Update dependency koa to v2.15.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
koa	2.6.2 -> 2.15.4

GitHub Vulnerability Alerts

CVE-2025-25200

Summary

Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.

PoC

Coming soon.

Impact

This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

---

Release Notes

koajs/koa (koa)

v2.15.4

Compare Source

v2.15.3

Compare Source

v2.15.2

Compare Source

v2.15.1

Compare Source

v2.15.0

Compare Source

v2.14.2

Compare Source

v2.14.1

Compare Source

v2.14.0

Compare Source

v2.13.4

Compare Source

v2.13.3

Compare Source

v2.13.2

Compare Source

v2.13.1

Compare Source

==================

fixes

• [b5472f4] - fix: make ESM transpiled CommonJS play nice for TS folks, fix #​1513 (#​1518) (miwnwski <m@iwnw.ski>)
• [68d97d6] - fix: fixed order of vulnerability disclosure addresses (niftylettuce <niftylettuce@gmail.com>)

others

• [b4398f5] - correct verb tense in doc (#​1512) (Matan Shavit <71092861+matanshavit@users.noreply.github.com>)
• [39e1a5a] - fixed multiple grammatical errors in docs. (#​1497) (Hridayesh Sharma <<vyasriday7@​gmail.com>>)
• [aeb5d19] - docs: added niftylettuce@gmail.com to vulnerability disclosure (niftylettuce <niftylettuce@gmail.com>)
• [6e1093b] - docs: remove babel from readme (#​1494) (miwnwski <m@iwnw.ski>)
• [38cb591] - docs: update specific for auto response status (AlbertAZ1992 <ziyuximing@163.com>)
• [2224cd9] - docs: remove babel ref. (#​1488) (Imed Jaberi <imed_jebari@hotmail.fr>)
• [d51f983] - docs: fix assert example for response (#​1489) (Imed Jaberi <imed_jebari@hotmail.fr>)
• [f8b49b8] - chore: fix grammatical and spelling errors in comments and tests (#​1490) (Matt Kubej <mkubej@gmail.com>)
• [d1c9263] - deps: update depd >> v2.0.0 (#​1482) (imed jaberi <imed_jebari@hotmail.fr>)

v2.13.0

Compare Source

==================

features

• [bbcde76] - feat: support esm (#​1474) (ZYSzys <zhangyongsheng@youzan.com>)

others

• [20e58cf] - test: imporve coverage to 100% (dead-horse <dead_horse@qq.com>)
• [4a40d63] - build: use prepare instead of prepublish (dead-horse <dead_horse@qq.com>)
• [226ba8c] - build: use prepublish instead of prepack (dead-horse <dead_horse@qq.com>)

v2.12.1

Compare Source

==================

fixes

• [e2030c7] - fix: Improve checks for Error in onerror handlers (#​1468) (Julien Wajsberg <felash@gmail.com>)

others

• [5208c5e] - chore: Use single console.error() statement in error handler (#​1471) (Mike Vosseller <michael.vosseller@gmail.com>)

v2.12.0

Compare Source

==================

features

• [0d2f421] - feat: error handler treat err.statusCode as the same as err.status (#​1460) (Vijay Krishnavanshi <vijaykrishnavanshi@gmail.com>)
• [8d52105] - feat: allow bodyless responses for non empty status codes (#​1447) (ejose19 <<8742215+ejose19@​users.noreply.github.com>>)

