Bump koa from 2.16.2 to 3.0.3 #5127

dependabot · 2025-10-21T15:12:18Z

Bumps koa from 2.16.2 to 3.0.3.

Release notes

v3.0.3

What's Changed

fix: normalize referer before redirect by @fengmk2 in koajs/koa#1908

Full Changelog: koajs/koa@v3.0.2...v3.0.3

v3.0.2

What's Changed

fix: fixes response.attachment behaviour leads to Content-Type Sniffing by @yowainwright in koajs/koa#1904

chore: use NPM trusted publishing with semver tag triggers by @Copilot in koajs/koa#1907

New Contributors

@Copilot made their first contribution in koajs/koa#1907

Full Changelog: koajs/koa@v3.0.1...v3.0.2

v3.0.1

What's Changed

fix(security): only allow same origin referer on response back koajs/koa@422c551

chore: adds initial doc text refresh; migration guide [CHORE-1870] by @yowainwright in koajs/koa#1877

build(deps-dev): bump formidable from 3.5.2 to 3.5.4 by @dependabot[bot] in koajs/koa#1878

chore: removes done callbacks in tests [CHORE-1870] by @yowainwright in koajs/koa#1875

build(deps-dev): bump supertest from 7.1.0 to 7.1.1 by @dependabot[bot] in koajs/koa#1879

build(deps): bump debug from 4.4.0 to 4.4.1 by @dependabot[bot] in koajs/koa#1880

feat: replace debug module with pure node:util::debuglog by @3imed-jaberi in koajs/koa#1885

feat: replace cache-content-type with mime-types directly by @3imed-jaberi in koajs/koa#1886

build(deps): bump statuses from 2.0.1 to 2.0.2 by @dependabot[bot] in koajs/koa#1888

build(deps-dev): bump supertest from 7.1.1 to 7.1.4 by @dependabot[bot] in koajs/koa#1895

build(deps-dev): bump form-data from 4.0.3 to 4.0.4 by @dependabot[bot] in koajs/koa#1894

Full Changelog: koajs/koa@v3.0.0...v3.0.1

v3.0.0

This is a major release.

Breaking

Minimum node v18

Removes .redirect('back'), adds .back(fallback_url) @fl0w koajs/koa#1115

For .redirect(), don't render redirect values in anchor ref koajs/koa@ff25eb4

req.origin should display the origin header if it exists, not the current hostname koajs/koa#1008. origin now aligns with the Origin header as used in CORS.

.body=<json> should not overwrite type if type already json koajs/koa#1120

Remove special ENOENT support koajs/koa#1861 - this is a big change and will require any file servers to adapt to this change for handling 404s / files not found

Removes generator deprecation messages. Generators are no longer supported. Koa no longer asserts if generators are used. Set content-length: 0 if body is explicitly set to null @ognjenjevremovic #1528 Remove obsolete createAsyncCtxStorageMiddleware koajs/koa#1817

ctx.throw now requires a format of ctx.throw(status, error, properties). See: https://www.npmjs.com/package/http-errors

... (truncated)

Changelog

Sourced from koa's changelog.

[!IMPORTANT] Moving forwards we are using the GitHub releases page at https://github.com/koajs/koa/releases in combination with np for publishing releases and their changelogs.

3.0.0-alpha.3 / 2025-02-11

fixes

Avoid redos on host and protocol getter

3.0.0-alpha.2 / 2024-11-04

breaking changes

Update http-errors to v2.0.0 #1486

ctx.throw now requires a format of ctx.throw(status, error, properties). See: https://www.npmjs.com/package/http-errors

Remove res.redirect('back'), add back() method to ctx #1115

Replace node querystring with URLSearchParams #1828

Remove obsolete createAsyncCtxStorageMiddleware #1817

features

Add support for web WHATWG #1830

updates

Update cookies to ~0.9.1 #1846

Update statuses to ^2.0.1

Update supertest to ^7.0.0 #1841

fixes

Fix exports.defaults in package.json #1630

Fix leaky handles in tests #1838

Fix body null checks #1814

Fix reformatting redirect URLs #1805 #1804

Fix passing ctx in error handler #1758

migrations

Migrate from jest to the native node test runner #1845

3.0.0-alpha.1 / 2023-04-12

fixes

[e98b8d1] - fix: can not get currentContext in error handler (#1758) (Gxkl <gxkl203@gmail.com>)

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

... (truncated)

