@naturalcycles/backend-lib 9.70.0 → 9.71.0

package/dist/server/compressionMiddleware.js

@@ -64,6 +64,7 @@ export function compressionMiddleware(options) {
         let length;
         let listeners = [];
         let stream;
+        let closed = false;
         const _end = res.end;
         const _on = res.on;
         const _write = res.write;
@@ -126,6 +127,17 @@ export function compressionMiddleware(options) {
             addListeners(res, _on, listeners);
             listeners = null;
         }
+        // Release the compression stream when the response closes, freeing native
+        // zlib memory even if the client disconnected before the response finished.
+        // Registered before onHeaders so a close that happens before the stream
+        // exists is not missed (the `closed` flag below handles a stream created
+        // afterwards). Fixes CVE-2026-87776 / GHSA-vc2v-76pw-4v95.
+        // We use `stream.destroy()` (not the `destroy` npm package upstream added)
+        // because our Node target frees the zlib handle on destroy().
+        _on.call(res, 'close', function onResponseClose() {
+            closed = true;
+            stream?.destroy();
+        });
         onHeaders(res, function onResponseHeaders() {
             // determine if request is filtered
             if (!filter(req, res)) {
@@ -184,6 +196,14 @@ export function compressionMiddleware(options) {
             else {
                 stream = zlib.createDeflate(zlibOpts);
             }
+            // The response already closed before the stream was created, so the close
+            // listener above has already run. Release the stream now and drop the
+            // reference so later writes fall back to the raw response.
+            if (closed) {
+                stream.destroy();
+                stream = undefined;
+                return;
+            }
             // add buffered listeners to stream
             addListeners(stream, stream.on.bind(stream), listeners);
             // header fields

package/dist/server/logMiddleware.js

@@ -1,4 +1,7 @@
 import { inspect } from 'node:util';
+import { _isPlainObject } from '@naturalcycles/js-lib';
+import { _anyToErrorObject } from '@naturalcycles/js-lib/error';
+import { _safeJsonStringify } from '@naturalcycles/js-lib/string/safeJsonStringify.js';
 import { _objectAssign } from '@naturalcycles/js-lib/types';
 import { _inspect } from '@naturalcycles/nodejs-lib';
 import { dimGrey } from '@naturalcycles/nodejs-lib/colors';
@@ -41,17 +44,46 @@ export const ciLogger = {
 // Documented here: https://cloud.google.com/logging/docs/structured-logging
 // Cloud Run logging: https://cloud.google.com/run/docs/logging
 function writeGCPStructuredLog(meta, args) {
-    console.log(JSON.stringify({
-        message: args.map(a => (typeof a === 'string' ? a : inspect(a))).join(' '),
-        ...meta,
-    }));
+    if (args.length !== 1 || !_isPlainObject(args[0])) {
+        console.log(JSON.stringify({
+            message: args.map(a => (typeof a === 'string' ? a : inspect(a))).join(' '),
+            ...meta,
+        }));
+        return;
+    }
+    const { msg, err, ...entry } = args[0];
+    if (err instanceof Error) {
+        entry['err'] = _anyToErrorObject(err);
+        entry['message'] = msg ? `${msg}\n${inspect(err)}` : inspect(err);
+    }
+    else {
+        if (err !== undefined)
+            entry['err'] = err;
+        if (msg !== undefined)
+            entry['message'] = msg;
+    }
+    console.log(_safeJsonStringify({ ...entry, ...meta }));
 }
 function logToDev(requestId, args) {
     // Run on local machine
-    console.log([
-        requestId ? [dimGrey(`[${requestId}]`)] : [],
-        ...args.map(a => _inspect(a, { includeErrorStack: true, colors: true })),
-    ].join(' '));
+    if (args.length !== 1 || !_isPlainObject(args[0])) {
+        console.log([
+            requestId ? [dimGrey(`[${requestId}]`)] : [],
+            ...args.map(a => _inspect(a, { includeErrorStack: true, colors: true })),
+        ].join(' '));
+        return;
+    }
+    const { msg, err, ...rest } = args[0];
+    const parts = [];
+    if (requestId)
+        parts.push(dimGrey(`[${requestId}]`));
+    if (msg !== undefined)
+        parts.push(String(msg));
+    if (err !== undefined)
+        parts.push(_inspect(err, { includeErrorStack: true, colors: true }));
+    if (Object.keys(rest).length)
+        parts.push(dimGrey(_inspect(rest, { colors: false })));
+    console.log(parts.join(' '));
 }
 /**
  * Same as logToDev, but without request and without colors.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.70.0",
+  "version": "9.71.0",
   "dependencies": {
     "@naturalcycles/db-lib": "^10",
     "@naturalcycles/js-lib": "^15",

package/src/server/compressionMiddleware.ts

@@ -113,6 +113,7 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
     let length: number | undefined
     let listeners: [string, (...args: any[]) => void][] | null = []
     let stream: zlib.Gzip | zlib.Deflate | zlib.BrotliCompress | zlib.ZstdCompress | undefined
+    let closed = false
 
     const _end = res.end
     const _on = res.on
@@ -199,6 +200,18 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
       listeners = null
     }
 
