Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: hapijs/joi
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v17.13.3
Choose a base ref
...
head repository: hapijs/joi
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v17.13.7
Choose a head ref
  • 14 commits
  • 11 files changed
  • 2 contributors

Commits on Jun 12, 2026

  1. chore: backport #3113 to v17

    Marsup committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    97bd51d View commit details
    Browse the repository at this point in the history
  2. Merge pull request #3123 from hapijs/chore/backport-3113

    chore: backport #3113 to v17
    Marsup authored Jun 12, 2026
    Configuration menu
    Copy the full SHA
    4bcdf36 View commit details
    Browse the repository at this point in the history
  3. 17.13.4

    Marsup committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    3d3ab76 View commit details
    Browse the repository at this point in the history

Commits on Aug 19, 2026

  1. chore: deny prototype pollution in objects by restoring prototype

    (cherry picked from commit fe41c4f)
    Marsup committed Aug 19, 2026
    Configuration menu
    Copy the full SHA
    30766a2 View commit details
    Browse the repository at this point in the history
  2. fix: prevent proto on renames

    (cherry picked from commit 162f367)
    Marsup committed Aug 19, 2026
    Configuration menu
    Copy the full SHA
    172ecec View commit details
    Browse the repository at this point in the history
  3. Merge pull request #3135 from hapijs/chore/backport-rename-proto

    chore: backport prevent proto on renames
    Marsup authored Aug 19, 2026
    Configuration menu
    Copy the full SHA
    3f3907c View commit details
    Browse the repository at this point in the history
  4. 17.13.5

    Marsup committed Aug 19, 2026
    Configuration menu
    Copy the full SHA
    566e73f View commit details
    Browse the repository at this point in the history
  5. fix: prevent messages proto injection

    (cherry picked from commit 90d0757)
    Marsup committed Aug 19, 2026
    Configuration menu
    Copy the full SHA
    8d0b808 View commit details
    Browse the repository at this point in the history
  6. Merge pull request #3139 from hapijs/chore/backport-messages-proto

    fix: prevent messages proto injection
    Marsup authored Aug 19, 2026
    Configuration menu
    Copy the full SHA
    9faeecc View commit details
    Browse the repository at this point in the history
  7. 17.13.6

    Marsup committed Aug 19, 2026
    Configuration menu
    Copy the full SHA
    850be1e View commit details
    Browse the repository at this point in the history

Commits on Sep 2, 2026

  1. fix(isoDate): pad a bare-hour timeshift with a colon, not just zeros

    internals.isoDate() pads a bare-hour UTC timeshift (e.g. "+04") before
    handing the string to Date() by appending '00' directly, producing
    "...+0400" instead of the ISO 8601 extended-format "...+04:00". Node's
    own Date parser tolerates the malformed form, which is why this went
    unnoticed, but it breaks stricter parsers (Safari) since ISO 8601
    doesn't allow mixing basic-format offsets into an otherwise
    extended-format string.
    
    Flagged by a reviewer on #2421 (the PR that introduced this line) but
    never addressed after merge; tracked since as #2434.
    
    Also drops the leading `.*` in the trigger regex, per the same
    review thread - matching doesn't require anchoring at the string
    start, so it was redundant.
    
    Since Node's Date constructor doesn't distinguish "+0700" from
    "+07:00", a test asserting on Joi's converted output wouldn't catch
    a regression here. The new test instead spies on the Date
    constructor to assert the actual string produced.
    
    Fixes #2434.
    
    (cherry picked from commit e70df42)
    yfwmaniish authored and Marsup committed Sep 2, 2026
    Configuration menu
    Copy the full SHA
    115e7b5 View commit details
    Browse the repository at this point in the history
  2. chore: add regression test for #3143

    (cherry picked from commit cc81a74a9366452ee6c66411fb8b9f5b96d54935)
    Marsup committed Sep 2, 2026
    Configuration menu
    Copy the full SHA
    c43fc96 View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    f2729f7 View commit details
    Browse the repository at this point in the history
  4. 17.13.7

    Marsup committed Sep 2, 2026
    Configuration menu
    Copy the full SHA
    ed9d7cd View commit details
    Browse the repository at this point in the history
Loading