Changelog

[1.2.0] 2026-08-17 Security (1)

.. and . segments are now resolved instead of being passed through (src/index.ts). The function’s whole job is to build a path from segments that frequently come from route params, locale codes or API values — and it previously treated .. as an ordinary segment, so concatRoute("/api/users", id) with an id of ../../admin produced /admin. Every consumer that feeds the result to a router or an HTTP client inherited that: the path escaped the prefix it was supposed to be confined to, taking any prefix-based authorization with it. Dot-segments are now collapsed, and .. beyond the root is dropped rather than climbing above it, so the result always stays at or below /.

Behaviour change: paths that contained literal dot-segments are now normalized. concatRoute("/a/b", "../c") returns /a/c (was /a/b/../c) and concatRoute("/a", "..", "..", "b") returns /b (was /a/../../b). Single . segments are dropped. Normal segments are untouched.

[1.1.4] 2026-05-26 Added (5)

README rewrite. Marketing-style index with install, 30-second tour, full API surface, normalization rules, edge cases (query strings, hash fragments, absolute URLs), and links to sibling packages.
AI kit. llms.txt, llms-full.txt, and skills/ folder (README, overview, concat-route, recipes) for tool-assisted development.
Test suite. Vitest tests covering empty input, root segments, falsy filtering, leading/trailing slash stripping, multi-slash collapse, embedded slashes, query strings, hash fragments, and known-quirk cases (skipped).
CI. GitHub Actions workflow: Node 18/20/22 × Ubuntu, plus Node 20 × Windows.
Package metadata. keywords, sideEffects: false, and test/test:watch scripts. vitest and typescript added as devDependencies.

<count emitted by `yarn test` — see CI for the canonical number>