From 2e11039f4a5e15bfaa2c136c1ed47b7ae0b466db Mon Sep 17 00:00:00 2001 From: Chris Portscheller Date: Sat, 26 Sep 2026 22:30:36 -0500 Subject: [PATCH 1/2] chore(release): 0.18.0 Co-Authored-By: Claude --- CHANGELOG.md | 2 ++ package-lock.json | 20 ++++++++++---------- packages/client/package.json | 2 +- packages/express/package.json | 4 ++-- packages/fastify/package.json | 4 ++-- packages/hono/package.json | 4 ++-- packages/nextjs/package.json | 4 ++-- packages/webdecoy/package.json | 2 +- 8 files changed, 22 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6d6dc7d..87556db 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.18.0] - 2026-09-27 + ### Added - **`trustProxy: 'railway'`.** Railway's edge replaces any `X-Forwarded-For` the client sent with exactly `, `, so the visitor is two entries from the right. A depth of `1`, and the Next.js and Hono default, names Railway's edge for every visitor instead. `'railway'` is the same answer as a depth of `2`, under a name you do not have to work out. Works in every adapter. diff --git a/package-lock.json b/package-lock.json index 5d1a8fe..2ee6e1a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10407,7 +10407,7 @@ }, "packages/client": { "name": "@webdecoy/client", - "version": "0.17.0", + "version": "0.18.0", "license": "MIT", "devDependencies": { "@types/jest": "^29.5.11", @@ -10424,10 +10424,10 @@ }, "packages/express": { "name": "@webdecoy/express", - "version": "0.17.0", + "version": "0.18.0", "license": "MIT", "dependencies": { - "@webdecoy/node": "^0.17.0" + "@webdecoy/node": "^0.18.0" }, "devDependencies": { "@types/express": "^4.17.21", @@ -10448,10 +10448,10 @@ }, "packages/fastify": { "name": "@webdecoy/fastify", - "version": "0.17.0", + "version": "0.18.0", "license": "MIT", "dependencies": { - "@webdecoy/node": "^0.17.0", + "@webdecoy/node": "^0.18.0", "fastify-plugin": "^4.5.1" }, "devDependencies": { @@ -10472,10 +10472,10 @@ }, "packages/hono": { "name": "@webdecoy/hono", - "version": "0.17.0", + "version": "0.18.0", "license": "MIT", "dependencies": { - "@webdecoy/node": "^0.17.0" + "@webdecoy/node": "^0.18.0" }, "devDependencies": { "@types/jest": "^29.5.11", @@ -10495,10 +10495,10 @@ }, "packages/nextjs": { "name": "@webdecoy/nextjs", - "version": "0.17.0", + "version": "0.18.0", "license": "MIT", "dependencies": { - "@webdecoy/node": "^0.17.0" + "@webdecoy/node": "^0.18.0" }, "devDependencies": { "@types/jest": "^29.5.11", @@ -10518,7 +10518,7 @@ }, "packages/webdecoy": { "name": "@webdecoy/node", - "version": "0.17.0", + "version": "0.18.0", "license": "MIT", "devDependencies": { "@types/jest": "^29.5.11", diff --git a/packages/client/package.json b/packages/client/package.json index e7e3512..00b4355 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/client", - "version": "0.17.0", + "version": "0.18.0", "description": "Web Decoy browser widget - signal collection, proof-of-work, and captcha UI", "main": "./dist/index.js", "module": "./dist/index.mjs", diff --git a/packages/express/package.json b/packages/express/package.json index 8386365..2a30158 100644 --- a/packages/express/package.json +++ b/packages/express/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/express", - "version": "0.17.0", + "version": "0.18.0", "description": "Web Decoy middleware for Express.js", "main": "./dist/index.js", "types": "./dist/index.d.ts", @@ -40,7 +40,7 @@ "url": "https://github.com/WebDecoy/node/issues" }, "dependencies": { - "@webdecoy/node": "^0.17.0" + "@webdecoy/node": "^0.18.0" }, "peerDependencies": { "express": "^4.18.0 || ^5.0.0" diff --git a/packages/fastify/package.json b/packages/fastify/package.json index 37f19de..779ab88 100644 --- a/packages/fastify/package.json +++ b/packages/fastify/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/fastify", - "version": "0.17.0", + "version": "0.18.0", "description": "Web Decoy plugin for Fastify", "main": "./dist/index.js", "types": "./dist/index.d.ts", @@ -40,7 +40,7 @@ "url": "https://github.com/WebDecoy/node/issues" }, "dependencies": { - "@webdecoy/node": "^0.17.0", + "@webdecoy/node": "^0.18.0", "fastify-plugin": "^4.5.1" }, "peerDependencies": { diff --git a/packages/hono/package.json b/packages/hono/package.json index 3acce58..a84a581 100644 --- a/packages/hono/package.json +++ b/packages/hono/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/hono", - "version": "0.17.0", + "version": "0.18.0", "description": "Web Decoy middleware for Hono — Cloudflare Workers, Bun, Deno, Node", "main": "./dist/index.js", "types": "./dist/index.d.ts", @@ -44,7 +44,7 @@ "url": "https://github.com/WebDecoy/node/issues" }, "dependencies": { - "@webdecoy/node": "^0.17.0" + "@webdecoy/node": "^0.18.0" }, "peerDependencies": { "hono": "^4.0.0" diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json index 677333b..4e35a5b 100644 --- a/packages/nextjs/package.json +++ b/packages/nextjs/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/nextjs", - "version": "0.17.0", + "version": "0.18.0", "description": "Web Decoy middleware for Next.js", "main": "./dist/index.js", "types": "./dist/index.d.ts", @@ -42,7 +42,7 @@ "url": "https://github.com/WebDecoy/node/issues" }, "dependencies": { - "@webdecoy/node": "^0.17.0" + "@webdecoy/node": "^0.18.0" }, "peerDependencies": { "next": ">=13.0.0" diff --git a/packages/webdecoy/package.json b/packages/webdecoy/package.json index 1f1582d..8669755 100644 --- a/packages/webdecoy/package.json +++ b/packages/webdecoy/package.json @@ -1,6 +1,6 @@ { "name": "@webdecoy/node", - "version": "0.17.0", + "version": "0.18.0", "description": "Web Decoy SDK for Node.js - Bot detection with TLS fingerprinting", "main": "./dist/index.js", "types": "./dist/index.d.ts", From d453ed63a11496a439d792ed7f7fa6b111ba649a Mon Sep 17 00:00:00 2001 From: Chris Portscheller Date: Sat, 26 Sep 2026 22:31:59 -0500 Subject: [PATCH 2/2] docs: the Fastify fail-closed change is 5.12.1, not 5.12.0 Co-Authored-By: Claude --- CHANGELOG.md | 2 +- packages/fastify/src/plugin.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 87556db..46cca95 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,7 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed -- **Fastify: pass the hop count to the plugin, not to Fastify.** Since Fastify 5.12 a numeric server `trustProxy` trusts no hop at all, so `request.ip` stays the socket address. The plugin's own `trustProxy` is unaffected; its documentation now says so. +- **Fastify: pass the hop count to the plugin, not to Fastify.** Since Fastify 5.12.1 a numeric server `trustProxy` trusts no hop at all, so `request.ip` stays the socket address. The plugin's own `trustProxy` is unaffected; its documentation now says so. ## [0.17.0] - 2026-09-24 diff --git a/packages/fastify/src/plugin.ts b/packages/fastify/src/plugin.ts index 556e926..9ab85e2 100644 --- a/packages/fastify/src/plugin.ts +++ b/packages/fastify/src/plugin.ts @@ -65,7 +65,7 @@ export interface WebDecoyPluginOptions extends ProtectOptions { * it to override that for WebDecoy alone — a number of trusted hops, * `'cloudflare'`, `'railway'`, or CIDRs of your proxies. * - * Prefer this over Fastify's own option for a hop count: since Fastify 5.12 a + * Prefer this over Fastify's own option for a hop count: since Fastify 5.12.1 a * numeric server `trustProxy` trusts no hop at all (a count cannot tell a * proxy from a direct client), so `request.ip` stays the socket address. *