@depup/express-slow-down 3.1.0-depup.0

package/README.md

@@ -0,0 +1,31 @@
+# @depup/express-slow-down
+
+> Dependency-bumped version of [express-slow-down](https://www.npmjs.com/package/express-slow-down)
+
+Generated by [DepUp](https://github.com/depup/npm) -- all production
+dependencies bumped to latest versions.
+
+## Installation
+
+```bash
+npm install @depup/express-slow-down
+```
+
+| Field | Value |
+|-------|-------|
+| Original | [express-slow-down](https://www.npmjs.com/package/express-slow-down) @ 3.1.0 |
+| Processed | 2026-03-19 |
+| Smoke test | passed |
+| Deps updated | 1 |
+
+## Dependency Changes
+
+| Dependency | From | To |
+|------------|------|-----|
+| express-rate-limit | 8 | ^8.3.1 |
+
+---
+
+Source: https://github.com/depup/npm | Original: https://www.npmjs.com/package/express-slow-down
+
+License inherited from the original package.

package/changelog.md

@@ -0,0 +1,84 @@
+# express-slow-down changelog
+
+## v3.1.0
+
+### Added
+
+- `legacyHeaders` and `standardHeaders` options can now be passed through to
+  express-rate-limit
+
+## v3.0.1
+
+### Fixed
+
+- Only pass supported options to express-rate-limit to avoid triggering warning
+  added for unexpected options in ERL v8.2.0
+
+## v3.0.0
+
+### Added
+
+- Added support for grouping IPv6 addresses by subnet (defaults to /56) via
+  upgrading express-rate-limit dependency to 8.x
+
+## v2.1.0
+
+### Fixed
+
+- Changed distributed JS to no longer bundle in `express-rate-limit`, instead
+  using the version installed via npm. This enables several new
+  express-rate-limit features that have been released since v7.0.1.
+
+## v2.0.3
+
+### Fixed
+
+- Fixed `peerDependencies` compatibility with express 5 beta.
+
+## v2.0.2
+
+### Fixed
+
+- Allowed `express-slow-down` to be used with `express` v5.
+
+## v2.0.1
+
+### Fixed
+
+- Fixed an incorrect `WRN_ERL_MAX_ZERO` warning when supplying a custom
+  validation object in the config.
+
+## v2.0.0
+
+express-slow-down v2 is built on top of express-rate-limit v7.
+
+### Breaking
+
+- Changed behavior of `delayMs` when set to a number
+  - Previous behavior multiplied `delayMs` value by the number of slowed
+    requests to determine the delay amount
+  - New behavior treats a numeric value as a fixed delay that is applied to each
+    slowed request without multiplication
+  - Set to `function(used) { return (used - this.delayAfter) * 1000; }` to
+    restore old behavior. (Change `1000` to match old value if necessary.)
+- Changed arguments passed to `delayMs` when set to a function
+  - Previous signature was `function(req, res): number`
+  - New signature is `function(used, req, res): number | Promise<number>` where
+    `used` is the number of hits from this user during the current window
+- Dropped support for `onLimitReached` method
+- Dropped support for `headers` option
+- Renamed `req.slowDown.current` to `req.slowDown.used`
+  - `current` is now a hidden getter that will return the `used` value, but will
+    not be included when iteration over keys or running through
+    `JSON.stringify()`
+
+### Added
+
+- `delayAfter`, `delayMs`, and `maxDelayMs` may now be async functions that
+  return a number or a promise that resolves to a number
+- The MemoryStore now uses precise, per-user reset times rather than a global
+  window that resets all users at once.
+- Now using express-rate-limit's validator to detect and warn about common
+  misconfigurations. See
+  https://github.com/express-rate-limit/express-rate-limit/wiki/Error-Codes for
+  more info.

package/changes.json

@@ -0,0 +1,10 @@
+{
+  "bumped": {
+    "express-rate-limit": {
+      "from": "8",
+      "to": "^8.3.1"
+    }
+  },
+  "timestamp": "2026-03-19T03:03:47.222Z",
+  "totalUpdated": 1
+}

