Bump koa from 2.14.1 to 3.0.1 #5028

dependabot · 2025-07-29T09:19:53Z

Bumps koa from 2.14.1 to 3.0.1.

Release notes

v3.0.1

What's Changed

fix(security): only allow same origin referer on response back koajs/koa@422c551

chore: adds initial doc text refresh; migration guide [CHORE-1870] by @yowainwright in koajs/koa#1877

build(deps-dev): bump formidable from 3.5.2 to 3.5.4 by @dependabot[bot] in koajs/koa#1878

chore: removes done callbacks in tests [CHORE-1870] by @yowainwright in koajs/koa#1875

build(deps-dev): bump supertest from 7.1.0 to 7.1.1 by @dependabot[bot] in koajs/koa#1879

build(deps): bump debug from 4.4.0 to 4.4.1 by @dependabot[bot] in koajs/koa#1880

feat: replace debug module with pure node:util::debuglog by @3imed-jaberi in koajs/koa#1885

feat: replace cache-content-type with mime-types directly by @3imed-jaberi in koajs/koa#1886

build(deps): bump statuses from 2.0.1 to 2.0.2 by @dependabot[bot] in koajs/koa#1888

build(deps-dev): bump supertest from 7.1.1 to 7.1.4 by @dependabot[bot] in koajs/koa#1895

build(deps-dev): bump form-data from 4.0.3 to 4.0.4 by @dependabot[bot] in koajs/koa#1894

Full Changelog: koajs/koa@v3.0.0...v3.0.1

v3.0.0

This is a major release.

Breaking

Minimum node v18

Removes .redirect('back'), adds .back(fallback_url) @fl0w koajs/koa#1115

For .redirect(), don't render redirect values in anchor ref koajs/koa@ff25eb4

req.origin should display the origin header if it exists, not the current hostname koajs/koa#1008. origin now aligns with the Origin header as used in CORS.

.body=<json> should not overwrite type if type already json koajs/koa#1120

Remove special ENOENT support koajs/koa#1861 - this is a big change and will require any file servers to adapt to this change for handling 404s / files not found

Removes generator deprecation messages. Generators are no longer supported. Koa no longer asserts if generators are used. Set content-length: 0 if body is explicitly set to null @ognjenjevremovic #1528 Remove obsolete createAsyncCtxStorageMiddleware koajs/koa#1817

ctx.throw now requires a format of ctx.throw(status, error, properties). See: https://www.npmjs.com/package/http-errors

New

Support custom streams @KristapsR koajs/koa#1825

Support WHATWG response bodies koajs/koa#1830 @kravorkid

Use asyncLocalStorage to get current context from app, e.g.: const ctx = app.currentContext.

Fixes

Handle responses when socket is no longer writable @titanism @azlond koajs/koa#1593

fix: Do not response Content-Length if Transfer-Encoding is defined #1562 @charlyzeng

fix: Set body to 'null' if ctx.type = 'json' and ctx.body = null #1059 @likegun

fix: can not get currentContext in error handler (#1758) (Gxkl <[email protected]>)

Fix exports.defaults in package.json koajs/koa#1630

Fix leaky handles in tests koajs/koa#1838

Fix body null checks koajs/koa#1814

Fix reformatting redirect URLs koajs/koa#1805 koajs/koa#1804

Fix passing ctx in error handler koajs/koa#1758

... (truncated)

Changelog

Sourced from koa's changelog.

[!IMPORTANT] Moving forwards we are using the GitHub releases page at https://github.com/koajs/koa/releases in combination with np for publishing releases and their changelogs.

3.0.0-alpha.3 / 2025-02-11

fixes

Avoid redos on host and protocol getter

3.0.0-alpha.2 / 2024-11-04

breaking changes

Update http-errors to v2.0.0 #1486

ctx.throw now requires a format of ctx.throw(status, error, properties). See: https://www.npmjs.com/package/http-errors

Remove res.redirect('back'), add back() method to ctx #1115

Replace node querystring with URLSearchParams #1828

Remove obsolete createAsyncCtxStorageMiddleware #1817

features

Add support for web WHATWG #1830

updates

Update cookies to ~0.9.1 #1846

Update statuses to ^2.0.1

Update supertest to ^7.0.0 #1841

fixes

Fix exports.defaults in package.json #1630

Fix leaky handles in tests #1838

Fix body null checks #1814

Fix reformatting redirect URLs #1805 #1804

Fix passing ctx in error handler #1758

migrations

Migrate from jest to the native node test runner #1845

3.0.0-alpha.1 / 2023-04-12

fixes

[e98b8d1] - fix: can not get currentContext in error handler (#1758) (Gxkl <[email protected]>)

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

... (truncated)

