[ci] release

packages/file-store/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @tus/file-store
 
+## 2.1.1
+
+### Patch Changes
+
+- d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom `getFileIdFromRequest`.
+- Updated dependencies [d2489f2]
+  - @tus/utils@0.7.1
+
 ## 2.1.0
 
 ### Minor Changes

packages/file-store/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@tus/file-store",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Local file storage for @tus/server",
   "main": "./dist/index.js",
   "exports": "./dist/index.js",
@@ -21,7 +21,7 @@
     "test": "mocha './dist/test/*.js' --exit"
   },
   "dependencies": {
-    "@tus/utils": "^0.7.0",
+    "@tus/utils": "^0.7.1",
     "debug": "^4.3.4"
   },
   "devDependencies": {

packages/server/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @tus/server
 
+## 2.4.3
+
+### Patch Changes
+
+- 7d6f382: Use the precomputed `EXPOSED_HEADERS` constant for the default `Access-Control-Expose-Headers` value instead of rebuilding it on every request.
+- d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom `getFileIdFromRequest`.
+- 42bc9da: Ensure `PostHandler` `onUploadFinish` hook headers override response defaults correctly.
+- Updated dependencies [d2489f2]
+  - @tus/utils@0.7.1
+
 ## 2.4.2
 
 ### Patch Changes

packages/server/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@tus/server",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "Tus resumable upload protocol in Node.js",
   "main": "./dist/index.js",
   "exports": "./dist/index.js",
@@ -21,7 +21,7 @@
     "test": "mocha './dist/test/*.js' --exit --timeout 30000"
   },
   "dependencies": {
-    "@tus/utils": "^0.7.0",
+    "@tus/utils": "^0.7.1",
     "debug": "^4.3.4",
     "lodash.throttle": "^4.1.1",
     "set-cookie-parser": "^2.7.1",

packages/utils/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @tus/utils
 
+## 0.7.1
+
+### Patch Changes
+
+- d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom `getFileIdFromRequest`.
+
 ## 0.7.0
 
 ### Minor Changes

packages/utils/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@tus/utils",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Internal utils for tus Node.js server and stores",
   "main": "./dist/index.js",
   "exports": "./dist/index.js",

test/package.json

@@ -11,10 +11,10 @@
     "./stores.test": "./dist/stores.test.js"
   },
   "dependencies": {
-    "@tus/file-store": "^2.1.0",
+    "@tus/file-store": "^2.1.1",
     "@tus/gcs-store": "^2.0.1",
     "@tus/s3-store": "^2.0.5",
-    "@tus/server": "^2.4.2"
+    "@tus/server": "^2.4.3"
   },
   "devDependencies": {
     "@types/mocha": "^10.0.6",