[dependabot]

Bumps @adonisjs/http-server from 9.1.1 to 9.3.1.

Release notes

Sourced from @​adonisjs/http-server's releases.

Faster route matching and request/response fixes

This release adds an opt-in tree-based route matcher. Enable it with router.matcher: 'tree'. The linear matcher remains the default. The tree matcher preserves registration order unless you configure precedence: 'specificity'.

Our benchmarks used 1,000 registered routes. The full-stack HTTP cases matched the last registered route:

Workload	Before (req/s)	After (req/s)	Change	p50 before	p50 after
Dynamic route	38,249.6	75,385.6	+97.1%	29 ms	9 ms
Wildcard route	39,414.4	75,552.0	+91.7%	28 ms	9 ms

Each result is from five rounds, with a 3-second warmup, a 5-second measurement window, 100 connections, and a pipeline depth of 10.

Matcher-only benchmarks reported these speedups:

Scenario	Speedup
Dynamic route at the end	18×
Dynamic route miss	22.8×
Deep dynamic route	12.1×
Wildcard route at the end	18.4×
1,000 overlapping regex matchers	1.19×

These results cover specific workloads, not every route pattern. The PR notes that its full-stack static-route benchmark had not been rerun against the final implementation.

This release also fixes three request and response edge cases.

• Requests behind trusted proxies now use the first X-Forwarded-Host value.
• Redirects without an explicit query-string option follow the server configuration, while false disables forwarding.
• Sending a native Response preserves all its Set-Cookie headers and appends them to cookies already set on the response.

Open redirect fix and improved declarative redirects

This release fixes a medium-severity open redirect vulnerability in route-generated URLs and improves declarative redirects.

Security

Route parameters are now encoded as individual path segments when generating URLs.

Previously, applications passing untrusted input as the first dynamic route segment could generate a scheme-relative URL. When used with Response.redirect().toRoute(), this could redirect users to an attacker-controlled website.

Applications may be affected when request-derived data is passed to route URL builders such as Router.makeUrl() or Response.redirect().toRoute().

Users should upgrade to:

• @adonisjs/http-server@9.3.0 when using AdonisJS v7
• @adonisjs/http-server@8.2.3 when using AdonisJS v6

Full details are available in the GitHub Security Advisory.

Improvements

Declarative redirects can now forward the incoming request query string using the forwardQueryString option.

... (truncated)

Commits

• 3bf3cde chore(release): 9.3.1
• 40f7396 fix(response): preserve native response cookies (#139)
• 22736fd fix(response): honor explicit query string forwarding overrides (#142)
• 1035516 chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#130)
• 867e990 chore(deps): bump actions/stale from 10 to 11 (#133)
• 05bb590 chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#132)
• 4ed840b perf(router): replace matchit with a registration-ordered route table (#137)
• f75ce1a fix(request): use first forwarded host (#138)
• ee260b8 chore(release): 9.3.0
• ab607a2 fix(router): encode route parameters in generated URLs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.