Koa 3.3.0 Released With HttpError Improvements and Security Fixes

Koa 3.3.0 is out, published by maintainer Jeff Wainwright as the latest release on the koajs/koa repository.

The update adds one feature: re-exporting http-errors utilities directly from Koa. A related patch makes errors thrown by ctx.assert instances of HttpError, alongside three fixes targeting HttpError instanceof checks to preserve prototype-based checks and subclass instance checks.

Request and response handling received several bug fixes. request.URL now parses absolute-form request targets, request.protocol lowercases the X-Forwarded-Proto header, and request.host parses IPv6 hostnames. Query parameter assignment preserves boolean values, and query parsing prevents prototype mutation to close a path for prototype pollution through crafted input. Responses now reject multiple values for singleton response headers, keep a Blob's own content type instead of forcing octet-stream, and include a response content-type fix with a test case.

CI now tests Node.js versions 22 through 26. Dependabot updates GitHub Actions, while dependency bumps cover actions/checkout and actions/setup-node to version 6, codecov/codecov-action to 7, type-is to 2.1.0, c8 to 11.0.0, supertest to 7.2.2, plus updates to minimatch and flatted.

Documentation updates fix an app.currentContext example, improve JSDoc parameter descriptions for the Application constructor, and update a request.hostname link. Ten contributors made their first contribution in this version.