package/dist/index.cjs

@@ -0,0 +1,127 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// source/index.ts
+var index_exports = {};
+__export(index_exports, {
+  default: () => slow_down_default,
+  slowDown: () => slowDown
+});
+module.exports = __toCommonJS(index_exports);
+
+// source/slow-down.ts
+var import_express_rate_limit = require("express-rate-limit");
+var filterUndefinedOptions = (passedOptions) => {
+  const filteredOptions = {};
+  for (const k of Object.keys(passedOptions)) {
+    const key = k;
+    if (passedOptions[key] !== void 0) {
+      filteredOptions[key] = passedOptions[key];
+    }
+  }
+  return filteredOptions;
+};
+var ExpressSlowDownWarning = class extends Error {
+  constructor(code, message) {
+    const url = `https://express-rate-limit.github.io/${code}/`;
+    super(`${message} See ${url} for more information.`);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.help = url;
+  }
+};
+var slowDown = (passedOptions = {}) => {
+  const notUndefinedOptions = filterUndefinedOptions(passedOptions);
+  if (notUndefinedOptions.max !== void 0 || notUndefinedOptions.limit !== void 0)
+    throw new Error(
+      "The limit/max option is not supported by express-slow-down, please use delayAfter instead."
+    );
+  const validate = typeof notUndefinedOptions.validate === "boolean" ? { default: notUndefinedOptions.validate } : notUndefinedOptions.validate ?? { default: true };
+  if (typeof notUndefinedOptions.delayMs === "number" && // Make sure the validation check is not disabled.
+  (validate.delayMs === true || validate.delayMs === void 0 && validate.default)) {
+    const message = `The behaviour of the 'delayMs' option was changed in express-slow-down v2:
+			- For the old behavior, change the delayMs option to:
+
+			  delayMs: (used, req) => {
+				  const delayAfter = req.${notUndefinedOptions.requestPropertyName ?? "slowDown"}.limit;
+				  return (used - delayAfter) * ${notUndefinedOptions.delayMs};
+			  },
+
+			- For the new behavior, change the delayMs option to:
+
+				delayMs: () => ${notUndefinedOptions.delayMs},
+
+			Or set 'options.validate: {delayMs: false}' to disable this message.`.replace(
+      /^(\t){3}/gm,
+      ""
+    );
+    console.warn(new ExpressSlowDownWarning("WRN_ESD_DELAYMS", message));
+  }
+  delete validate?.delayMs;
+  const options = {
+    // The following settings are defaults that may be overridden by the user's options.
+    delayAfter: 1,
+    delayMs(used, request, response) {
+      const delayAfter2 = request[options.requestPropertyName].limit;
+      return (used - delayAfter2) * 1e3;
+    },
+    maxDelayMs: Number.POSITIVE_INFINITY,
+    requestPropertyName: "slowDown",
+    // Disable the headers by default, but allow users to override
+    legacyHeaders: false,
+    standardHeaders: false,
+    // Next the user's options are pulled in, overriding defaults from above
+    ...notUndefinedOptions,
+    // This is a combination of the user's validate settings and our own overrides
+    validate: {
+      ...validate,
+      limit: false
+      // We know the behavior of limit=0 changed - we depend on the new behavior!
+    },
+    // These settings cannot be overridden.
+    limit: 0,
+    // We want the handler to run on every request.
+    // The handler contains the slow-down logic, so don't allow it to be overridden.
+    async handler(_request, response, next) {
+      const delayAfter2 = typeof options.delayAfter === "function" ? await options.delayAfter(_request, response) : options.delayAfter;
+      const request = _request;
+      const info = request[options.requestPropertyName];
+      info.limit = delayAfter2;
+      info.remaining = Math.max(0, delayAfter2 - info.used);
+      let delay = 0;
+      if (info.used > delayAfter2) {
+        const unboundedDelay = typeof options.delayMs === "function" ? await options.delayMs(info.used, request, response) : options.delayMs;
+        const maxDelayMs2 = typeof options.maxDelayMs === "function" ? await options.maxDelayMs(request, response) : options.maxDelayMs;
+        delay = Math.max(0, Math.min(unboundedDelay, maxDelayMs2));
+      }
+      request[options.requestPropertyName].delay = delay;
+      if (delay <= 0) return next();
+      const timerId = setTimeout(() => next(), delay);
+      response.on("close", () => clearTimeout(timerId));
+    }
+  };
+  const { delayAfter, delayMs, maxDelayMs, ...erlOptions } = options;
+  return (0, import_express_rate_limit.rateLimit)(erlOptions);
+};
+var slow_down_default = slowDown;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  slowDown
+});
+module.exports = slowDown; module.exports.default = slowDown; module.exports.slowDown = slowDown; 

