express-rate-limit 8.0.0 → 8.0.2

package/dist/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // source/index.ts
@@ -39,13 +29,15 @@ module.exports = __toCommonJS(index_exports);
 
 // source/ip-key-generator.ts
 var import_node_net = require("node:net");
-var import_ip = __toESM(require("ip"), 1);
+var import_ip_address = require("ip-address");
 function ipKeyGenerator(ip, ipv6Subnet = 56) {
-  if (ipv6Subnet && (0, import_node_net.isIPv6)(ip)) {
-    return `${import_ip.default.mask(
-      ip,
-      import_ip.default.fromPrefixLen(ipv6Subnet)
-    )}/${ipv6Subnet}`;
+  if ((0, import_node_net.isIPv6)(ip)) {
+    const address = new import_ip_address.Address6(ip);
+    if (address.is4()) return address.to4().correctForm();
+    if (ipv6Subnet) {
+      const subnet = new import_ip_address.Address6(`${ip}/${ipv6Subnet}`);
+      return `${subnet.startAddress().correctForm()}/${ipv6Subnet}`;
+    }
   }
   return ip;
 }
@@ -448,7 +440,7 @@ var validations = {
     if (limit === 0) {
       throw new ChangeWarning(
         "WRN_ERL_MAX_ZERO",
-        `Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7`
+        "Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7"
       );
     }
   },
@@ -480,7 +472,7 @@ var validations = {
     if (onLimitReached) {
       throw new ChangeWarning(
         "WRN_ERL_DEPRECATED_ON_LIMIT_REACHED",
-        `The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.`
+        "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7."
       );
     }
   },
@@ -559,7 +551,7 @@ var validations = {
       }
       throw new ValidationError(
         "ERR_ERL_CREATED_IN_REQUEST_HANDLER",
-        `express-rate-limit instance should be created at app initialization, not when responding to a request.`
+        "express-rate-limit instance should be created at app initialization, not when responding to a request."
       );
     }
   },
@@ -590,7 +582,7 @@ var validations = {
     if ((src.includes("req.ip") || src.includes("request.ip")) && !src.includes("ipKeyGenerator")) {
       throw new ValidationError(
         "ERR_ERL_KEY_GEN_IPV6",
-        `Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits.`
+        "Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits."
       );
     }
   }
@@ -891,4 +883,4 @@ var rate_limit_default = rateLimit;
   ipKeyGenerator,
   rateLimit
 });
-module.exports = rateLimit; module.exports.default = rateLimit; module.exports.rateLimit = rateLimit; module.exports.MemoryStore = MemoryStore;
+module.exports = Object.assign(rateLimit, module.exports);

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-// Generated by dts-bundle-generator v9.5.1
+// Generated by dts-bundle-generator v8.0.1
 
-import { NextFunction, Request as Request$1, RequestHandler, Response as Response$1 } from 'express';
+import { NextFunction, Request, RequestHandler, Response } from 'express';
 
 /**
  * Returns the IP address itself for IPv4, or a CIDR-notation subnet for IPv6.
@@ -8,7 +8,7 @@ import { NextFunction, Request as Request$1, RequestHandler, Response as Respons
  * If you write a custom keyGenerator that allows a fallback to IP address for
  * unauthenticated users, return ipKeyGenerator(req.ip) rather than just req.ip.
  *
- * For more infomration, {@see Options.ipv6Subnet}.
+ * For more information, {@see Options.ipv6Subnet}.
  *
  * @param ip {string} - The IP address to process, usually request.ip.
  * @param ipv6Subnet {number | false} - The subnet mask for IPv6 addresses.

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-// Generated by dts-bundle-generator v9.5.1
+// Generated by dts-bundle-generator v8.0.1
 
-import { NextFunction, Request as Request$1, RequestHandler, Response as Response$1 } from 'express';
+import { NextFunction, Request, RequestHandler, Response } from 'express';
 
 /**
  * Returns the IP address itself for IPv4, or a CIDR-notation subnet for IPv6.
@@ -8,7 +8,7 @@ import { NextFunction, Request as Request$1, RequestHandler, Response as Respons
  * If you write a custom keyGenerator that allows a fallback to IP address for
  * unauthenticated users, return ipKeyGenerator(req.ip) rather than just req.ip.
  *
- * For more infomration, {@see Options.ipv6Subnet}.
+ * For more information, {@see Options.ipv6Subnet}.
  *
  * @param ip {string} - The IP address to process, usually request.ip.
  * @param ipv6Subnet {number | false} - The subnet mask for IPv6 addresses.

