@void/edge 1.1.11 → 1.1.12

package/dist/index.d.mts

@@ -188,10 +188,9 @@ type ResolvedAsset = Readonly<{
   spa?: boolean;
 }>;
 /**
- * Percent-decode a request pathname for a manifest lookup, honoring ONLY the
- * encodings a conformant URL is required to use. Returns the raw value
- * unchanged on a malformed sequence (e.g. a lone `%`) or on any non-canonical /
- * over-encoded spelling.
+ * Percent-decode a request pathname for a manifest lookup, honoring required
+ * URL encodings and encoded square brackets. Returns the raw value unchanged
+ * on a malformed sequence (e.g. a lone `%`) or other over-encoded spellings.
  *
  * Request pathnames arrive percent-encoded — WHATWG `URL.pathname` never
  * decodes — but manifest keys are the asset's decoded on-disk path (a file
@@ -199,8 +198,10 @@ type ResolvedAsset = Readonly<{
  * `%20`). Callers try the raw key first, then this decoded form.
  *
  * The decoded form is accepted only when re-encoding it reproduces the request
- * path (up to percent-escape letter case) — i.e. the only encoded bytes were
- * characters a URL MUST encode (space, `#`, non-ASCII, …). This rejects
+ * path (up to percent-escape letter case and square-bracket encoding). Next.js
+ * encodes brackets in dynamic-page chunk URLs even though URL.pathname leaves
+ * them literal. Other accepted escapes are characters a URL MUST encode
+ * (space, `#`, non-ASCII, …). This rejects
  * over-encoded spellings of ordinary path text (`%2F`→`/`, `%61`→`a`, `%5F`→`_`,
  * `%2e%2e`→`..`), which a browser would never send and which would otherwise let
  * a request reconstruct a guarded path (`/assets%2Fx`, `/%61ssets/x`,

package/dist/index.mjs

@@ -602,10 +602,9 @@ function rewriteRequest(request, url, originalUrl) {
 //#endregion
 //#region src/static.ts
 /**
-* Percent-decode a request pathname for a manifest lookup, honoring ONLY the
-* encodings a conformant URL is required to use. Returns the raw value
-* unchanged on a malformed sequence (e.g. a lone `%`) or on any non-canonical /
-* over-encoded spelling.
+* Percent-decode a request pathname for a manifest lookup, honoring required
+* URL encodings and encoded square brackets. Returns the raw value unchanged
+* on a malformed sequence (e.g. a lone `%`) or other over-encoded spellings.
 *
 * Request pathnames arrive percent-encoded — WHATWG `URL.pathname` never
 * decodes — but manifest keys are the asset's decoded on-disk path (a file
@@ -613,8 +612,10 @@ function rewriteRequest(request, url, originalUrl) {
 * `%20`). Callers try the raw key first, then this decoded form.
 *
 * The decoded form is accepted only when re-encoding it reproduces the request
-* path (up to percent-escape letter case) — i.e. the only encoded bytes were
-* characters a URL MUST encode (space, `#`, non-ASCII, …). This rejects
+* path (up to percent-escape letter case and square-bracket encoding). Next.js
+* encodes brackets in dynamic-page chunk URLs even though URL.pathname leaves
+* them literal. Other accepted escapes are characters a URL MUST encode
+* (space, `#`, non-ASCII, …). This rejects
 * over-encoded spellings of ordinary path text (`%2F`→`/`, `%61`→`a`, `%5F`→`_`,
 * `%2e%2e`→`..`), which a browser would never send and which would otherwise let
 * a request reconstruct a guarded path (`/assets%2Fx`, `/%61ssets/x`,
@@ -638,7 +639,8 @@ function safeDecodePathname(pathname) {
 	if (decoded === pathname) return pathname;
 	const canonical = reencodePathname(decoded);
 	if (canonical === null) return pathname;
-	return normalizePercentCase(canonical) === normalizePercentCase(pathname) ? decoded : pathname;
+	const normalized = normalizePercentCase(pathname).replace(/%5B/g, "[").replace(/%5D/g, "]");
+	return normalizePercentCase(canonical) === normalized ? decoded : pathname;
 }
 /** Uppercase the hex digits of every `%xx` escape so encodings compare equal
 * regardless of the letter case a client used. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/edge",
-  "version": "1.1.11",
+  "version": "1.1.12",
   "description": "Routing, headers, and static asset helpers for Void runtimes.",
   "homepage": "https://void.cloud",
   "bugs": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "1.1.11"
+    "@void/deploy-core": "1.1.12"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20261014.1",