mastercontroller 1.3.25 → 1.3.27

package/MasterControl.js

@@ -146,25 +146,10 @@ class MasterControl {
         // Only freeze in production to allow for easier debugging in development
         const isProduction = process.env.NODE_ENV === 'production';
 
-        if (isProduction) {
-            // Freeze prototypes to prevent prototype pollution attacks
-            try {
-                Object.freeze(Object.prototype);
-                Object.freeze(Array.prototype);
-                Object.freeze(Function.prototype);
-
-                logger.info({
-                    code: 'MC_SECURITY_PROTOTYPE_FROZEN',
-                    message: 'Prototypes frozen in production mode for security'
-                });
-            } catch (err) {
-                logger.warn({
-                    code: 'MC_SECURITY_FREEZE_FAILED',
-                    message: 'Failed to freeze prototypes',
-                    error: err.message
-                });
-            }
-        }
+        // NOTE: Prototype freezing was removed. Freezing Object.prototype/Array.prototype/
+        // Function.prototype breaks third-party libraries (e.g., long, mysql2) that define
+        // properties on their prototypes after framework init. Prototype pollution protection
+        // is handled via input validation in MasterValidator.js instead.
 
         // Add prototype pollution detection utility
         this._detectPrototypePollution = (obj) => {

package/MasterRouter.js

@@ -37,7 +37,9 @@ const HTTP_METHODS = {
     GET: 'get',
     POST: 'post',
     PUT: 'put',
+    PATCH: 'patch',
     DELETE: 'delete',
+    HEAD: 'head',
     OPTIONS: 'options'
 };
 
@@ -239,7 +241,10 @@ const ROUTER_CONFIG = {
                         const pathObj = normalizePaths(requestObject.pathName, route.path, testParams);
 
                         // if we find the route that matches the request
-                        if(pathObj.requestPath === pathObj.routePath && route.type === requestObject.type){
+                        // HEAD requests match GET routes per HTTP spec (RFC 9110 §9.3.2)
+                        const methodMatches = route.type === requestObject.type
+                            || (requestObject.type === HTTP_METHODS.HEAD && route.type === HTTP_METHODS.GET);
+                        if(pathObj.requestPath === pathObj.routePath && methodMatches){
                             // Only commit the extracted params if this route actually matches
                             requestObject.params = testParams;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mastercontroller",
-  "version": "1.3.25",
+  "version": "1.3.27",
   "description": "Fortune 500 ready Node.js MVC framework with enterprise security, monitoring, and horizontal scaling",
   "main": "MasterControl.js",
   "license": "MIT",