package/dist/index.d.cts

@@ -0,0 +1,112 @@
+// Generated by dts-bundle-generator v8.0.1
+
+import { Response } from 'express';
+import { AugmentedRequest as RateLimitedRequest, EnabledValidations, Options as RateLimitOptions, RateLimitInfo, RateLimitRequestHandler, ValueDeterminingMiddleware } from 'express-rate-limit';
+
+/**
+ * A modified Express request handler with the rate limit and slow down methods.
+ */
+export type SlowDownRequestHandler = RateLimitRequestHandler;
+/**
+ * Method to generate the delay to apply to the incoming request.
+ *
+ * @param used {number} - The number of requests made by the client so far.
+ * @param request {Request} - The Express request object.
+ * @param response {Response} - The Express response object.
+ *
+ * @returns {number} - The delay to apply.
+ */
+export type DelayFn = (used: number, request: AugmentedRequest, response: Response) => number | Promise<number>;
+/**
+ * Extra validation checks provided by `express-slow-down`.
+ */
+export type ExtendedValidations = EnabledValidations & {
+	delayMs?: boolean;
+};
+/**
+ * Options present in `express-rate-limit` that this package overrides.
+ */
+export type OverriddenOptions = {
+	/**
+	 * The `limit` option is set from the handler using `delayAfter`.
+	 */
+	limit: never;
+	max: never;
+	/**
+	 * The `handler` option is overridden by the library.
+	 */
+	handler: never;
+};
+export type OverridenOptions = OverriddenOptions;
+/**
+ * All the `express-slow-down` specific options.
+ */
+export type SlowDownOptions = {
+	/**
+	 * The max number of requests allowed during windowMs before the middleware
+	 * starts delaying responses.
+	 *
+	 * Can be the limit itself as a number or a (sync/async) function that accepts
+	 * the Express req and res objects and then returns a number.
+	 *
+	 * Defaults to 1.
+	 */
+	delayAfter: number | ValueDeterminingMiddleware<number>;
+	/**
+	 * The delay to apply to each request once the limit is reached.
+	 *
+	 * Can be the limit itself as a number or a (sync/async) function that accepts
+	 * the Express req and res objects and then returns a number.
+	 *
+	 * By default, it increases the delay by 1 second for every request over the limit.
+	 */
+	delayMs: number | DelayFn;
+	/**
+	 * The absolute maximum value for delayMs. After many consecutive attempts,
+	 * the delay will always be this value. This option should be used especially
+	 * when your application is running behind a load balancer or reverse proxy
+	 * that has a request timeout.
+	 *
+	 * Defaults to infinity.
+	 */
+	maxDelayMs: number | ValueDeterminingMiddleware<number>;
+	/**
+	 * Allows the developer to turn off the validation check for `delayMs` being a
+	 * function.
+	 */
+	validate: boolean | ExtendedValidations;
+};
+/**
+ * The configuration options for the middleware.
+ */
+export type Options = RateLimitOptions & OverriddenOptions & SlowDownOptions;
+/**
+ * The extended request object that includes information about the client's
+ * rate limit and delay.
+ */
+export type AugmentedRequest = RateLimitedRequest & {
+	[key: string]: SlowDownInfo;
+};
+/**
+ * The rate limit and delay related information for each client included in the
+ * Express request object.
+ */
+export type SlowDownInfo = RateLimitInfo & {
+	delay: number;
+};
+/**
+ * Create an instance of middleware that slows down responses to Express requests.
+ *
+ * @param passedOptions {Options} - Options to configure the speed limiter.
+ *
+ * @returns {SlowDownRequestHandle} - The middleware that speed-limits clients based on your configuration.
+ *
+ * @public
+ */
+export declare const slowDown: (passedOptions?: Partial<Options>) => SlowDownRequestHandler;
+
+export {
+	slowDown as default,
+};
+
+export {};

package/dist/index.d.mts

@@ -0,0 +1,112 @@
+// Generated by dts-bundle-generator v8.0.1
+
+import { Response } from 'express';
+import { AugmentedRequest as RateLimitedRequest, EnabledValidations, Options as RateLimitOptions, RateLimitInfo, RateLimitRequestHandler, ValueDeterminingMiddleware } from 'express-rate-limit';
+
+/**
+ * A modified Express request handler with the rate limit and slow down methods.
+ */
+export type SlowDownRequestHandler = RateLimitRequestHandler;
+/**
+ * Method to generate the delay to apply to the incoming request.
+ *
+ * @param used {number} - The number of requests made by the client so far.
+ * @param request {Request} - The Express request object.
+ * @param response {Response} - The Express response object.
+ *
+ * @returns {number} - The delay to apply.
+ */
+export type DelayFn = (used: number, request: AugmentedRequest, response: Response) => number | Promise<number>;
+/**
+ * Extra validation checks provided by `express-slow-down`.
+ */
+export type ExtendedValidations = EnabledValidations & {
+	delayMs?: boolean;
+};
+/**
+ * Options present in `express-rate-limit` that this package overrides.
+ */
+export type OverriddenOptions = {
+	/**
+	 * The `limit` option is set from the handler using `delayAfter`.
+	 */
+	limit: never;
+	max: never;
+	/**
+	 * The `handler` option is overridden by the library.
+	 */
+	handler: never;
+};
+export type OverridenOptions = OverriddenOptions;
+/**
+ * All the `express-slow-down` specific options.
+ */
+export type SlowDownOptions = {
+	/**
+	 * The max number of requests allowed during windowMs before the middleware
+	 * starts delaying responses.
+	 *
+	 * Can be the limit itself as a number or a (sync/async) function that accepts
+	 * the Express req and res objects and then returns a number.
+	 *
+	 * Defaults to 1.
+	 */
+	delayAfter: number | ValueDeterminingMiddleware<number>;
+	/**
+	 * The delay to apply to each request once the limit is reached.
+	 *
+	 * Can be the limit itself as a number or a (sync/async) function that accepts
+	 * the Express req and res objects and then returns a number.
+	 *
+	 * By default, it increases the delay by 1 second for every request over the limit.
+	 */
+	delayMs: number | DelayFn;
+	/**
+	 * The absolute maximum value for delayMs. After many consecutive attempts,
+	 * the delay will always be this value. This option should be used especially
+	 * when your application is running behind a load balancer or reverse proxy
+	 * that has a request timeout.
+	 *
+	 * Defaults to infinity.
+	 */
+	maxDelayMs: number | ValueDeterminingMiddleware<number>;
+	/**
+	 * Allows the developer to turn off the validation check for `delayMs` being a
+	 * function.
+	 */
+	validate: boolean | ExtendedValidations;
+};
+/**
+ * The configuration options for the middleware.
+ */
+export type Options = RateLimitOptions & OverriddenOptions & SlowDownOptions;
+/**
+ * The extended request object that includes information about the client's
+ * rate limit and delay.
+ */
+export type AugmentedRequest = RateLimitedRequest & {
+	[key: string]: SlowDownInfo;
+};
+/**
+ * The rate limit and delay related information for each client included in the
+ * Express request object.
+ */
+export type SlowDownInfo = RateLimitInfo & {
+	delay: number;
+};
+/**
+ * Create an instance of middleware that slows down responses to Express requests.
+ *
+ * @param passedOptions {Options} - Options to configure the speed limiter.
+ *
+ * @returns {SlowDownRequestHandle} - The middleware that speed-limits clients based on your configuration.
+ *
+ * @public
+ */
+export declare const slowDown: (passedOptions?: Partial<Options>) => SlowDownRequestHandler;
+
+export {
+	slowDown as default,
+};
+
+export {};

