koa 3.1.0 → 3.1.2

package/lib/request.js

@@ -256,7 +256,17 @@ module.exports = {
       if (!host) host = this.get('Host')
     }
     if (!host) return ''
-    return splitCommaSeparatedValues(host, 1)[0]
+    host = splitCommaSeparatedValues(host, 1)[0]
+    // Host header may contain userinfo (e.g., "user@host") which is invalid per RFC 7230.
+    // Use URL parser to correctly extract the host portion.
+    if (host.includes('@')) {
+      try {
+        host = new URL(`http://${host}`).host
+      } catch (e) {
+        return ''
+      }
+    }
+    return host
   },
 
   /**

package/lib/response.js

@@ -139,7 +139,10 @@ module.exports = {
     const cleanupPreviousStream = () => {
       if (original && isStream(original)) {
         original.once('error', () => {})
-        destroy(original)
+        // Only destroy if the new value is not a stream
+        if (!isStream(val)) {
+          destroy(original)
+        }
       }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "koa",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "description": "Koa web app framework",
   "main": "lib/application.js",
   "exports": {
@@ -37,7 +37,7 @@
   "license": "MIT",
   "dependencies": {
     "accepts": "^1.3.8",
-    "content-disposition": "~0.5.4",
+    "content-disposition": "~1.0.1",
     "content-type": "^1.0.5",
     "cookies": "~0.9.1",
     "delegates": "^1.0.0",