@absolutejs/absolute 0.20.0-beta.149 → 0.20.0-beta.150

package/CHANGELOG.md

@@ -6,6 +6,12 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.20.0-beta.150 — 2026-10-24
+
+### Fixed
+
+- **Reject malformed encoded static paths with HTTP 400 and serve encoded asset filenames consistently.**
+
 ## 0.20.0-beta.149 — 2026-10-24
 
 ### Fixed

package/changelog.json

@@ -2,6 +2,16 @@
 	"contract": 1,
 	"name": "@absolutejs/absolute",
 	"releases": [
+		{
+			"changes": [
+				{
+					"kind": "fixed",
+					"summary": "Reject malformed encoded static paths with HTTP 400 and serve encoded asset filenames consistently."
+				}
+			],
+			"date": "2026-10-24",
+			"version": "0.20.0-beta.150"
+		},
 		{
 			"changes": [
 				{

package/dist/angular/components/core/streamingSlotRegistrar.js

@@ -1,5 +1,5 @@
 // @bun
-// .angular-partial-tmp-sgg6Qh/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-nF5Xvc/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");

package/dist/angular/components/core/streamingSlotRegistry.js

@@ -1,5 +1,5 @@
 // @bun
-// .angular-partial-tmp-sgg6Qh/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-nF5Xvc/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");
@@ -46,7 +46,7 @@ var warnMissingStreamingSlotCollector = (primitiveName) => {
   getWarningController()?.maybeWarn(primitiveName);
 };
 
-// .angular-partial-tmp-sgg6Qh/src/core/streamingSlotRegistry.ts
+// .angular-partial-tmp-nF5Xvc/src/core/streamingSlotRegistry.ts
 var STREAMING_SLOT_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotAsyncLocalStorage");
 var isObjectRecord2 = (value) => Boolean(value) && typeof value === "object";
 var isAsyncLocalStorage = (value) => isObjectRecord2(value) && ("getStore" in value) && typeof value.getStore === "function" && ("run" in value) && typeof value.run === "function";

package/dist/build.js

@@ -14136,14 +14136,20 @@ var COMPRESSIBLE_EXTENSIONS, MIN_COMPRESSIBLE_BYTES = 1024, MIN_SAVING_RATIO = 0
     if (request.method !== "GET" && request.method !== "HEAD")
       return;
     const { pathname } = new URL(request.url);
-    const available = copies.get(decodeURIComponent(pathname));
+    let decodedPathname;
+    try {
+      decodedPathname = decodeURIComponent(pathname);
+    } catch {
+      return new Response("Malformed URL path", { status: 400 });
+    }
+    const available = copies.get(decodedPathname);
     if (!available)
       return;
     const chosen = acceptedEncodings(request.headers.get("accept-encoding")).find(({ encoding }) => available.has(encoding));
     if (!chosen)
       return;
-    const original = Bun.file(join30(root, pathname));
-    return new Response(Bun.file(`${join30(root, pathname)}${chosen.suffix}`), {
+    const original = Bun.file(join30(root, decodedPathname));
+    return new Response(Bun.file(`${join30(root, decodedPathname)}${chosen.suffix}`), {
       headers: {
         "cache-control": assetCacheControl(pathname),
         "content-encoding": chosen.encoding,
@@ -37863,5 +37869,5 @@ export {
   devBuild
 };
 
-//# debugId=AA60B6F5F10DA90864756E2164756E21
+//# debugId=938280719BA28ADC64756E2164756E21
 //# sourceMappingURL=build.js.map