koa - npm Package Compare versions

Comparing version 2.16.3 to 2.16.4

lib/request.js

@@ -260,3 +260,13 @@
     if (!host) return '';
-    return splitCommaSeparatedValues(host, 1)[0];
+    host = splitCommaSeparatedValues(host, 1)[0];
+    // Host header may contain userinfo (e.g., "user@host") which is invalid per RFC 7230.
+    // Use URL parser to correctly extract the host portion.
+    if (host.includes('@')) {
+      try {
+        host = new URL(`http://${host}`).host;
+      } catch (e) {
+        return '';
+      }
+    }
+    return host;
   },
@@ -263,0 +273,0 @@

package.json

 {
   "name": "koa",
-  "version": "2.16.3",
+  "version": "2.16.4",
   "publishConfig": {
@@ -28,2 +28,9 @@ "access": "public",
   },
+  "scripts": {
+    "test": "jest --forceExit",
+    "lint": "eslint --ignore-path .gitignore .",
+    "authors": "git log --format='%aN <%aE>' | sort -u > AUTHORS",
+    "build": "gen-esm-wrapper . ./dist/koa.mjs",
+    "prepare": "npm run build"
+  },
   "repository": "koajs/koa",
@@ -86,9 +93,3 @@ "keywords": [
     "testEnvironment": "node"
-  },
-  "scripts": {
-    "test": "jest --forceExit",
-    "lint": "eslint --ignore-path .gitignore .",
-    "authors": "git log --format='%aN <%aE>' | sort -u > AUTHORS",
-    "build": "gen-esm-wrapper . ./dist/koa.mjs"
   }
-}
+}

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 4 instances in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 4 instances in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

62445

0.55%

Lines of code

1655

0.61%

No dependency changes