package/dist/index.d.ts

@@ -0,0 +1,112 @@
+// Generated by dts-bundle-generator v8.0.1
+
+import { Response } from 'express';
+import { AugmentedRequest as RateLimitedRequest, EnabledValidations, Options as RateLimitOptions, RateLimitInfo, RateLimitRequestHandler, ValueDeterminingMiddleware } from 'express-rate-limit';
+
+/**
+ * A modified Express request handler with the rate limit and slow down methods.
+ */
+export type SlowDownRequestHandler = RateLimitRequestHandler;
+/**
+ * Method to generate the delay to apply to the incoming request.
+ *
+ * @param used {number} - The number of requests made by the client so far.
+ * @param request {Request} - The Express request object.
+ * @param response {Response} - The Express response object.
+ *
+ * @returns {number} - The delay to apply.
+ */
+export type DelayFn = (used: number, request: AugmentedRequest, response: Response) => number | Promise<number>;
+/**
+ * Extra validation checks provided by `express-slow-down`.
+ */
+export type ExtendedValidations = EnabledValidations & {
+	delayMs?: boolean;
+};
+/**
+ * Options present in `express-rate-limit` that this package overrides.
+ */
+export type OverriddenOptions = {
+	/**
+	 * The `limit` option is set from the handler using `delayAfter`.
+	 */
+	limit: never;
+	max: never;
+	/**
+	 * The `handler` option is overridden by the library.
+	 */
+	handler: never;
+};
+export type OverridenOptions = OverriddenOptions;
+/**
+ * All the `express-slow-down` specific options.
+ */
+export type SlowDownOptions = {
+	/**
+	 * The max number of requests allowed during windowMs before the middleware
+	 * starts delaying responses.
+	 *
+	 * Can be the limit itself as a number or a (sync/async) function that accepts
+	 * the Express req and res objects and then returns a number.
+	 *
+	 * Defaults to 1.
+	 */
+	delayAfter: number | ValueDeterminingMiddleware<number>;
+	/**
+	 * The delay to apply to each request once the limit is reached.
+	 *
+	 * Can be the limit itself as a number or a (sync/async) function that accepts
+	 * the Express req and res objects and then returns a number.
+	 *
+	 * By default, it increases the delay by 1 second for every request over the limit.
+	 */
+	delayMs: number | DelayFn;
+	/**
+	 * The absolute maximum value for delayMs. After many consecutive attempts,
+	 * the delay will always be this value. This option should be used especially
+	 * when your application is running behind a load balancer or reverse proxy
+	 * that has a request timeout.
+	 *
+	 * Defaults to infinity.
+	 */
+	maxDelayMs: number | ValueDeterminingMiddleware<number>;
+	/**
+	 * Allows the developer to turn off the validation check for `delayMs` being a
+	 * function.
+	 */
+	validate: boolean | ExtendedValidations;
+};
+/**
+ * The configuration options for the middleware.
+ */
+export type Options = RateLimitOptions & OverriddenOptions & SlowDownOptions;
+/**
+ * The extended request object that includes information about the client's
+ * rate limit and delay.
+ */
+export type AugmentedRequest = RateLimitedRequest & {
+	[key: string]: SlowDownInfo;
+};
+/**
+ * The rate limit and delay related information for each client included in the
+ * Express request object.
+ */
+export type SlowDownInfo = RateLimitInfo & {
+	delay: number;
+};
+/**
+ * Create an instance of middleware that slows down responses to Express requests.
+ *
+ * @param passedOptions {Options} - Options to configure the speed limiter.
+ *
+ * @returns {SlowDownRequestHandle} - The middleware that speed-limits clients based on your configuration.
+ *
+ * @public
+ */
+export declare const slowDown: (passedOptions?: Partial<Options>) => SlowDownRequestHandler;
+
+export {
+	slowDown as default,
+};
+
+export {};