+    // Release the compression stream when the response closes, freeing native
+    // zlib memory even if the client disconnected before the response finished.
+    // Registered before onHeaders so a close that happens before the stream
+    // exists is not missed (the `closed` flag below handles a stream created
+    // afterwards). Fixes CVE-2026-87776 / GHSA-vc2v-76pw-4v95.
+    // We use `stream.destroy()` (not the `destroy` npm package upstream added)
+    // because our Node target frees the zlib handle on destroy().
+    _on.call(res, 'close', function onResponseClose() {
+      closed = true
+      stream?.destroy()
+    })
+
     onHeaders(res, function onResponseHeaders() {
       // determine if request is filtered
       if (!filter(req, res)) {
@@ -268,6 +281,15 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
         stream = zlib.createDeflate(zlibOpts)
       }
 
+      // The response already closed before the stream was created, so the close
+      // listener above has already run. Release the stream now and drop the
+      // reference so later writes fall back to the raw response.
+      if (closed) {
+        stream.destroy()
+        stream = undefined
+        return
+      }
+
       // add buffered listeners to stream
       addListeners(stream, stream.on.bind(stream), listeners!)
 

package/src/server/eventLoop.util.ts

@@ -1,8 +1,4 @@
-import type {
-  EventLoopMonitorOptions,
-  EventLoopUtilization,
-  IntervalHistogram,
-} from 'node:perf_hooks'
+import type { ELDHistogram, EventLoopMonitorOptions, EventLoopUtilization } from 'node:perf_hooks'
 import { monitorEventLoopDelay, performance, PerformanceObserver } from 'node:perf_hooks'
 import type {
   Integer,
@@ -45,7 +41,7 @@ export class EventLoopMonitor {
   constructor(cfg: EventLoopMonitorCfg = {}) {
     const { measureInterval = 60_000 } = cfg
 
-    const eldOptions: EventLoopMonitorOptions2 = {
+    const eldOptions: EventLoopMonitorOptions = {
       // Node >=24.19 / >=26.5: sample once per event loop iteration (uv_prepare/uv_check hooks),
       // which measures actual per-iteration delay instead of timer jitter.
       // More accurate (no `resolution` offset baked into every percentile) and cheaper.
@@ -103,7 +99,7 @@ export class EventLoopMonitor {
   }
 
   private interval: NodeJS.Timeout
-  private eld: IntervalHistogram
+  private eld: ELDHistogram
   private lastElu: EventLoopUtilization
   /**
    * Undefined until the first interval has completed.
@@ -167,11 +163,3 @@ export interface EventLoopStats {
    */
   gcCPU: Integer
 }
-
-/**
- * Extends the Node types with `samplePerIteration` (added in Node 24.19 / 26.5).
- * Remove once @types/node declares it.
- */
-interface EventLoopMonitorOptions2 extends EventLoopMonitorOptions {
-  samplePerIteration?: boolean
-}

package/src/server/logMiddleware.ts

@@ -1,5 +1,8 @@
 import { inspect } from 'node:util'
+import { _isPlainObject } from '@naturalcycles/js-lib'
+import { _anyToErrorObject } from '@naturalcycles/js-lib/error'
 import type { CommonLogger } from '@naturalcycles/js-lib/log'
+import { _safeJsonStringify } from '@naturalcycles/js-lib/string/safeJsonStringify.js'
 import { _objectAssign } from '@naturalcycles/js-lib/types'
 import type { AnyObject } from '@naturalcycles/js-lib/types'
 import { _inspect } from '@naturalcycles/nodejs-lib'
@@ -50,22 +53,46 @@ export const ciLogger: CommonLogger = {
 // Documented here: https://cloud.google.com/logging/docs/structured-logging
 // Cloud Run logging: https://cloud.google.com/run/docs/logging
 function writeGCPStructuredLog(meta: AnyObject, args: any[]): void {
-  console.log(
-    JSON.stringify({
-      message: args.map(a => (typeof a === 'string' ? a : inspect(a))).join(' '),
-      ...meta,
-    }),
-  )
+  if (args.length !== 1 || !_isPlainObject(args[0])) {
+    console.log(
+      JSON.stringify({
+        message: args.map(a => (typeof a === 'string' ? a : inspect(a))).join(' '),
+        ...meta,
+      }),
+    )
+    return
+  }
+
+  const { msg, err, ...entry } = args[0]
+  if (err instanceof Error) {
+    entry['err'] = _anyToErrorObject(err)
+    entry['message'] = msg ? `${msg}\n${inspect(err)}` : inspect(err)
+  } else {
+    if (err !== undefined) entry['err'] = err
+    if (msg !== undefined) entry['message'] = msg
+  }
+  console.log(_safeJsonStringify({ ...entry, ...meta }))
 }
 
 function logToDev(requestId: string | null, args: any[]): void {
   // Run on local machine
-  console.log(
-    [
-      requestId ? [dimGrey(`[${requestId}]`)] : [],
-      ...args.map(a => _inspect(a, { includeErrorStack: true, colors: true })),
-    ].join(' '),
-  )
+  if (args.length !== 1 || !_isPlainObject(args[0])) {
+    console.log(
+      [
+        requestId ? [dimGrey(`[${requestId}]`)] : [],
+        ...args.map(a => _inspect(a, { includeErrorStack: true, colors: true })),
+      ].join(' '),
+    )
+    return
+  }
+
+  const { msg, err, ...rest } = args[0]
+  const parts: string[] = []
+  if (requestId) parts.push(dimGrey(`[${requestId}]`))
+  if (msg !== undefined) parts.push(String(msg))
+  if (err !== undefined) parts.push(_inspect(err, { includeErrorStack: true, colors: true }))
+  if (Object.keys(rest).length) parts.push(dimGrey(_inspect(rest, { colors: false })))
+  console.log(parts.join(' '))
 }
 
 /**