chore(release): 0.18.0

CHANGELOG.md

@@ -7,13 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.0] - 2026-09-27
+
 ### Added
 
 - **`trustProxy: 'railway'`.** Railway's edge replaces any `X-Forwarded-For` the client sent with exactly `<client>, <edge>`, so the visitor is two entries from the right. A depth of `1`, and the Next.js and Hono default, names Railway's edge for every visitor instead. `'railway'` is the same answer as a depth of `2`, under a name you do not have to work out. Works in every adapter.
 
 ### Changed
 
-- **Fastify: pass the hop count to the plugin, not to Fastify.** Since Fastify 5.12 a numeric server `trustProxy` trusts no hop at all, so `request.ip` stays the socket address. The plugin's own `trustProxy` is unaffected; its documentation now says so.
+- **Fastify: pass the hop count to the plugin, not to Fastify.** Since Fastify 5.12.1 a numeric server `trustProxy` trusts no hop at all, so `request.ip` stays the socket address. The plugin's own `trustProxy` is unaffected; its documentation now says so.
 
 ## [0.17.0] - 2026-09-24
 

packages/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/client",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Web Decoy browser widget - signal collection, proof-of-work, and captcha UI",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",

packages/express/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/express",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Web Decoy middleware for Express.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -40,7 +40,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.17.0"
+    "@webdecoy/node": "^0.18.0"
   },
   "peerDependencies": {
     "express": "^4.18.0 || ^5.0.0"

packages/fastify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fastify",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Web Decoy plugin for Fastify",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -40,7 +40,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.17.0",
+    "@webdecoy/node": "^0.18.0",
     "fastify-plugin": "^4.5.1"
   },
   "peerDependencies": {

packages/fastify/src/plugin.ts

@@ -65,7 +65,7 @@ export interface WebDecoyPluginOptions extends ProtectOptions {
    * it to override that for WebDecoy alone — a number of trusted hops,
    * `'cloudflare'`, `'railway'`, or CIDRs of your proxies.
    *
-   * Prefer this over Fastify's own option for a hop count: since Fastify 5.12 a
+   * Prefer this over Fastify's own option for a hop count: since Fastify 5.12.1 a
    * numeric server `trustProxy` trusts no hop at all (a count cannot tell a
    * proxy from a direct client), so `request.ip` stays the socket address.
    *

packages/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/hono",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Web Decoy middleware for Hono — Cloudflare Workers, Bun, Deno, Node",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -44,7 +44,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.17.0"
+    "@webdecoy/node": "^0.18.0"
   },
   "peerDependencies": {
     "hono": "^4.0.0"

packages/nextjs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/nextjs",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Web Decoy middleware for Next.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -42,7 +42,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.17.0"
+    "@webdecoy/node": "^0.18.0"
   },
   "peerDependencies": {
     "next": ">=13.0.0"

packages/webdecoy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/node",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Web Decoy SDK for Node.js - Bot detection with TLS fingerprinting",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",