package/dist/index.mjs

@@ -0,0 +1,99 @@
+// source/slow-down.ts
+import { rateLimit } from "express-rate-limit";
+var filterUndefinedOptions = (passedOptions) => {
+  const filteredOptions = {};
+  for (const k of Object.keys(passedOptions)) {
+    const key = k;
+    if (passedOptions[key] !== void 0) {
+      filteredOptions[key] = passedOptions[key];
+    }
+  }
+  return filteredOptions;
+};
+var ExpressSlowDownWarning = class extends Error {
+  constructor(code, message) {
+    const url = `https://express-rate-limit.github.io/${code}/`;
+    super(`${message} See ${url} for more information.`);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.help = url;
+  }
+};
+var slowDown = (passedOptions = {}) => {
+  const notUndefinedOptions = filterUndefinedOptions(passedOptions);
+  if (notUndefinedOptions.max !== void 0 || notUndefinedOptions.limit !== void 0)
+    throw new Error(
+      "The limit/max option is not supported by express-slow-down, please use delayAfter instead."
+    );
+  const validate = typeof notUndefinedOptions.validate === "boolean" ? { default: notUndefinedOptions.validate } : notUndefinedOptions.validate ?? { default: true };
+  if (typeof notUndefinedOptions.delayMs === "number" && // Make sure the validation check is not disabled.
+  (validate.delayMs === true || validate.delayMs === void 0 && validate.default)) {
+    const message = `The behaviour of the 'delayMs' option was changed in express-slow-down v2:
+			- For the old behavior, change the delayMs option to:
+
+			  delayMs: (used, req) => {
+				  const delayAfter = req.${notUndefinedOptions.requestPropertyName ?? "slowDown"}.limit;
+				  return (used - delayAfter) * ${notUndefinedOptions.delayMs};
+			  },
+
+			- For the new behavior, change the delayMs option to:
+
+				delayMs: () => ${notUndefinedOptions.delayMs},
+
+			Or set 'options.validate: {delayMs: false}' to disable this message.`.replace(
+      /^(\t){3}/gm,
+      ""
+    );
+    console.warn(new ExpressSlowDownWarning("WRN_ESD_DELAYMS", message));
+  }
+  delete validate?.delayMs;
+  const options = {
+    // The following settings are defaults that may be overridden by the user's options.
+    delayAfter: 1,
+    delayMs(used, request, response) {
+      const delayAfter2 = request[options.requestPropertyName].limit;
+      return (used - delayAfter2) * 1e3;
+    },
+    maxDelayMs: Number.POSITIVE_INFINITY,
+    requestPropertyName: "slowDown",
+    // Disable the headers by default, but allow users to override
+    legacyHeaders: false,
+    standardHeaders: false,
+    // Next the user's options are pulled in, overriding defaults from above
+    ...notUndefinedOptions,
+    // This is a combination of the user's validate settings and our own overrides
+    validate: {
+      ...validate,
+      limit: false
+      // We know the behavior of limit=0 changed - we depend on the new behavior!
+    },
+    // These settings cannot be overridden.
+    limit: 0,
+    // We want the handler to run on every request.
+    // The handler contains the slow-down logic, so don't allow it to be overridden.
+    async handler(_request, response, next) {
+      const delayAfter2 = typeof options.delayAfter === "function" ? await options.delayAfter(_request, response) : options.delayAfter;
+      const request = _request;
+      const info = request[options.requestPropertyName];
+      info.limit = delayAfter2;
+      info.remaining = Math.max(0, delayAfter2 - info.used);
+      let delay = 0;
+      if (info.used > delayAfter2) {
+        const unboundedDelay = typeof options.delayMs === "function" ? await options.delayMs(info.used, request, response) : options.delayMs;
+        const maxDelayMs2 = typeof options.maxDelayMs === "function" ? await options.maxDelayMs(request, response) : options.maxDelayMs;
+        delay = Math.max(0, Math.min(unboundedDelay, maxDelayMs2));
+      }
+      request[options.requestPropertyName].delay = delay;
+      if (delay <= 0) return next();
+      const timerId = setTimeout(() => next(), delay);
+      response.on("close", () => clearTimeout(timerId));
+    }
+  };
+  const { delayAfter, delayMs, maxDelayMs, ...erlOptions } = options;
+  return rateLimit(erlOptions);
+};
+var slow_down_default = slowDown;
+export {
+  slow_down_default as default,
+  slowDown
+};

package/license.md

@@ -0,0 +1,20 @@
+# MIT License
+
+Copyright 2023 Nathan Friedly, Vedant K
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/package.json

