This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+11 more
Summary
AI summaryFixed API requests to unknown /api/* endpoints now return JSON 404 for all HTTP verbs.
Full changelog
[1.59.5] — 2026-05-20
fix(api): NEW-F1 (v1.59.5) — unknown /api/* returns JSON 404 on every verb. Pre-fix app.get("/api/*", …) was GET-only; POST / PUT / DELETE to an unknown api path fell through to the SPA catch-all and returned an HTML 404, breaking SPA clients that do try { res.json() } catch {}. Changed to app.all("/api/*", …) in server/index.mjs. New test suite tests/api-404-json.test.mjs probes GET / POST / PUT / DELETE on /api/no-such-endpoint plus an unknown :name under a real handler — 5 new tests, all green. 964 → 969 unit. (NEW-F1)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Career Ops UI
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]