[dependabot]

Bumps elysia from 1.4.25 to 1.4.30.

Release notes

Sourced from elysia's releases.

1.4.30

What's changed

The current development effort will be focused in Elysia 2, see kiana and beta release note.

1.4.x will only publish security updates, no new features.

Chore:

• update test case for Bun 1.4

Advisory:

• GHSA-gmm9-qwx3-2m3h
• GHSA-2p5p-r4r9-f9jm
• GHSA-3958-wq4x-729c
• GHSA-46qc-v7pw-4j7j
• GHSA-mx4m-hmpr-4w39

Full Changelog: elysiajs/elysia@1.4.29...1.4.30

1.4.29

What's changed

Improvement:

• normalize a multipart/form-data with .get instead of .getAll for faster performance

Full Changelog: elysiajs/elysia@1.4.28...1.4.29

1.4.28

What's new

Feature:

• #1803 stream response with pull based backpressure
• #1802 handle range header for file/blob response
• #1722, #1741 direct ReadableStream perf blow-up

Bug fix:

• #1805 dynamic imports inside .guard not registering routes
• #1771 breaks Bun HTML imports
• #1797 await mapped error response promise
• #1794 merge app cookie config into route cookie validator config
• #1796 check custom parser by full name
• #1795 write transformed cookie value to cookie entry directly
• #1793 use cookie schema for cookie noValidate check
• #1792 throw ValidationError instead of boolean in response encode path
• detect HTML bundle when inline response is Promise

Change:

• #1613 export ElysiaTypeCustomErrors
• remove Bun specific built
• export AnySchema, UnwrapSchema, ModelsToTypes from root
• conditional set headers of String and Object when no set.headers is set

... (truncated)

Changelog

Sourced from elysia's changelog.

1.4.30 - 26 Aug 2026

Chore:

• update test case for Bun 1.4

Advisory:

• GHSA-gmm9-qwx3-2m3h
• GHSA-2p5p-r4r9-f9jm
• GHSA-3958-wq4x-729c
• GHSA-46qc-v7pw-4j7j
• GHSA-mx4m-hmpr-4w39

1.4.29 - 17 Jun 2026

Bug fix:

• normalize a multipart/form-data with .get instead of .getAll for faster performance

1.4.28 - 17 Mar 2025

Feature:

• #1803 stream response with pull based backpressure
• #1802 handle range header for file/blob response
• #1722, #1741 direct ReadableStream perf blow-up

Bug fix:

• #1805 dynamic imports inside .guard not registering routes
• #1771 breaks Bun HTML imports
• #1797 await mapped error response promise
• #1794 merge app cookie config into route cookie validator config
• #1796 check custom parser by full name
• #1795 write transformed cookie value to cookie entry directly
• #1793 use cookie schema for cookie noValidate check
• #1792 throw ValidationError instead of boolean in response encode path
• detect HTML bundle when inline response is Promise

Change:

• #1613 export ElysiaTypeCustomErrors
• remove Bun specific built
• export AnySchema, UnwrapSchema, ModelsToTypes from root
• conditional set headers of String and Object when no set.headers is set

1.4.27 - 1 Mar 2026

Bug fix:

• getSchemaValidator: handle TypeBox as sub type
• handle cookie prototype pollution when parsing cookie

Improvement:

• conditional async on getSchemaValidator when schema is Standard Schema
• use Response.json on Bun

1.4.26 - 25 Feb 2026

Bug fix:

• #1755 deduplicate local handler from global event

... (truncated)

Commits

• e037eca 🧹 chore: correct spelling mistake in changelog
• acea3a7 🧹 chore: add SECURITY.md
• a6b9fc7 🧹 chore: update for bun 1.4
• b1c325f Merge branch 'main' of https://github.com/elysiajs/elysia
• b8256cc 🧹 chore: update for bun 1.4
• 767bad1 Merge commit from fork
• be31c27 🔧 fix: escape schema default keys and values to prevent code injection
• 89088df 🧹 chore: remove blank issue
• 2c8b61d 🧹 chore: 'I have nothing but my burger and I want nothing more' disclosure
• 7e7dabd 🧹 chore: 'I have nothing but my burger and I want nothing more' disclosure
• Additional commits viewable in compare view

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}