Commits

1ddb048 3.0.1
422c551 Merge commit from fork
6e51eb1 build(deps-dev): bump form-data from 4.0.3 to 4.0.4 (#1894)
d378e5c build(deps-dev): bump supertest from 7.1.1 to 7.1.4 (#1895)
cb22d8d build(deps): bump statuses from 2.0.1 to 2.0.2 (#1888)
0acad8f feat: replace cache-content-type with mime-types directly (#1886)
2f6e814 feat: replace debug module with pure node:util::debuglog (#1885)
8620ced build(deps): bump debug from 4.4.0 to 4.4.1 (#1880)
dec1ffc build(deps-dev): bump supertest from 7.1.0 to 7.1.1 (#1879)
9057541 chore: removes done callbacks in tests [CHORE-1870] (#1875)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

changeset-bot · 2025-07-29T09:19:57Z

⚠️ No Changeset found

Latest commit: 37a6b60

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2025-07-29T09:20:05Z

📊 Tachometer Benchmark Results

Summary

nop-update

this-change, tip-of-tree, previous-release: unsure 🔍 -7% - +5% (-0.96ms - +0.68ms)
^{this-change vs tip-of-tree}

render

this-change: 44.20ms - 45.07ms
this-change, tip-of-tree, previous-release: unsure 🔍 -5% - +4% (-0.99ms - +0.89ms)
^{this-change vs tip-of-tree}
this-change, tip-of-tree, previous-release: unsure 🔍 -2% - +3% (-0.64ms - +1.15ms)
^{this-change vs tip-of-tree}
this-change, tip-of-tree, previous-release: unsure 🔍 -19% - +38% (-9.25ms - +19.31ms)
^{this-change vs tip-of-tree}

update

this-change: 516.29ms - 522.41ms
this-change, tip-of-tree, previous-release: unsure 🔍 -4% - +6% (-1.94ms - +2.43ms)
^{this-change vs tip-of-tree}
this-change, tip-of-tree, previous-release: unsure 🔍 -1% - +3% (-0.92ms - +2.68ms)
^{this-change vs tip-of-tree}
this-change, tip-of-tree, previous-release: unsure 🔍 -1% - +2% (-2.95ms - +8.97ms)
^{this-change vs tip-of-tree}

update-reflect

this-change: 498.02ms - 504.15ms
this-change, tip-of-tree, previous-release: unsure 🔍 -0% - +2% (-1.88ms - +10.66ms)
^{this-change vs tip-of-tree}

Results

this-change

Browser: chrome-headless 139.0.0.0
Sample size: 50
Built by: Benchmarks #6869
Commit: 37a6b60

render

Version	Avg time	vs
	44.20ms - 45.07ms	-

update

Version	Avg time	vs
	516.29ms - 522.41ms	-

update-reflect

Version	Avg time	vs
	498.02ms - 504.15ms	-

this-change, tip-of-tree, previous-release

Browser: chrome-headless 139.0.0.0
Sample size: 30
Built by: Benchmarks #6869
Commit: 37a6b60

render

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	20.47ms - 21.87ms	-	unsure 🔍 -5% - +4% -0.99ms - +0.89ms	unsure 🔍 -3% - +6% -0.71ms - +1.25ms
tip-of-tree tip-of-tree	20.60ms - 21.85ms	unsure 🔍 -4% - +5% -0.89ms - +0.99ms	-	unsure 🔍 -3% - +6% -0.61ms - +1.25ms
previous-release previous-release	20.22ms - 21.59ms	unsure 🔍 -6% - +3% -1.25ms - +0.71ms	unsure 🔍 -6% - +3% -1.25ms - +0.61ms	-

update

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	42.57ms - 45.65ms	-	unsure 🔍 -4% - +6% -1.94ms - +2.43ms	unsure 🔍 -7% - +3% -3.05ms - +1.35ms
tip-of-tree tip-of-tree	42.32ms - 45.41ms	unsure 🔍 -5% - +4% -2.43ms - +1.94ms	-	unsure 🔍 -7% - +2% -3.30ms - +1.10ms
previous-release previous-release	43.39ms - 46.53ms	unsure 🔍 -3% - +7% -1.35ms - +3.05ms	unsure 🔍 -3% - +8% -1.10ms - +3.30ms	-

nop-update

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	12.35ms - 13.49ms	-	unsure 🔍 -7% - +5% -0.96ms - +0.68ms	unsure 🔍 -6% - +6% -0.79ms - +0.80ms
tip-of-tree tip-of-tree	12.48ms - 13.65ms	unsure 🔍 -5% - +7% -0.68ms - +0.96ms	-	unsure 🔍 -5% - +7% -0.66ms - +0.95ms
previous-release previous-release	12.37ms - 13.47ms	unsure 🔍 -6% - +6% -0.80ms - +0.79ms	unsure 🔍 -7% - +5% -0.95ms - +0.66ms	-

this-change, tip-of-tree, previous-release

Browser: chrome-headless 139.0.0.0
Sample size: 50
Built by: Benchmarks #6869
Commit: 37a6b60

render

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	39.13ms - 40.56ms	-	unsure 🔍 -2% - +3% -0.64ms - +1.15ms	unsure 🔍 -1% - +4% -0.45ms - +1.48ms
tip-of-tree tip-of-tree	39.06ms - 40.13ms	unsure 🔍 -3% - +2% -1.15ms - +0.64ms	-	unsure 🔍 -1% - +3% -0.58ms - +1.10ms
previous-release previous-release	38.69ms - 39.98ms	unsure 🔍 -4% - +1% -1.48ms - +0.45ms	unsure 🔍 -3% - +1% -1.10ms - +0.58ms	-

update

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	92.29ms - 94.55ms	-	unsure 🔍 -1% - +3% -0.92ms - +2.68ms	unsure 🔍 -2% - +2% -1.69ms - +2.03ms
tip-of-tree tip-of-tree	91.14ms - 93.94ms	unsure 🔍 -3% - +1% -2.68ms - +0.92ms	-	unsure 🔍 -3% - +1% -2.75ms - +1.32ms
previous-release previous-release	91.77ms - 94.73ms	unsure 🔍 -2% - +2% -2.03ms - +1.69ms	unsure 🔍 -1% - +3% -1.32ms - +2.75ms	-

this-change, tip-of-tree, previous-release

Browser: chrome-headless 139.0.0.0
Sample size: 50
Built by: Benchmarks #6869
Commit: 37a6b60

render

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	47.26ms - 68.07ms	-	unsure 🔍 -19% - +38% -9.25ms - +19.31ms	unsure 🔍 -16% - +42% -7.41ms - +20.69ms
tip-of-tree tip-of-tree	42.85ms - 62.41ms	unsure 🔍 -32% - +15% -19.31ms - +9.25ms	-	unsure 🔍 -24% - +30% -11.98ms - +15.20ms
previous-release previous-release	41.58ms - 60.46ms	unsure 🔍 -34% - +11% -20.69ms - +7.41ms	unsure 🔍 -28% - +22% -15.20ms - +11.98ms	-

update

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	523.98ms - 532.75ms	-	unsure 🔍 -1% - +2% -2.95ms - +8.97ms	unsure 🔍 -1% - +1% -7.45ms - +5.65ms
tip-of-tree tip-of-tree	521.32ms - 529.39ms	unsure 🔍 -2% - +1% -8.97ms - +2.95ms	-	unsure 🔍 -2% - +0% -10.23ms - +2.41ms
previous-release previous-release	524.41ms - 534.12ms	unsure 🔍 -1% - +1% -5.65ms - +7.45ms	unsure 🔍 -0% - +2% -2.41ms - +10.23ms	-

update-reflect

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	534.26ms - 544.46ms	-	unsure 🔍 -0% - +2% -1.88ms - +10.66ms	unsure 🔍 -1% - +1% -5.40ms - +7.40ms
tip-of-tree tip-of-tree	531.32ms - 538.62ms	unsure 🔍 -2% - +0% -10.66ms - +1.88ms	-	unsure 🔍 -2% - +0% -8.70ms - +1.92ms
previous-release previous-release	534.50ms - 542.22ms	unsure 🔍 -1% - +1% -7.40ms - +5.40ms	unsure 🔍 -0% - +2% -1.92ms - +8.70ms	-

_{tachometer-reporter-action v2 for Benchmarks}

github-actions · 2025-07-29T09:21:54Z

The size of lit-html.js and lit-core.min.js are as expected.

Bumps [koa](https://github.com/koajs/koa) from 2.14.1 to 3.0.1. - [Release notes](https://github.com/koajs/koa/releases) - [Changelog](https://github.com/koajs/koa/blob/master/History.md) - [Commits](koajs/koa@2.14.1...v3.0.1) --- updated-dependencies: - dependency-name: koa dependency-version: 3.0.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2025-10-21T15:12:23Z

Superseded by #5127.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 29, 2025

dependabot bot requested a review from kevinpschaaf as a code owner July 29, 2025 09:19

dependabot bot mentioned this pull request Jul 29, 2025

Bump koa from 2.14.1 to 2.16.1 #4967

Closed

dependabot bot force-pushed the dependabot/npm_and_yarn/koa-3.0.1 branch from a6ef652 to cd3ff52 Compare August 3, 2025 00:28

dependabot bot force-pushed the dependabot/npm_and_yarn/koa-3.0.1 branch from cd3ff52 to 37a6b60 Compare August 20, 2025 22:41

dependabot bot closed this Oct 21, 2025

dependabot bot deleted the dependabot/npm_and_yarn/koa-3.0.1 branch October 21, 2025 15:12

Bump koa from 2.14.1 to 3.0.1 #5028

Bump koa from 2.14.1 to 3.0.1 #5028

Conversation

dependabot bot commented on behalf of github Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.0.1

What's Changed

v3.0.0

Breaking

New

Fixes

3.0.0-alpha.3 / 2025-02-11

3.0.0-alpha.2 / 2024-11-04

3.0.0-alpha.1 / 2023-04-12

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

Uh oh!

changeset-bot bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Tachometer Benchmark Results

Summary

nop-update

render

update

update-reflect

Results

render

update

update-reflect

render

update

nop-update

render

update

render

update

update-reflect

Uh oh!

github-actions bot commented Jul 29, 2025

Uh oh!

dependabot bot commented on behalf of github Oct 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jul 29, 2025 •

edited

Loading

changeset-bot bot commented Jul 29, 2025 •

edited

Loading

github-actions bot commented Jul 29, 2025 •

edited

Loading