Commit activity
Last 12 weeks · 0 commits
Community health
3 of 6 standards met
Recent PRs & issues
Description Using issue template from previous CVE/dependency related issues. Situation reports a high severity vulnerability CVE-2026-87776 in the direct dependency compression@1.8.1 Steps to reproduce macOS 27.0.1 Node.js v24.12.0 LTS Logs Assessment Executing the following is unable to remediate the vulnerability: serve@14.2.6 is pinned to compression@1.8.1, release Jul 17, 2025, which is the object of CVE-2026-87776. A minimum version compression@1.8.2 (current ) is required to pull the fixed version. Recommendation Bump compression@1.8.1 to compression@1.8.2 in dependencies of serve and release a new version. Library version 14.2.6 (current ) Node version v24.12.0 LTS
Description is validated against , which sets and does not include in its list. Any with a key fails at startup: The configuration you provided is invalid: must NOT have additional properties {"additionalProperty":"$schema"} Repro: 1. Create : { "$schema": "https://github.com/chances/schemastore/raw/refs/heads/vercel-serve/src/schemas/json/serve.json", "public": "app/" } 2. Run 3. Server exits with the error above. Expected: (a standard JSON Schema convention for editor tooling) should be allowed in 's , same as Vercel's own schema does for . Environment Node/npx on Windows. Library version v14.2.6 Node version v24.19.0
Recent fixes
Related Issues Fixes #746. Description Added Regression coverage for a throwing and a normal external IPv4 address, plus a patch changeset and a README note. Changed Defer interface discovery until is called and return no network address when discovery fails. Importing the utility no longer queries the interfaces. Network discovery only supplies an optional banner URL, so its failure should not stop a local HTTP server. Removed The import-time interface snapshot. Caveats/Problems/Issues Checked on Node 22.23.3 with pnpm 10.33.0 and the repository's Vitest 2.1.3: Baseline regression: 1 pass, 1 fail, with the failure at the import-time interface query. : TypeScript check and all 30 unit tests pass with coverage enabled. and : pass. Compiled CLI started under a preload that makes the actual Node builtin throw. It served fixture HTTP 200 with correct content and no network URL. No Android/Termux hardware test performed. Standalone run_tests.sh passed from a second fresh clone/install, including the baseline failure, full tests/lint/compile and compiled CLI HTTP proof. Open #859 changes when network URLs are advertised for specific listeners. This fix only makes discovery optional and should compose; it does not change binding behavior or that PR's listener rules. Checklist [x] Related issue mentioned above. [x] Added/changed/removed behavior described above. [x] All tests () pass. [x] passes. [x] Added optional-discovery comment; existing helper TSDoc and return annotation retained.
Related Issues No issue filed. Found while checking the configuration loader's automatic fallback behavior. Description Added Three regressions covering a deployment-style containing , a legacy section, and falling through to static settings. Added README documentation and a patch changeset. Changed The loader automatically probes when no exists. A valid deployment file without currently throws , stopping local serving before the server starts. Make optional and skip that file if it has no static section, matching the existing package.json behavior. Existing legacy static configuration remains honored. This does not validate deployment configuration or add new deployment support. Removed Nothing. Caveats/Problems/Issues Node 22.23.3, pnpm 10.33.0, repository Vitest 2.1.3: New tests on unchanged loader: 1 pass, 2 fail. Full : TypeScript and all 31 tests pass with coverage. Full and : pass. Compiled CLI started beside now.json version 2, served a fixture over HTTP with status 200 and exact content. Standalone run_tests.sh passed in a second fresh clone/install, including baseline failure, full tests/lint/compile and compiled CLI proof. Only the absent legacy section is addressed; JSON-shape validation beyond this scenario is unchanged. Checklist [x] Related issue status stated above (none filed). [x] Added/changed/removed behavior explained. [x] All tests () pass. [x] passes. [x] Existing loader TSDoc and section-selection comment retained; optional interface type reflects supported absence.
Related Issues Fixes #862 Description Changed Strip the top-level key from before validation, so editor-added schema references no longer fail with "must NOT have additional properties". It is editor metadata, not a serve option. Added (a config with plus real options still loads the options; a -only config is accepted) and a patch changeset. Caveats/Problems/Issues New tests fail 2 of 3 on the unpatched base and pass 3 of 3 with the change. With a containing and , the compiled CLI serves HTTP 200; the unpatched build exits with the AJV error. Checklist [x] The issues that this PR fixes/closes have been mentioned above. [x] What this PR adds/changes/removes has been explained. [x] All tests () pass. [x] The linter () does not throw an errors. [x] All added/modified code has been commented, and methods/classes/constants/types have been annotated with TSDoc comments.
Repository: vercel/serve. Description: Static file serving and directory listing Stars: 9906, Forks: 707. Primary language: TypeScript. Languages: TypeScript (78.7%), HTML (10.5%), JavaScript (10.5%), Shell (0.3%). License: MIT. Homepage: https://npmjs.com/package/serve Topics: cli, command, http, node. Latest release: v14.2.6 (7mo ago). Open PRs: 19, open issues: 135. Last activity: 3mo ago. Community health: 75%. Top contributors: leo, greenkeeper[bot], rauchg, AndyBitz, greenkeeperio-bot, leerob, disquisition, TooTallNate, gamemaker1, dependabot[bot] and others.