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-// Generated by dts-bundle-generator v9.5.1
+// Generated by dts-bundle-generator v8.0.1
 
-import { NextFunction, Request as Request$1, RequestHandler, Response as Response$1 } from 'express';
+import { NextFunction, Request, RequestHandler, Response } from 'express';
 
 /**
  * Returns the IP address itself for IPv4, or a CIDR-notation subnet for IPv6.
@@ -8,7 +8,7 @@ import { NextFunction, Request as Request$1, RequestHandler, Response as Respons
  * If you write a custom keyGenerator that allows a fallback to IP address for
  * unauthenticated users, return ipKeyGenerator(req.ip) rather than just req.ip.
  *
- * For more infomration, {@see Options.ipv6Subnet}.
+ * For more information, {@see Options.ipv6Subnet}.
  *
  * @param ip {string} - The IP address to process, usually request.ip.
  * @param ipv6Subnet {number | false} - The subnet mask for IPv6 addresses.

package/dist/index.mjs

@@ -1,12 +1,14 @@
 // source/ip-key-generator.ts
 import { isIPv6 } from "node:net";
-import iptools from "ip";
+import { Address6 } from "ip-address";
 function ipKeyGenerator(ip, ipv6Subnet = 56) {
-  if (ipv6Subnet && isIPv6(ip)) {
-    return `${iptools.mask(
-      ip,
-      iptools.fromPrefixLen(ipv6Subnet)
-    )}/${ipv6Subnet}`;
+  if (isIPv6(ip)) {
+    const address = new Address6(ip);
+    if (address.is4()) return address.to4().correctForm();
+    if (ipv6Subnet) {
+      const subnet = new Address6(`${ip}/${ipv6Subnet}`);
+      return `${subnet.startAddress().correctForm()}/${ipv6Subnet}`;
+    }
   }
   return ip;
 }
@@ -409,7 +411,7 @@ var validations = {
     if (limit === 0) {
       throw new ChangeWarning(
         "WRN_ERL_MAX_ZERO",
-        `Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7`
+        "Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7"
       );
     }
   },
@@ -441,7 +443,7 @@ var validations = {
     if (onLimitReached) {
       throw new ChangeWarning(
         "WRN_ERL_DEPRECATED_ON_LIMIT_REACHED",
-        `The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.`
+        "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7."
       );
     }
   },
@@ -520,7 +522,7 @@ var validations = {
       }
       throw new ValidationError(
         "ERR_ERL_CREATED_IN_REQUEST_HANDLER",
-        `express-rate-limit instance should be created at app initialization, not when responding to a request.`
+        "express-rate-limit instance should be created at app initialization, not when responding to a request."
       );
     }
   },
@@ -551,7 +553,7 @@ var validations = {
     if ((src.includes("req.ip") || src.includes("request.ip")) && !src.includes("ipKeyGenerator")) {
       throw new ValidationError(
         "ERR_ERL_KEY_GEN_IPV6",
-        `Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits.`
+        "Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits."
       );
     }
   }