@@ -0,0 +1,162 @@
+{
+  "name": "@depup/express-slow-down",
+  "version": "3.1.0-depup.0",
+  "description": "Basic IP rate-limiting middleware for Express that slows down responses rather than blocking the user. (with updated dependencies)",
+  "homepage": "https://github.com/express-rate-limit/express-slow-down",
+  "author": {
+    "name": "Nathan Friedly",
+    "url": "http://nfriedly.com/"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/express-rate-limit/express-slow-down.git"
+  },
+  "keywords": [
+    "express-slow-down",
+    "depup",
+    "updated-dependencies",
+    "security",
+    "latest",
+    "patched",
+    "express-rate-limit",
+    "express",
+    "rate",
+    "limit",
+    "ratelimit",
+    "rate-limit",
+    "middleware",
+    "ip",
+    "auth",
+    "authorization",
+    "brute",
+    "force",
+    "bruteforce",
+    "brute-force",
+    "attack"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "main": "dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist/",
+    "tsconfig.json",
+    "readme.md",
+    "license.md",
+    "changelog.md",
+    "changes.json",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">= 16"
+  },
+  "scripts": {
+    "clean": "del-cli dist/ coverage/ *.log *.tmp *.bak *.tgz",
+    "build:cjs": "esbuild --platform=node --bundle --target=es2022 --packages=external --format=cjs --outfile=dist/index.cjs --footer:js=\"module.exports = slowDown; module.exports.default = slowDown; module.exports.slowDown = slowDown; \" source/index.ts",
+    "build:esm": "esbuild --platform=node --bundle --target=es2022 --packages=external --format=esm --outfile=dist/index.mjs source/index.ts",
+    "build:types": "dts-bundle-generator --out-file=dist/index.d.ts source/index.ts && cp dist/index.d.ts dist/index.d.cts && cp dist/index.d.ts dist/index.d.mts",
+    "compile": "run-s clean build:*",
+    "lint:code": "xo",
+    "lint:rest": "prettier --check .",
+    "lint": "run-s lint:*",
+    "format:code": "xo --fix",
+    "format:rest": "prettier --write .",
+    "format": "run-s format:*",
+    "test:lib": "jest test/library/",
+    "test:int": "jest test/integration/",
+    "test": "run-s lint test:*",
+    "pre-commit": "lint-staged"
+  },
+  "peerDependencies": {
+    "express": "4 || 5 || ^5.0.0-beta.1"
+  },
+  "dependencies": {
+    "express-rate-limit": "^8.3.1"
+  },
+  "devDependencies": {
+    "@express-rate-limit/prettier": "1.1.1",
+    "@express-rate-limit/tsconfig": "1.0.2",
+    "@jest/globals": "29.7.0",
+    "@types/express": "4.17.18",
+    "@types/jest": "29.5.5",
+    "@types/supertest": "2.0.12",
+    "body-parser": "1.20.3",
+    "del-cli": "5.1.0",
+    "dts-bundle-generator": "8.0.1",
+    "esbuild": "0.25.0",
+    "express": "4.21.2",
+    "husky": "8.0.3",
+    "jest": "29.7.0",
+    "jest-expect-message": "1.1.3",
+    "lint-staged": "16.1.2",
+    "npm-run-all": "4.1.5",
+    "prettier": "3.0.3",
+    "supertest": "6.3.3",
+    "ts-jest": "29.1.1",
+    "typescript": "5.2.2",
+    "xo": "0.56.0"
+  },
+  "xo": {
+    "prettier": true,
+    "rules": {
+      "@typescript-eslint/prefer-nullish-coalescing": [
+        "error",
+        {
+          "ignoreConditionalTests": true
+        }
+      ],
+      "@typescript-eslint/no-confusing-void-expression": 0,
+      "@typescript-eslint/consistent-indexed-object-style": [
+        "error",
+        "index-signature"
+      ],
+      "unicorn/prefer-string-replace-all": 0
+    },
+    "overrides": [
+      {
+        "files": "test/**/*.ts",
+        "rules": {
+          "@typescript-eslint/no-unsafe-argument": 0,
+          "@typescript-eslint/no-unsafe-assignment": 0,
+          "@typescript-eslint/no-unsafe-call": 0,
+          "@typescript-eslint/no-unsafe-return": 0,
+          "@typescript-eslint/no-empty-function": 0,
+          "import/no-named-as-default": 0,
+          "unicorn/prefer-event-target": 0,
+          "unicorn/prevent-abbreviations": 0
+        }
+      }
+    ]
+  },
+  "prettier": "@express-rate-limit/prettier",
+  "lint-staged": {
+    "{source,test}/**/*.ts": "xo --fix",
+    "**/*.{json,yaml,md}": "prettier --write"
+  },
+  "depup": {
+    "changes": {
+      "express-rate-limit": {
+        "from": "8",
+        "to": "^8.3.1"
+      }
+    },
+    "depsUpdated": 1,
+    "originalPackage": "express-slow-down",
+    "originalVersion": "3.1.0",
+    "processedAt": "2026-03-19T03:04:02.971Z",
+    "smokeTest": "passed"
+  }
+}

