All pull requests

Pull requests

• docs: fix insecure regex origin examples and add warning for origin: true with credentials: true

  #431·vaibhavmashal opened Aug 30, 2026·

  ·
  2

  1

• Remove the object-assign dependency (native Object.assign with an ES5 fallback)

  #430·Martin-Luther opened Aug 3, 2026·

  ·

• fix: always set Vary: Origin in CORS middleware

  #429·ilovesugarr opened Aug 1, 2026·

  ·
  1

• docs: harden origin regex examples and warn on credentials

  #427·Errr0rr404 opened Jul 23, 2026·

  ·
  2

• fix: omit Vary for static origin

  #426·vibhor-aggr opened Jul 10, 2026·

  ·
  1

• docs: warn about dangerous origin:true + credentials:true combination

  #424·luisangelrod opened Jun 24, 2026·

  ·
  1

  1

• docs: warn against combining origin: true with credentials: true

  #423·AchieverSana opened Jun 24, 2026·

  ·
  1

  1

• docs: clarify CORS header behavior

  #421·vibhor-aggr opened Jun 11, 2026·

  ·
  1

• docs: replace ambiguous 'reflect' jargon in configuration options

  #420·Prawshant123-ui opened Jun 7, 2026·

  ·
  1

• build(deps-dev): bump express from 4.21.2 to 4.22.2

  dependenciesjavascript
  #419·dependabot[bot] opened Jun 2, 2026Bot·

  ·
  1

• build(deps): bump github/codeql-action from 4.32.4 to 4.36.1

  dependenciesgithub_actions
  #418·dependabot[bot] opened Jun 2, 2026Bot·

  ·

• build(deps): bump actions/checkout from 4.2.2 to 6.0.3

  dependenciesgithub_actions
  #417·dependabot[bot] opened Jun 2, 2026Bot·

  ·

• chore: drop object-assign

  #416·hyperz111 opened May 12, 2026·

  ·
  2

• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1

  dependenciesgithub_actions
  #415·dependabot[bot] opened May 1, 2026Bot·

  ·

• Fix: throw error when credentials=true with origin='*'

  #413·jiafeimao0p opened Apr 23, 2026·

  ·
  1

• docs: anchor regex origin examples to avoid lookalike matches (#408)

  #412·SAY-5 opened Apr 15, 2026·

  ·
  1

  1

• build: include bundled TypeScript declarations

  #407·jeanpierrecarvalho opened Mar 30, 2026·

  ·

• fix: do not set Vary: Origin for static string origin option

  #405·Vansh1811 opened Mar 30, 2026Contributor·

  ·
  1

  1

• chore(ci): replace deprecated set-output with GITHUB_OUTPUT

  #404·mahmoodhamdi opened Mar 29, 2026·

  ·

• fix: set Vary: Origin header when origin callback rejects

  #403·mahmoodhamdi opened Mar 29, 2026·

  ·
  1

• test: add integration tests for CORS with various origin configurations

  #402·mahmoodhamdi opened Mar 29, 2026·

  ·

• test: add coverage for origin callback edge cases

  #401·mahmoodhamdi opened Mar 29, 2026·

  ·

• Forbid wildcard (*) CORS headers when credentials are true

  #400·Vansh0204 opened Mar 17, 2026·

  ·

• AI QA Improvements: Tests + Verified Fixes

  #398·manis45001-ai opened Mar 5, 2026·

  ·
  2

• docs: tighten prose and clarify configuration options

  #387·jonchurch opened Jan 12, 2026Member·

  ·
  2