others

• [faeaff5] - fox: remove error-inject and fix error handling (#​1409) (Konstantin Vyatkin <tino@vtkn.io>)
• [f7c732f] - docs: fixed incorrect onerror example (#​1459) (Paul Annekov <paul.annekov@gmail.com>)
• [143d8f7] - Always use strict equality. (#​1225) (Yazan Medanat <medanat@gmail.com>)
• [6b6b0dd] - docs(api): add app.use chainability note (#​1449) (Zac Anger <zac@zacanger.com>)
• [8ddab48] - docs: Document response status with empty body (#​1445) (Marc-Aurèle DARCHE <152407+madarche@users.noreply.github.com>)
• [7deedb2] - docs: Updating context.md with the latest cookies opts (#​1433) (Brad Ito <phlogisticfugu@users.noreply.github.com>)
• [3e97a10] - docs(links): remove Google+ link (#​1439) (laffachan <45162759+laffachan@users.noreply.github.com>)
• [eda2760] - build: Drop unused Travis sudo: false directive (#​1416) (Olle Jonsson <olle.jonsson@gmail.com>)

v2.11.0

Compare Source

==================

features

• [422e539] - feat: support app.proxyIPHeader and app.maxIpsCount to make ctx.ips more security (Yiyu He <dead_horse@qq.com>)
• [d48d88e] - feat: implement response.has (#​1397) (Konstantin Vyatkin <tino@vtkn.io>)

others

• [4dc56f6] - chore: update ESLint and plugins/configs (#​1407) (Konstantin Vyatkin <tino@vtkn.io>)
• [be7d334] - chore: removes code duplication at handling HEAD method (#​1400) (Konstantin Vyatkin <tino@vtkn.io>)
• [f155785] - chore: support writableEnded (#​1402) (Konstantin Vyatkin <tino@vtkn.io>)
• [b968688] - chore: add FUNDING.yml (#​1403) (Konstantin Vyatkin <tino@vtkn.io>)
• [4f96829] - chore: remove isJSON in res.length (#​1399) (Konstantin Vyatkin <tino@vtkn.io>)
• [8be5626] - build: enable codecov partial coverage and use bash uploader (#​1396) (Konstantin Vyatkin <tino@vtkn.io>)
• [ef5c43b] - chore: use rest params (#​1393) (Konstantin Vyatkin <tino@vtkn.io>)

v2.10.0

Compare Source

==================

features

• [d7f7f77] - feat: support sameSite=none cookies (bump cookies dependency) (#​1390) (Filip Skokan <panva.ip@gmail.com>)

v2.9.0

Compare Source

==================

features

• [2d1c598] - feat: export HttpError from http-errors library (Micheal Hill <micheal.hill@trunkplatform.com>)

others

• [cf70dbc] - Chore: Use https in readme (#​1389) (谭九鼎 <<109224573@​qq.com>>)

v2.8.2

Compare Source

==================

fixes

• [54e8fab] - fix: encode redirect url if not already encoded (#​1384) (fengmk2 <<fengmk2@​gmail.com>>)

others

• [817b498] - test: fix body test (#​1375) (Robert Nagy <ronagy@icloud.com>)
• [f75d445] - test: fix end after end (#​1374) (Robert Nagy <ronagy@icloud.com>)

v2.8.1

Compare Source

==================

fixes

• [287e589] - fix: make options more compatibility (dead-horse <dead_horse@qq.com>)

v2.8.0

Compare Source

==================

features

• [5afff89] - feat: accept options in the Application constructor (#​1372) (Jake <djakelambert@gmail.com>)

fixes

• [ff70bdc] - fix: typo on document (#​1355) (Jeff <jeff.tian@outlook.com>)