package/readme.md

@@ -0,0 +1,283 @@
+# <div align="center"> Express Slow Down </div>
+
+<div align="center">
+
+[![tests](https://github.com/express-rate-limit/express-slow-down/actions/workflows/ci.yaml/badge.svg)](https://github.com/express-rate-limit/express-slow-down/actions/workflows/ci.yaml)
+[![npm version](https://img.shields.io/npm/v/express-slow-down.svg)](https://npmjs.org/package/express-slow-down 'View this project on NPM')
+[![npm downloads](https://img.shields.io/npm/dm/express-slow-down)](https://www.npmjs.com/package/express-slow-down)
+
+Basic rate-limiting middleware for Express that slows down responses rather than
+blocking them outright. Use to slow repeated requests to public APIs and/or
+endpoints such as password reset.
+
+Plays nice with (and built on top of)
+[Express Rate Limit](https://npmjs.org/package/express-rate-limit)
+
+</div>
+
+### Stores
+
+The default memory store does not share state with any other processes or
+servers. It's sufficient for basic abuse prevention, but an external store will
+provide more consistency.
+
+express-slow-down uses
+[express-rate-limit's stores](https://express-rate-limit.mintlify.app/reference/stores)
+
+> **Note**: when using express-slow-down and express-rate-limit with an external
+> store, you'll need to create two instances of the store and provide different
+> prefixes so that they don't double-count requests.
+
+## Installation
+
+From the npm registry:
+
+```sh
+# Using npm
+> npm install express-slow-down
+# Using yarn or pnpm
+> yarn/pnpm add express-slow-down
+```
+
+From Github Releases:
+
+```sh
+# Using npm
+> npm install https://github.com/express-rate-limit/express-slow-down/releases/download/v{version}/express-slow-down.tgz
+# Using yarn or pnpm
+> yarn/pnpm add https://github.com/express-rate-limit/express-slow-down/releases/download/v{version}/express-slow-down.tgz
+```
+
+Replace `{version}` with the version of the package that you want to your, e.g.:
+`2.0.0`.
+
+## Usage
+
+### Importing
+
+This library is provided in ESM as well as CJS forms, and works with both
+Javascript and Typescript projects.
+
+**This package requires you to use Node 16 or above.**
+
+Import it in a CommonJS project (`type: commonjs` or no `type` field in
+`package.json`) as follows:
+
+```ts
+const { slowDown } = require('express-slow-down')
+```
+
+Import it in a ESM project (`type: module` in `package.json`) as follows:
+
+```ts
+import { slowDown } from 'express-slow-down'
+```
+
+### Examples
+
+To use it in an API-only server where the speed-limiter should be applied to all
+requests:
+
+```ts
+import { slowDown } from 'express-slow-down'
+
+const limiter = slowDown({
+	windowMs: 15 * 60 * 1000, // 15 minutes
+	delayAfter: 5, // Allow 5 requests per 15 minutes.
+	delayMs: (hits) => hits * 100, // Add 100 ms of delay to every request after the 5th one.
+
+	/**
+	 * So:
+	 *
+	 * - requests 1-5 are not delayed.
+	 * - request 6 is delayed by 600ms
+	 * - request 7 is delayed by 700ms
+	 * - request 8 is delayed by 800ms
+	 *
+	 * and so on. After 15 minutes, the delay is reset to 0.
+	 */
+})
+
+// Apply the delay middleware to all requests.
+app.use(limiter)
+```
+
+To use it in a 'regular' web server (e.g. anything that uses
+`express.static()`), where the rate-limiter should only apply to certain
+requests:
+
+```ts
+import { slowDown } from 'express-slow-down'
+
+const apiLimiter = slowDown({
+	windowMs: 15 * 60 * 1000, // 15 minutes
+	delayAfter: 1, // Allow only one request to go at full-speed.
+	delayMs: (hits) => hits * hits * 1000, // 2nd request has a 4 second delay, 3rd is 9 seconds, 4th is 16, etc.
+})
+
+// Apply the delay middleware to API calls only.
+app.use('/api', apiLimiter)
+```
+
+To use a custom store:
+
+```ts
+import { slowDown } from 'express-slow-down'
+import { MemcachedStore } from 'rate-limit-memcached'
+
+const speedLimiter = slowDown({
+	windowMs: 15 * 60 * 1000, // 15 minutes
+	delayAfter: 1, // Allow only one request to go at full-speed.
+	delayMs: (hits) => hits * hits * 1000, // Add exponential delay after 1 request.
+	store: new MemcachedStore({
+		/* ... */
+	}), // Use the external store
+})
+
+// Apply the rate limiting middleware to all requests.
+app.use(speedLimiter)
+```
+
+> **Note:** most stores will require additional configuration, such as custom
+> prefixes, when using multiple instances. The default built-in memory store is
+> an exception to this rule.
+
+## Configuration
+
+### [`windowMs`](https://express-rate-limit.mintlify.app/reference/configuration#windowms)
+
+> `number`
+
+Time frame for which requests are checked/remembered.
+
+Note that some stores have to be passed the value manually, while others infer
+it from the options passed to this middleware.
+
+Defaults to `60000` ms (= 1 minute).
+
+### `delayAfter`
+
+> `number` | `function`
+
+The max number of requests allowed during `windowMs` before the middleware
