Summary

This major version contains a single breaking change, disabling by default the HTML escaping of error messages.

• Upgrade time: moderate to none
• Complexity: low
• Risk: moderate

⚠️ Breaking changes

Optional HTML escaping

Previously, joi escaped the parts of the error messages where an attacker could maliciously inject some HTML code to try and trick the receiver of the error message.

This was especially important as joi was mostly used in an hapi context, and making hapi a vector of attack was not an option.

Now joi is being used in more contexts where people only want plain text, or already have strategies to protect themselves against such an attack, so it makes sense to make it optional by default, with an option (escapeHtml) to get the old behavior for those who want it.

The migration depends on whether or not you want to keep the old security feature and on which platform you use joi on :

• Standalone should not be affected by this as you probably expect plain text.
• Servers are not directly impacted by this change as they are a mere vector for this attack, but you should carefully evaluate whether your client code is protected against those.
• Browsers always saw HTML entities anyway, so I don't expect an impact there. But the recent difficulty to bundle joi with webpack should be alleviated by this.

✨ New features

None.

👥 Contributors

The contributors to this release are : myself.