others

• [3b23865] - docs: parameter of request.get is case-insensitive (#​1373) (Gunnlaugur Thor Briem <gunnlaugur@gmail.com>)
• [a245d18] - docs: Update response.socket (#​1357) (Jeff <jeff.tian@outlook.com>)
• [d1d65dd] - chore(deps): install egg-bin, mm as devDeps not deps (#​1366) (Edvard Chen <<pigeon73101@​gmail.com>>)
• [2c86b10] - test: remove jest and use egg-bin(mocha) (#​1363) (Yiyu He <dead_horse@qq.com>)
• [219bf22] - docs(context): update link (#​1354) (Peng Jie <bivinity.pengzjie@gmail.com>)
• [52a6737] - chore: ignore Intellij IDEA project files (#​1361) (Imon-Haque <38266345+Imon-Haque@users.noreply.github.com>)
• [b9e3546] - docs(api): fix keygrip link (#​1350) (Peng Jie <bivinity.pengzjie@gmail.com>)
• [d4bdb5e] - chore: update eslint and fix lint errors (dead-horse <dead_horse@qq.com>)
• [12960c4] - build: test on 8/10/12 (dead-horse <dead_horse@qq.com>)
• [00e8f7a] - docs: ctx.type aliases ctx.response, not ctx.request (#​1343) (Alex Berk <berkalexanderc@gmail.com>)
• [62f29eb] - docs(context): update cookies link (#​1348) (Peng Jie <dean.leehom@gmail.com>)
• [b7fc526] - docs: fix typo in cookie path default value docs (#​1340) (Igor Adamenko <igoradamenko@users.noreply.github.com>)
• [23f7f54] - chore: simplify variable (#​1332) (kzhang <godky@users.noreply.github.com>)
• [132c9ee] - docs: Clarify the format of request.headers (#​1325) (Dobes Vandermeer <dobesv@gmail.com>)
• [5810f27] - docs: Removed Document in Progress note in Koa vs Express (#​1336) (Andrew Peterson <andrew@andpeterson.com>)
• [75233d9] - chore: Consider removing this return statement; it will be ignored. (#​1322) (Vern Brandl <tkvern@users.noreply.github.com>)
• [04e07fd] - test: Buffer() is deprecated due to security and usability issues. so use the Buffer.alloc() instead (#​1321) (Vern Brandl <tkvern@users.noreply.github.com>)
• [130e363] - docs: use 'fs-extra' instead of 'fs-promise' (#​1309) (rosald <35028438+rosald@users.noreply.github.com>)
• [2f2078b] - chore: Update PR-welcome badge url (#​1299) (James George <<jamesgeorge998001@​gmail.com>>)

v2.7.0

Compare Source

==================

features

• [b7bfa71] - feat: change set status assert, allowing valid custom statuses (#​1308) (Martin Iwanowski <martin@iwanowski.se>)

others

• [72f325b] - chore: add pr welcoming badge (#​1291) (James George <<jamesgeorge998001@​gmail.com>>)
• [b15115b] - chore: Reduce unnecessary variable declarations (#​1298) (call me saisai <<1457358080@​qq.com>>)
• [ad91ce2] - chore: license 2019 (dead-horse <dead_horse@qq.com>)
• [b25e79d] - Mark two examples as live for the corresponding documentation change in https://github.com/koajs/koajs.com/pull/38. (#​1031) (Francisco Ryan Tolmasky I <tolmasky@gmail.com>)
• [d9ef603] - chore: Optimize array split (#​1295) (Mikhail Bodrov <<connormiha1@​gmail.com>>)
• [9be8583] - chore: replace ~~ with Math.trunc in res.length (option) (#​1288) (jeremiG <gendronjeremi@gmail.com>)
• [7e46c20] - docs: add link to the license file (#​1290) (James George <<jamesgeorge998001@​gmail.com>>)
• [48993ad] - docs: Document other body types (#​1285) (Douglas Wade <douglas.b.wade@gmail.com>)
• [acb388b] - docs: Add security vulnerability disclosure instructions to the Readme (#​1283) (Douglas Wade <douglas.b.wade@gmail.com>)
• [a007198] - docs: Document ctx.app.emit (#​1284) (Douglas Wade <douglas.b.wade@gmail.com>)
• [f90e825] - docs: response.set(fields) won't overwrites previous header fields(#​1282) (Douglas Wade <douglas.b.wade@gmail.com>)
• [fc93c05] - docs: update readme to add babel 7 instructions (#​1274) (Vikram Rangaraj <<vik120@​icloud.com>>)
• [5560f72] - chore: use the ability of content-type lib directly (#​1276) (Jordan <mingmingwon@gmail.com>)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.