+starts delaying responses. Can be the limit itself as a number or a (sync/async)
+function that accepts the Express `req` and `res` objects and then returns a
+number.
+
+Defaults to `1`.
+
+An example of using a function:
+
+```ts
+const isPremium = async (user) => {
+	// ...
+}
+
+const limiter = slowDown({
+	// ...
+	delayAfter: async (req, res) => {
+		if (await isPremium(req.user)) return 10
+		else return 1
+	},
+})
+```
+
+### `delayMs`
+
+> `number | function`
+
+The delay to apply to each request once the limit is reached. Can be the delay
+itself (in milliseconds) as a number or a (sync/async) function that accepts a
+number (number of requests in the current window), the Express `req` and `res`
+objects and then returns a number.
+
+By default, it increases the delay by 1 second for every request over the limit:
+
+```ts
+const limiter = slowDown({
+	// ...
+	delayMs: (used) => (used - delayAfter) * 1000,
+})
+```
+
+### `maxDelayMs`
+
+> `number | function`
+
+The absolute maximum value for `delayMs`. After many consecutive attempts, the
+delay will always be this value. This option should be used especially when your
+application is running behind a load balancer or reverse proxy that has a
+request timeout. Can be the number itself (in milliseconds) or a (sync/async)
+function that accepts the Express `req` and `res` objects and then returns a
+number.
+
+Defaults to `Infinity`.
+
+For example, for the following configuration:
+
+```ts
+const limiter = slowDown({
+	// ...
+	delayAfter: 1,
+	delayMs: (hits) => hits * 1000,
+	maxDelayMs: 4000,
+})
+```
+
+The first request will have no delay. The second will have a 2 second delay, the
+3rd will have a 3 second delay, but the fourth, fifth, sixth, seventh and so on
+requests will all have a 4 second delay.
+
+### Options from [`express-rate-limit`](https://github.com/express-rate-limit/express-rate-limit)
+
+Because
+[`express-rate-limit`](https://github.com/express-rate-limit/express-rate-limit)
+is used internally, additional options that it supports may be passed in. Some
+of them are listed below; see `express-rate-limit`'s
+[documentation](https://express-rate-limit.mintlify.app/reference/configuration)
+for the complete list.
+
+> **Note**: The `limit` (`max`) option is not supported (use `delayAfter`
+> instead), nor is the `handler` option.
+
+- [`standardHeaders`](https://express-rate-limit.mintlify.app/reference/configuration#standardheaders)
+- [`legacyHeaders`](https://express-rate-limit.mintlify.app/reference/configuration#legacyheaders)
+- [`requestPropertyName`](https://express-rate-limit.mintlify.app/reference/configuration#requestpropertyname)
+- [`skipFailedRequests`](https://express-rate-limit.mintlify.app/reference/configuration#skipfailedrequests)
+- [`skipSuccessfulRequests`](https://express-rate-limit.mintlify.app/reference/configuration#skipsuccessfulrequests)
+- [`keyGenerator`](https://express-rate-limit.mintlify.app/reference/configuration#keygenerator)
+- [`ipv6Subnet`](https://express-rate-limit.mintlify.app/reference/configuration#ipv6subnet)
+- [`skip`](https://express-rate-limit.mintlify.app/reference/configuration#skip)
+- [`requestWasSuccessful`](https://express-rate-limit.mintlify.app/reference/configuration#requestwassuccessful)
+- [`validate`](https://express-rate-limit.mintlify.app/reference/configuration#validate)
+- [`store`](https://express-rate-limit.mintlify.app/reference/configuration#store)
+
+## Request API
+
+A `req.slowDown` property is added to all requests with the `limit`, `used`, and
+`remaining` number of requests and, if the store provides it, a `resetTime` Date
+object. It also has the `delay` property, which is the amount of delay imposed
+on current request (milliseconds). These may be used in your application code to
+take additional actions or inform the user of their status.
+
+Note that `used` includes the current request, so it should always be > 0.
+
+The property name can be configured with the configuration option
+`requestPropertyName`.
+
+## Issues and Contributing
+
+If you encounter a bug or want to see something added/changed, please go ahead
+and
+[open an issue](https://github.com/express-rate-limit/express-slow-down/issues/new)!
+If you need help with something, feel free to
+[start a discussion](https://github.com/express-rate-limit/express-slow-down/discussions/new)!
+
+If you wish to contribute to the library, thanks! First, please read
+[the contributing guide](contributing.md). Then you can pick up any issue and
+fix/implement it!
+
+## License
+
+MIT © [Nathan Friedly](http://nfriedly.com/),
+[Vedant K](https://github.com/gamemaker1)

package/tsconfig.json

@@ -0,0 +1,9 @@
+{
+	"extends": "@express-rate-limit/tsconfig",
+	"include": ["source/"],
+	"exclude": ["node_modules/"],
+	"compilerOptions": {
+		"target": "ES2020",
+		"outDir": "dist"
+	}
+}