diff --git a/.changeset/lazy-animals-watch.md b/.changeset/lazy-animals-watch.md deleted file mode 100644 index 545e24af..00000000 --- a/.changeset/lazy-animals-watch.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@tus/server": patch ---- - -Use the precomputed `EXPOSED_HEADERS` constant for the default `Access-Control-Expose-Headers` value instead of rebuilding it on every request. diff --git a/.changeset/quiet-files-stay.md b/.changeset/quiet-files-stay.md deleted file mode 100644 index ef67fa37..00000000 --- a/.changeset/quiet-files-stay.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@tus/server": patch -"@tus/file-store": patch -"@tus/utils": patch ---- - -Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom `getFileIdFromRequest`. diff --git a/.changeset/wild-foxes-invite.md b/.changeset/wild-foxes-invite.md deleted file mode 100644 index 4663bc67..00000000 --- a/.changeset/wild-foxes-invite.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@tus/server": patch ---- - -Ensure `PostHandler` `onUploadFinish` hook headers override response defaults correctly. diff --git a/package-lock.json b/package-lock.json index 078a8e26..ccdf1a68 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6208,10 +6208,10 @@ }, "packages/file-store": { "name": "@tus/file-store", - "version": "2.1.0", + "version": "2.1.1", "license": "MIT", "dependencies": { - "@tus/utils": "^0.7.0", + "@tus/utils": "^0.7.1", "debug": "^4.3.4" }, "devDependencies": { @@ -6276,10 +6276,10 @@ }, "packages/server": { "name": "@tus/server", - "version": "2.4.2", + "version": "2.4.3", "license": "MIT", "dependencies": { - "@tus/utils": "^0.7.0", + "@tus/utils": "^0.7.1", "debug": "^4.3.4", "lodash.throttle": "^4.1.1", "set-cookie-parser": "^2.7.1", @@ -6309,7 +6309,7 @@ }, "packages/utils": { "name": "@tus/utils", - "version": "0.7.0", + "version": "0.7.1", "license": "MIT", "devDependencies": { "@types/debug": "^4.1.12", @@ -6325,10 +6325,10 @@ }, "test": { "dependencies": { - "@tus/file-store": "^2.1.0", + "@tus/file-store": "^2.1.1", "@tus/gcs-store": "^2.0.1", "@tus/s3-store": "^2.0.5", - "@tus/server": "^2.4.2" + "@tus/server": "^2.4.3" }, "devDependencies": { "@types/mocha": "^10.0.6", diff --git a/packages/file-store/CHANGELOG.md b/packages/file-store/CHANGELOG.md index 787c13ed..cfc6ef3c 100644 --- a/packages/file-store/CHANGELOG.md +++ b/packages/file-store/CHANGELOG.md @@ -1,5 +1,13 @@ # @tus/file-store +## 2.1.1 + +### Patch Changes + +- d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom `getFileIdFromRequest`. +- Updated dependencies [d2489f2] + - @tus/utils@0.7.1 + ## 2.1.0 ### Minor Changes diff --git a/packages/file-store/package.json b/packages/file-store/package.json index 5c1c731c..5294d8f7 100644 --- a/packages/file-store/package.json +++ b/packages/file-store/package.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/package.json", "name": "@tus/file-store", - "version": "2.1.0", + "version": "2.1.1", "description": "Local file storage for @tus/server", "main": "./dist/index.js", "exports": "./dist/index.js", @@ -21,7 +21,7 @@ "test": "mocha './dist/test/*.js' --exit" }, "dependencies": { - "@tus/utils": "^0.7.0", + "@tus/utils": "^0.7.1", "debug": "^4.3.4" }, "devDependencies": { diff --git a/packages/server/CHANGELOG.md b/packages/server/CHANGELOG.md index b0695d32..3a3aef7a 100644 --- a/packages/server/CHANGELOG.md +++ b/packages/server/CHANGELOG.md @@ -1,5 +1,15 @@ # @tus/server +## 2.4.3 + +### Patch Changes + +- 7d6f382: Use the precomputed `EXPOSED_HEADERS` constant for the default `Access-Control-Expose-Headers` value instead of rebuilding it on every request. +- d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom `getFileIdFromRequest`. +- 42bc9da: Ensure `PostHandler` `onUploadFinish` hook headers override response defaults correctly. +- Updated dependencies [d2489f2] + - @tus/utils@0.7.1 + ## 2.4.2 ### Patch Changes diff --git a/packages/server/package.json b/packages/server/package.json index 223fc981..6b54fdc1 100644 --- a/packages/server/package.json +++ b/packages/server/package.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/package.json", "name": "@tus/server", - "version": "2.4.2", + "version": "2.4.3", "description": "Tus resumable upload protocol in Node.js", "main": "./dist/index.js", "exports": "./dist/index.js", @@ -21,7 +21,7 @@ "test": "mocha './dist/test/*.js' --exit --timeout 30000" }, "dependencies": { - "@tus/utils": "^0.7.0", + "@tus/utils": "^0.7.1", "debug": "^4.3.4", "lodash.throttle": "^4.1.1", "set-cookie-parser": "^2.7.1", diff --git a/packages/utils/CHANGELOG.md b/packages/utils/CHANGELOG.md index 671fe6a4..94c2c9bf 100644 --- a/packages/utils/CHANGELOG.md +++ b/packages/utils/CHANGELOG.md @@ -1,5 +1,11 @@ # @tus/utils +## 0.7.1 + +### Patch Changes + +- d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom `getFileIdFromRequest`. + ## 0.7.0 ### Minor Changes diff --git a/packages/utils/package.json b/packages/utils/package.json index 12137aef..37521102 100644 --- a/packages/utils/package.json +++ b/packages/utils/package.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/package.json", "name": "@tus/utils", - "version": "0.7.0", + "version": "0.7.1", "description": "Internal utils for tus Node.js server and stores", "main": "./dist/index.js", "exports": "./dist/index.js", diff --git a/test/package.json b/test/package.json index a00d74db..bbaa57e1 100644 --- a/test/package.json +++ b/test/package.json @@ -11,10 +11,10 @@ "./stores.test": "./dist/stores.test.js" }, "dependencies": { - "@tus/file-store": "^2.1.0", + "@tus/file-store": "^2.1.1", "@tus/gcs-store": "^2.0.1", "@tus/s3-store": "^2.0.5", - "@tus/server": "^2.4.2" + "@tus/server": "^2.4.3" }, "devDependencies": { "@types/mocha": "^10.0.6",