Commits

ffd497a 3.0.3
769fd75 fix: normalize referer before redirect (#1908)
433b20c 3.0.2
307013b chore: use NPM trusted publishing with semver tag triggers (#1907)
83128eb fix: fixes response.attachment behavior leads to Content-Type Sniffing (#1904)
1ddb048 3.0.1
422c551 Merge commit from fork
6e51eb1 build(deps-dev): bump form-data from 4.0.3 to 4.0.4 (#1894)
d378e5c build(deps-dev): bump supertest from 7.1.1 to 7.1.4 (#1895)
cb22d8d build(deps): bump statuses from 2.0.1 to 2.0.2 (#1888)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for koa since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [koa](https://github.com/koajs/koa) from 2.16.2 to 3.0.3. - [Release notes](https://github.com/koajs/koa/releases) - [Changelog](https://github.com/koajs/koa/blob/master/History.md) - [Commits](koajs/koa@v2.16.2...v3.0.3) --- updated-dependencies: - dependency-name: koa dependency-version: 3.0.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2025-10-21T15:12:23Z

⚠️ No Changeset found

Latest commit: 70696ad

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2025-10-21T15:12:39Z

📊 Tachometer Benchmark Results

Summary

nop-update

this-change, tip-of-tree, previous-release: unsure 🔍 -10% - +5% (-1.21ms - +0.64ms)
^{this-change vs tip-of-tree}

render

this-change: 41.89ms - 53.77ms
this-change, tip-of-tree, previous-release: unsure 🔍 -6% - +3% (-1.17ms - +0.66ms)
^{this-change vs tip-of-tree}
this-change, tip-of-tree, previous-release: unsure 🔍 -2% - +2% (-0.55ms - +0.55ms)
^{this-change vs tip-of-tree}
this-change, tip-of-tree, previous-release: unsure 🔍 -14% - +40% (-6.66ms - +19.95ms)
^{this-change vs tip-of-tree}

update

this-change: 436.49ms - 442.82ms
this-change, tip-of-tree, previous-release: unsure 🔍 -7% - +2% (-2.42ms - +0.65ms)
^{this-change vs tip-of-tree}
this-change, tip-of-tree, previous-release: unsure 🔍 -1% - +2% (-0.46ms - +1.41ms)
^{this-change vs tip-of-tree}
this-change, tip-of-tree, previous-release: unsure 🔍 -1% - +1% (-5.89ms - +2.92ms)
^{this-change vs tip-of-tree}

update-reflect

this-change: 418.16ms - 420.66ms
this-change, tip-of-tree, previous-release: unsure 🔍 -0% - +1% (-0.97ms - +5.16ms)
^{this-change vs tip-of-tree}

Results

this-change

Browser: chrome-headless 140.0.0.0
Sample size: 50
Built by: Benchmarks #7009
Commit: 70696ad

render

Version	Avg time	vs
	41.89ms - 53.77ms	-

update

Version	Avg time	vs
	436.49ms - 442.82ms	-

update-reflect

Version	Avg time	vs
	418.16ms - 420.66ms	-

this-change, tip-of-tree, previous-release

Browser: chrome-headless 140.0.0.0
Sample size: 30
Built by: Benchmarks #7009
Commit: 70696ad

render

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	18.61ms - 19.81ms	-	unsure 🔍 -6% - +3% -1.17ms - +0.66ms	unsure 🔍 -10% - +4% -1.92ms - +0.90ms
tip-of-tree tip-of-tree	18.77ms - 20.15ms	unsure 🔍 -3% - +6% -0.66ms - +1.17ms	-	unsure 🔍 -9% - +6% -1.70ms - +1.19ms
previous-release previous-release	18.45ms - 20.99ms	unsure 🔍 -5% - +10% -0.90ms - +1.92ms	unsure 🔍 -6% - +9% -1.19ms - +1.70ms	-

update

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	33.76ms - 36.04ms	-	unsure 🔍 -7% - +2% -2.42ms - +0.65ms	unsure 🔍 -9% - +1% -3.34ms - +0.32ms
tip-of-tree tip-of-tree	34.76ms - 36.81ms	unsure 🔍 -2% - +7% -0.65ms - +2.42ms	-	unsure 🔍 -6% - +3% -2.38ms - +1.13ms
previous-release previous-release	34.98ms - 37.84ms	unsure 🔍 -1% - +10% -0.32ms - +3.34ms	unsure 🔍 -3% - +7% -1.13ms - +2.38ms	-

nop-update

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	11.57ms - 12.91ms	-	unsure 🔍 -10% - +5% -1.21ms - +0.64ms	unsure 🔍 -8% - +7% -0.98ms - +0.88ms
tip-of-tree tip-of-tree	11.89ms - 13.16ms	unsure 🔍 -5% - +10% -0.64ms - +1.21ms	-	unsure 🔍 -6% - +9% -0.68ms - +1.14ms
previous-release previous-release	11.64ms - 12.94ms	unsure 🔍 -7% - +8% -0.88ms - +0.98ms	unsure 🔍 -9% - +5% -1.14ms - +0.68ms	-

this-change, tip-of-tree, previous-release

Browser: chrome-headless 140.0.0.0
Sample size: 50
Built by: Benchmarks #7009
Commit: 70696ad

