417 - Ignore stream errors after request ends
418 - Skip directories in index file search
424 * Accept options directly to `send` module
430 * Resolve relative paths at middleware setup
431 * Use parseurl to parse the URL from request
436 * Do not rely on connect-like environments
446 * Add mime export for back-compat
451 * Genesis from `connect`