This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@tus/file-store@2.1.1

Patch Changes

• d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom getFileIdFromRequest.
• Updated dependencies [d2489f2]
  • @tus/utils@0.7.1

@tus/server@2.4.3

Patch Changes

• 7d6f382: Use the precomputed EXPOSED_HEADERS constant for the default Access-Control-Expose-Headers value instead of rebuilding it on every request.
• d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom getFileIdFromRequest.
• 42bc9da: Ensure PostHandler onUploadFinish hook headers override response defaults correctly.
• Updated dependencies [d2489f2]
  • @tus/utils@0.7.1

@tus/utils@0.7.1

Patch Changes

• d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom getFileIdFromRequest.