Important

• Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)

What's Changed

• chore: add funding to package.json by @bjohansebas in #248
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in #249
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #253
• build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by @dependabot[bot] in #252
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #251
• build(deps): bump actions/setup-node from 4.4.0 to 6.0.0 by @dependabot[bot] in #261
• build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by @dependabot[bot] in #260
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #259
• build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #258
• build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by @dependabot[bot] in #264
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #263
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.5 by @dependabot[bot] in #262
• chore: up node version to 25.x in CI by @imangas in #272
• doc(package): remove history.md and add readme.md to published files by @sheplu in #270
• Update link to CONTRIBUTING.md by @krzysdz in #281
• test: run CI on Windows and macOS by @kilisamemarisaaa in #283
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #257
• build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #268
• build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 by @dependabot[bot] in #265
• build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in #266
• build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #267
• chore(ci): npm-publish via reusable workflows by @sheplu in #269
• docs: update outdated Brotli note and fix npm install docs URL by @Vansh1811 in #276
• fix: match Cache-Control no-transform directive case-insensitively by @vaibhavmashal in #286
• 1.8.2 by @UlisesGascon in #287

New Contributors

• @imangas made their first contribution in #272
• @sheplu made their first contribution in #270
• @krzysdz made their first contribution in #281
• @kilisamemarisaaa made their first contribution in #283
• @Vansh1811 made their first contribution in #276
• @vaibhavmashal made their first contribution in #286

Full Changelog: v1.8.1...v1.8.2

What's Changed

• fix(docs): update multiple links from http to https by @Phillip9587 in #222
• ci: add dependabot for github actions by @bjohansebas in #207
• build(deps): bump github/codeql-action from 2.23.2 to 3.28.15 by @dependabot[bot] in #228
• build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.1 by @dependabot[bot] in #229
• build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 by @dependabot[bot] in #230
• build(deps-dev): bump supertest from 6.2.3 to 6.3.4 by @dependabot[bot] in #231
• [StepSecurity] ci: Harden GitHub Actions by @step-security-bot in #235
• build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 by @dependabot[bot] in #243
• build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 by @dependabot[bot] in #239
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #240
• build(deps): bump actions/checkout from 4.1.1 to 4.2.2 by @dependabot[bot] in #241
• build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by @dependabot[bot] in #244
• deps: [email protected] by @UlisesGascon in #246
• Release: 1.8.1 by @UlisesGascon in #247

New Contributors

• @dependabot[bot] made their first contribution in #228
• @step-security-bot made their first contribution in #235

Full Changelog: 1.8.0...v1.8.1

What's Changed

• Refactor chunkLength function for improved readability and consistency by @Ayoub-Mabrouk in #203
• Refactor toBuffer function to simplify buffer check logic by @Ayoub-Mabrouk in #201
• ci: add CodeQL (SAST) by @bjohansebas in #204
• Use headersSent instead of _header by @maritz in #129
• Bugfix/use write head instead of implicit header by @Icehunter in #170
• feat: add default option by @bjohansebas in #191
• ci: update ci workflow by @bjohansebas in #206
• feat: support for brotli by @bjohansebas in #194
• docs: improve readme by @bjohansebas in #209
• docs: keywords field by @bjohansebas in #210
• refactor: simplify encoding negotiation logic by @bjohansebas in #213

New Contributors

• @Ayoub-Mabrouk made their first contribution in #203
• @maritz made their first contribution in #129
• @Icehunter made their first contribution in #170

Full Changelog: 1.7.5...v1.8.0

What's Changed

• chore: add support for OSSF scorecard reporting by @inigomarquinez in #186
• ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in #187
• docs: fix spelling by @dijonkitchen in #174
• deps: [email protected] by @bjohansebas in #192
• remove --bail option by @bjohansebas in #196
• build: Node.js 23.0 by @bjohansebas in #193
• Replace accepts with negotiator by @blakeembrey in #197
• docs: update history by @bjohansebas in #200

New Contributors

• @inigomarquinez made their first contribution in #186
• @dijonkitchen made their first contribution in #174
• @bjohansebas made their first contribution in #192
• @blakeembrey made their first contribution in #197
• @UlisesGascon made their first contribution in #195

Full Changelog: 1.7.4...1.7.5

• deps: compressible@~2.0.16
  • Mark text/less as compressible
  • deps: mime-db@'>= 1.38.0 < 2'
• deps: on-headers@~1.0.2
  • Fix res.writeHead patch missing return value
• perf: prevent unnecessary buffer copy

• deps: accepts@~1.3.5
  • deps: mime-types@~2.1.18
• deps: compressible@~2.0.14
  • Mark all XML-derived types as compressible
  • deps: mime-db@'>= 1.34.0 < 2'
• deps: [email protected]

• deps: compressible@~2.0.13
  • deps: mime-db@'>= 1.33.0 < 2'

• deps: accepts@~1.3.4
  • deps: mime-types@~2.1.16
• deps: [email protected]
• deps: compressible@~2.0.11
  • deps: mime-db@'>= 1.29.0 < 2'
• deps: [email protected]
• deps: vary@~1.1.2
  • perf: improve header token parsing speed

• Use safe-buffer for improved Buffer API
• deps: [email protected]
• deps: compressible@~2.0.10
  • Fix regex fallback to not override compressible: false in db
  • deps: mime-db@'>= 1.27.0 < 2'
• deps: [email protected]
  • Allow colors in workers
  • Deprecated DEBUG_FD environment variable set to 3 or higher
  • Fix error when running under React Native
  • Fix DEBUG_MAX_ARRAY_LENGTH
  • Use same color for same namespace
  • deps: [email protected]
• deps: vary@~1.1.1
  • perf: hoist regular expression

• deps: accepts@~1.3.3
  • deps: mime-types@~2.1.11
  • deps: [email protected]
• deps: [email protected]
  • Drop partial bytes on all parsed units
  • Fix parsing byte string that looks like hex
  • perf: hoist regular expressions
• deps: compressible@~2.0.8
  • deps: mime-db@'>= 1.23.0 < 2'