What's Changed

• feat: add :pid token by @ganesh3367 in #329

Security Fix:

• Escape control characters in :remote-user token to prevent log injection
  • Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

New Contributors

• @inigomarquinez made their first contribution in #291
• @jonchurch made their first contribution in #299
• @bjohansebas made their first contribution in #301
• @UlisesGascon made their first contribution in #300
• @ctcpip made their first contribution in #319
• @ganesh3367 made their first contribution in #329

Full Changelog: 1.10.0...1.11.0

What's Changed

• renaming simple to sample in readme by @ryhinchey in #237
• adding installation instructions to readme by @ryhinchey in #233
• chore: add support for OSSF scorecard reporting by @inigomarquinez in #291
• ci: replace travis with github actions by @inigomarquinez in #290
• docs: add example output for log formats by @jonchurch in #299
• ci: use ubuntu-latest by @bjohansebas in #301
• ci: apply OSSF Scorecard security best practices by @UlisesGascon in #300
• remove --bail by @jonchurch in #314
• ⬆️ bump on-headers by @ctcpip in #319

New Contributors

• @inigomarquinez made their first contribution in #291
• @jonchurch made their first contribution in #299
• @bjohansebas made their first contribution in #301
• @UlisesGascon made their first contribution in #300
• @ctcpip made their first contribution in #319

Full Changelog: 1.10.0...1.10.1

• Add :total-time token
• Fix trailing space in colored status code for dev format
• deps: basic-auth@~2.0.1
  • deps: safe-buffer@5.1.2
• deps: depd@~2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: on-headers@~1.0.2
  • Fix res.writeHead patch missing return value

• Fix using special characters in format
• deps: depd@~1.1.2
  • perf: remove argument reassignment

• Use res.headersSent when available
• deps: basic-auth@~2.0.0
  • Use safe-buffer for improved Buffer API
• deps: debug@2.6.9
• deps: depd@~1.1.1
  • Remove unnecessary Buffer loading

• deps: debug@2.6.8
  • Fix DEBUG_MAX_ARRAY_LENGTH
  • deps: ms@2.0.0

• deps: debug@2.6.1
  • Fix deprecation messages in WebStorm and other editors
  • Undeprecate DEBUG_FD set to 1 or 2

• Fix sending unnecessary undefined argument to token functions
• deps: basic-auth@~1.1.0
• deps: debug@2.6.0
  • Allow colors in workers
  • Deprecated DEBUG_FD environment variable
  • Fix error when running under React Native
  • Use same color for same namespace
  • deps: ms@0.7.2
• perf: enable strict mode in compiled functions

• Add digits argument to response-time token
• deps: depd@~1.1.0
  • Enable strict mode in more places
  • Support web browser loading
• deps: on-headers@~1.0.1
  • perf: enable strict mode

• deps: basic-auth@~1.0.3