new release

Author: remorses

spiceflow/CHANGELOG.md

@@ -1,5 +1,11 @@
 # spiceflow
 
+## 1.17.10
+
+### Patch Changes
+
+- Fix CORS middleware immutable headers error in Cloudflare Workers by properly handling Vary header updates on response headers instead of attempting to modify request headers
+
 ## 1.17.9
 
 ### Patch Changes

spiceflow/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spiceflow",
-  "version": "1.17.9",
+  "version": "1.17.10",
   "description": "Simple API framework with RPC and type safety",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

spiceflow/src/cors.ts

@@ -63,10 +63,10 @@ export const cors = (options?: CORSOptions): MiddlewareHandler => {
     // Suppose the server sends a response with an Access-Control-Allow-Origin value with an explicit origin (rather than the "*" wildcard).
     // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
     if (opts.origin !== '*') {
-      const existingVary = c.request.headers.get('Vary')
+      const existingVary = responseHeaders.get('Vary')
 
       if (existingVary) {
-        set('Vary', existingVary)
+        set('Vary', `${existingVary}, Origin`)
       } else {
         set('Vary', 'Origin')
       }
@@ -113,7 +113,12 @@ export const cors = (options?: CORSOptions): MiddlewareHandler => {
       }
       if (headers?.length) {
         set('Access-Control-Allow-Headers', headers.join(','))
-        c.request.headers.append('Vary', 'Access-Control-Request-Headers')
+        const existingVary = responseHeaders.get('Vary')
+        if (existingVary) {
+          set('Vary', `${existingVary}, Access-Control-Request-Headers`)
+        } else {
+          set('Vary', 'Access-Control-Request-Headers')
+        }
       }
 
       responseHeaders.delete('Content-Length')