render

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	33.68ms - 34.39ms	-	unsure 🔍 -2% - +2% -0.55ms - +0.55ms	unsure 🔍 -2% - +1% -0.84ms - +0.25ms
tip-of-tree tip-of-tree	33.61ms - 34.45ms	unsure 🔍 -2% - +2% -0.55ms - +0.55ms	-	unsure 🔍 -3% - +1% -0.88ms - +0.29ms
previous-release previous-release	33.91ms - 34.74ms	unsure 🔍 -1% - +2% -0.25ms - +0.84ms	unsure 🔍 -1% - +3% -0.29ms - +0.88ms	-

update

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	66.46ms - 67.68ms	-	unsure 🔍 -1% - +2% -0.46ms - +1.41ms	unsure 🔍 -0% - +2% -0.21ms - +1.37ms
tip-of-tree tip-of-tree	65.88ms - 67.30ms	unsure 🔍 -2% - +1% -1.41ms - +0.46ms	-	unsure 🔍 -1% - +1% -0.76ms - +0.97ms
previous-release previous-release	65.99ms - 66.99ms	unsure 🔍 -2% - +0% -1.37ms - +0.21ms	unsure 🔍 -1% - +1% -0.97ms - +0.76ms	-

this-change, tip-of-tree, previous-release

Browser: chrome-headless 140.0.0.0
Sample size: 50
Built by: Benchmarks #7009
Commit: 70696ad

render

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	48.69ms - 68.08ms	-	unsure 🔍 -14% - +40% -6.66ms - +19.95ms	unsure 🔍 -22% - +26% -12.47ms - +14.91ms
tip-of-tree tip-of-tree	42.63ms - 60.86ms	unsure 🔍 -33% - +10% -19.95ms - +6.66ms	-	unsure 🔍 -32% - +13% -18.72ms - +7.86ms
previous-release previous-release	47.50ms - 66.84ms	unsure 🔍 -25% - +21% -14.91ms - +12.47ms	unsure 🔍 -16% - +37% -7.86ms - +18.72ms	-

update

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	429.79ms - 436.34ms	-	unsure 🔍 -1% - +1% -5.89ms - +2.92ms	unsure 🔍 -1% - +1% -3.29ms - +6.09ms
tip-of-tree tip-of-tree	431.60ms - 437.49ms	unsure 🔍 -1% - +1% -2.92ms - +5.89ms	-	unsure 🔍 -0% - +2% -1.58ms - +7.35ms
previous-release previous-release	428.30ms - 435.02ms	unsure 🔍 -1% - +1% -6.09ms - +3.29ms	unsure 🔍 -2% - +0% -7.35ms - +1.58ms	-

update-reflect

Version	Avg time	vs this-change	vs tip-of-tree tip-of-tree	vs previous-release previous-release
this-change	431.64ms - 436.31ms	-	unsure 🔍 -0% - +1% -0.97ms - +5.16ms	unsure 🔍 -0% - +1% -2.08ms - +3.78ms
tip-of-tree tip-of-tree	429.89ms - 433.86ms	unsure 🔍 -1% - +0% -5.16ms - +0.97ms	-	unsure 🔍 -1% - +0% -3.91ms - +1.41ms
previous-release previous-release	431.36ms - 434.89ms	unsure 🔍 -1% - +0% -3.78ms - +2.08ms	unsure 🔍 -0% - +1% -1.41ms - +3.91ms	-

_{tachometer-reporter-action v2 for Benchmarks}

github-actions · 2025-10-21T15:16:49Z

The size of lit-html.js and lit-core.min.js are as expected.

dependabot bot requested a review from kevinpschaaf as a code owner October 21, 2025 15:12

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 21, 2025

dependabot bot mentioned this pull request Oct 21, 2025

Bump koa from 2.14.1 to 3.0.1 #5028

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump koa from 2.16.2 to 3.0.3 #5127

Bump koa from 2.16.2 to 3.0.3 #5127

Uh oh!

Uh oh!

📊 Tachometer Benchmark Results

Summary

nop-update

render

update

update-reflect

Results

render

update

update-reflect

render

update

nop-update

render

update

render

update

update-reflect

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump koa from 2.16.2 to 3.0.3 #5127

Are you sure you want to change the base?

Bump koa from 2.16.2 to 3.0.3 #5127

Conversation

v3.0.3

What's Changed

v3.0.2

What's Changed

New Contributors

v3.0.1

What's Changed

v3.0.0

Breaking

3.0.0-alpha.3 / 2025-02-11

3.0.0-alpha.2 / 2024-11-04

3.0.0-alpha.1 / 2023-04-12

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

Uh oh!

⚠️ No Changeset found

Uh oh!

Uh oh!

📊 Tachometer Benchmark Results

Summary

nop-update

render

update

update-reflect

Results

render

update

update-reflect

render

update

nop-update

render

update

render

update

update-reflect

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants