Update dependency koa to v2.15.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
koa	2.6.2 -> 2.15.4

GitHub Vulnerability Alerts

CVE-2025-25200

Summary

Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.

PoC

Coming soon.

Impact

This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

---

Release Notes

koajs/koa (koa)

v2.15.4

Compare Source

v2.15.3

Compare Source

v2.15.2

Compare Source

v2.15.1

Compare Source

v2.15.0

Compare Source

v2.14.2

Compare Source

v2.14.1

Compare Source

v2.14.0

Compare Source

v2.13.4

Compare Source

v2.13.3

Compare Source

v2.13.2

Compare Source

v2.13.1

Compare Source

==================

fixes

• [b5472f4] - fix: make ESM transpiled CommonJS play nice for TS folks, fix #​1513 (#​1518) (miwnwski <[email protected]>)
• [68d97d6] - fix: fixed order of vulnerability disclosure addresses (niftylettuce <[email protected]>)

others

• [b4398f5] - correct verb tense in doc (#​1512) (Matan Shavit <[email protected]>)
• [39e1a5a] - fixed multiple grammatical errors in docs. (#​1497) (Hridayesh Sharma <<vyasriday7@​gmail.com>>)
• [aeb5d19] - docs: added [email protected] to vulnerability disclosure (niftylettuce <[email protected]>)
• [6e1093b] - docs: remove babel from readme (#​1494) (miwnwski <[email protected]>)
• [38cb591] - docs: update specific for auto response status (AlbertAZ1992 <[email protected]>)
• [2224cd9] - docs: remove babel ref. (#​1488) (Imed Jaberi <[email protected]>)
• [d51f983] - docs: fix assert example for response (#​1489) (Imed Jaberi <[email protected]>)
• [f8b49b8] - chore: fix grammatical and spelling errors in comments and tests (#​1490) (Matt Kubej <[email protected]>)
• [d1c9263] - deps: update depd >> v2.0.0 (#​1482) (imed jaberi <[email protected]>)

v2.13.0

Compare Source

==================

features

• [bbcde76] - feat: support esm (#​1474) (ZYSzys <[email protected]>)

others

• [20e58cf] - test: imporve coverage to 100% (dead-horse <[email protected]>)
• [4a40d63] - build: use prepare instead of prepublish (dead-horse <[email protected]>)
• [226ba8c] - build: use prepublish instead of prepack (dead-horse <[email protected]>)

v2.12.1

Compare Source

==================

fixes

• [e2030c7] - fix: Improve checks for Error in onerror handlers (#​1468) (Julien Wajsberg <[email protected]>)

others

• [5208c5e] - chore: Use single console.error() statement in error handler (#​1471) (Mike Vosseller <[email protected]>)

v2.12.0

Compare Source

==================

features

• [0d2f421] - feat: error handler treat err.statusCode as the same as err.status (#​1460) (Vijay Krishnavanshi <[email protected]>)
• [8d52105] - feat: allow bodyless responses for non empty status codes (#​1447) (ejose19 <<8742215+ejose19@​users.noreply.github.com>>)

others

• [faeaff5] - fox: remove error-inject and fix error handling (#​1409) (Konstantin Vyatkin <[email protected]>)
• [f7c732f] - docs: fixed incorrect onerror example (#​1459) (Paul Annekov <[email protected]>)
• [143d8f7] - Always use strict equality. (#​1225) (Yazan Medanat <[email protected]>)
• [6b6b0dd] - docs(api): add app.use chainability note (#​1449) (Zac Anger <[email protected]>)
• [8ddab48] - docs: Document response status with empty body (#​1445) (Marc-Aurèle DARCHE <[email protected]>)
• [7deedb2] - docs: Updating context.md with the latest cookies opts (#​1433) (Brad Ito <[email protected]>)
• [3e97a10] - docs(links): remove Google+ link (#​1439) (laffachan <[email protected]>)
• [eda2760] - build: Drop unused Travis sudo: false directive (#​1416) (Olle Jonsson <[email protected]>)

v2.11.0

Compare Source

==================

features

• [422e539] - feat: support app.proxyIPHeader and app.maxIpsCount to make ctx.ips more security (Yiyu He <[email protected]>)
• [d48d88e] - feat: implement response.has (#​1397) (Konstantin Vyatkin <[email protected]>)

others

• [4dc56f6] - chore: update ESLint and plugins/configs (#​1407) (Konstantin Vyatkin <[email protected]>)
• [be7d334] - chore: removes code duplication at handling HEAD method (#​1400) (Konstantin Vyatkin <[email protected]>)
• [f155785] - chore: support writableEnded (#​1402) (Konstantin Vyatkin <[email protected]>)
• [b968688] - chore: add FUNDING.yml (#​1403) (Konstantin Vyatkin <[email protected]>)
• [4f96829] - chore: remove isJSON in res.length (#​1399) (Konstantin Vyatkin <[email protected]>)
• [8be5626] - build: enable codecov partial coverage and use bash uploader (#​1396) (Konstantin Vyatkin <[email protected]>)
• [ef5c43b] - chore: use rest params (#​1393) (Konstantin Vyatkin <[email protected]>)

v2.10.0

Compare Source

==================

features

• [d7f7f77] - feat: support sameSite=none cookies (bump cookies dependency) (#​1390) (Filip Skokan <[email protected]>)

v2.9.0

Compare Source

==================

features

• [2d1c598] - feat: export HttpError from http-errors library (Micheal Hill <[email protected]>)

others

• [cf70dbc] - Chore: Use https in readme (#​1389) (谭九鼎 <<109224573@​qq.com>>)

v2.8.2

Compare Source

==================

fixes

• [54e8fab] - fix: encode redirect url if not already encoded (#​1384) (fengmk2 <<fengmk2@​gmail.com>>)

others

• [817b498] - test: fix body test (#​1375) (Robert Nagy <[email protected]>)
• [f75d445] - test: fix end after end (#​1374) (Robert Nagy <[email protected]>)

v2.8.1

Compare Source

==================

fixes

• [287e589] - fix: make options more compatibility (dead-horse <[email protected]>)

v2.8.0

Compare Source

==================

features

• [5afff89] - feat: accept options in the Application constructor (#​1372) (Jake <[email protected]>)

fixes

• [ff70bdc] - fix: typo on document (#​1355) (Jeff <[email protected]>)

others

• [3b23865] - docs: parameter of request.get is case-insensitive (#​1373) (Gunnlaugur Thor Briem <[email protected]>)
• [a245d18] - docs: Update response.socket (#​1357) (Jeff <[email protected]>)
• [d1d65dd] - chore(deps): install egg-bin, mm as devDeps not deps (#​1366) (Edvard Chen <<pigeon73101@​gmail.com>>)
• [2c86b10] - test: remove jest and use egg-bin(mocha) (#​1363) (Yiyu He <[email protected]>)
• [219bf22] - docs(context): update link (#​1354) (Peng Jie <[email protected]>)
• [52a6737] - chore: ignore Intellij IDEA project files (#​1361) (Imon-Haque <[email protected]>)
• [b9e3546] - docs(api): fix keygrip link (#​1350) (Peng Jie <[email protected]>)
• [d4bdb5e] - chore: update eslint and fix lint errors (dead-horse <[email protected]>)
• [12960c4] - build: test on 8/10/12 (dead-horse <[email protected]>)
• [00e8f7a] - docs: ctx.type aliases ctx.response, not ctx.request (#​1343) (Alex Berk <[email protected]>)
• [62f29eb] - docs(context): update cookies link (#​1348) (Peng Jie <[email protected]>)
• [b7fc526] - docs: fix typo in cookie path default value docs (#​1340) (Igor Adamenko <[email protected]>)
• [23f7f54] - chore: simplify variable (#​1332) (kzhang <[email protected]>)
• [132c9ee] - docs: Clarify the format of request.headers (#​1325) (Dobes Vandermeer <[email protected]>)
• [5810f27] - docs: Removed Document in Progress note in Koa vs Express (#​1336) (Andrew Peterson <[email protected]>)
• [75233d9] - chore: Consider removing this return statement; it will be ignored. (#​1322) (Vern Brandl <[email protected]>)
• [04e07fd] - test: Buffer() is deprecated due to security and usability issues. so use the Buffer.alloc() instead (#​1321) (Vern Brandl <[email protected]>)
• [130e363] - docs: use 'fs-extra' instead of 'fs-promise' (#​1309) (rosald <[email protected]>)
• [2f2078b] - chore: Update PR-welcome badge url (#​1299) (James George <<jamesgeorge998001@​gmail.com>>)

v2.7.0

Compare Source

==================

features

• [b7bfa71] - feat: change set status assert, allowing valid custom statuses (#​1308) (Martin Iwanowski <[email protected]>)

others

• [72f325b] - chore: add pr welcoming badge (#​1291) (James George <<jamesgeorge998001@​gmail.com>>)
• [b15115b] - chore: Reduce unnecessary variable declarations (#​1298) (call me saisai <<1457358080@​qq.com>>)
• [ad91ce2] - chore: license 2019 (dead-horse <[email protected]>)
• [b25e79d] - Mark two examples as live for the corresponding documentation change in https://github.com/koajs/koajs.com/pull/38. (#​1031) (Francisco Ryan Tolmasky I <[email protected]>)
• [d9ef603] - chore: Optimize array split (#​1295) (Mikhail Bodrov <<connormiha1@​gmail.com>>)
• [9be8583] - chore: replace ~~ with Math.trunc in res.length (option) (#​1288) (jeremiG <[email protected]>)
• [7e46c20] - docs: add link to the license file (#​1290) (James George <<jamesgeorge998001@​gmail.com>>)
• [48993ad] - docs: Document other body types (#​1285) (Douglas Wade <[email protected]>)
• [acb388b] - docs: Add security vulnerability disclosure instructions to the Readme (#​1283) (Douglas Wade <[email protected]>)
• [a007198] - docs: Document ctx.app.emit (#​1284) (Douglas Wade <[email protected]>)
• [f90e825] - docs: response.set(fields) won't overwrites previous header fields(#​1282) (Douglas Wade <[email protected]>)
• [fc93c05] - docs: update readme to add babel 7 instructions (#​1274) (Vikram Rangaraj <<vik120@​icloud.com>>)
• [5560f72] - chore: use the ability of content-type lib directly (#​1276) (Jordan <[email protected]>)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.