package/package.json

@@ -1,113 +1,111 @@
 {
-	"name": "express-rate-limit",
-	"version": "8.0.0",
-	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
-	"author": {
-		"name": "Nathan Friedly",
-		"url": "http://nfriedly.com/"
-	},
-	"license": "MIT",
-	"homepage": "https://github.com/express-rate-limit/express-rate-limit",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/express-rate-limit/express-rate-limit.git"
-	},
-	"funding": "https://github.com/sponsors/express-rate-limit",
-	"keywords": [
-		"express-rate-limit",
-		"express",
-		"rate",
-		"limit",
-		"ratelimit",
-		"rate-limit",
-		"middleware",
-		"ip",
-		"auth",
-		"authorization",
-		"security",
-		"brute",
-		"force",
-		"bruteforce",
-		"brute-force",
-		"attack"
-	],
-	"type": "module",
-	"exports": {
-		".": {
-			"import": {
-				"types": "./dist/index.d.mts",
-				"default": "./dist/index.mjs"
-			},
-			"require": {
-				"types": "./dist/index.d.cts",
-				"default": "./dist/index.cjs"
-			}
-		}
-	},
-	"main": "./dist/index.cjs",
-	"module": "./dist/index.mjs",
-	"types": "./dist/index.d.ts",
-	"files": [
-		"dist/",
-		"tsconfig.json"
-	],
-	"engines": {
-		"node": ">= 16"
-	},
-	"scripts": {
-		"clean": "del-cli dist/ coverage/ *.log *.tmp *.bak *.tgz",
-		"build:cjs": "esbuild --packages=external --platform=node --bundle --target=es2022 --format=cjs --outfile=dist/index.cjs --footer:js=\"module.exports = rateLimit; module.exports.default = rateLimit; module.exports.rateLimit = rateLimit; module.exports.MemoryStore = MemoryStore;\" source/index.ts",
-		"build:esm": "esbuild --packages=external --platform=node --bundle --target=es2022 --format=esm --outfile=dist/index.mjs source/index.ts",
-		"build:types": "dts-bundle-generator --out-file=dist/index.d.ts source/index.ts && cp dist/index.d.ts dist/index.d.cts && cp dist/index.d.ts dist/index.d.mts",
-		"compile": "run-s clean build:*",
-		"docs": "cd docs && mintlify dev",
-		"lint:code": "biome check",
-		"lint:docs": "prettier --check docs/ *.md",
-		"lint": "run-s lint:*",
-		"format:code": "biome check --write",
-		"format:docs": "prettier --write docs/ *.md",
-		"format": "run-s format:*",
-		"test:lib": "jest",
-		"test:ext": "cd test/external/ && bash run-all-tests",
-		"test": "run-s lint test:lib",
-		"pre-commit": "lint-staged",
-		"prepare": "run-s compile && husky"
-	},
-	"dependencies": {
-		"ip": "2.0.1"
-	},
-	"peerDependencies": {
-		"express": ">= 4.11"
-	},
-	"devDependencies": {
-		"@biomejs/biome": "2.1.1",
-		"@express-rate-limit/prettier": "1.1.1",
-		"@express-rate-limit/tsconfig": "1.0.2",
-		"@jest/globals": "30.0.4",
-		"@types/express": "5.0.3",
-		"@types/ip": "1.1.3",
-		"@types/jest": "30.0.0",
-		"@types/node": "24.0.14",
-		"@types/supertest": "6.0.3",
-		"del-cli": "6.0.0",
-		"dts-bundle-generator": "9.5.1",
-		"esbuild": "0.25.6",
-		"express": "5.1.0",
-		"husky": "9.1.7",
-		"jest": "30.0.4",
-		"lint-staged": "16.1.2",
-		"mintlify": "4.2.15",
-		"npm-run-all": "4.1.5",
-		"prettier": "3.6.2",
-		"ratelimit-header-parser": "0.1.0",
-		"supertest": "7.1.3",
-		"ts-jest": "29.4.0",
-		"ts-node": "10.9.2",
-		"typescript": "5.8.3"
-	},
-	"prettier": "@express-rate-limit/prettier",
-	"lint-staged": {
-		"*.{js,ts,json}": "biome check --write",
-		"*.{md,yaml}": "prettier --write"
-	}
-}
+  "name": "express-rate-limit",
+  "version": "8.0.2",
+  "description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
+  "author": {
+    "name": "Nathan Friedly",
+    "url": "http://nfriedly.com/"
+  },
+  "license": "MIT",
+  "homepage": "https://github.com/express-rate-limit/express-rate-limit",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/express-rate-limit/express-rate-limit.git"
+  },
+  "funding": "https://github.com/sponsors/express-rate-limit",
+  "keywords": [
+    "express-rate-limit",
+    "express",
+    "rate",
+    "limit",
+    "ratelimit",
+    "rate-limit",
+    "middleware",
+    "ip",
+    "auth",
+    "authorization",
+    "security",
+    "brute",
+    "force",
+    "bruteforce",
+    "brute-force",
+    "attack"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist/",
+    "tsconfig.json"
+  ],
+  "engines": {
+    "node": ">= 16"
+  },
+  "dependencies": {
+    "ip-address": "10.1.0"
+  },
+  "peerDependencies": {
+    "express": ">= 4.11"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.1.1",
+    "@express-rate-limit/prettier": "1.1.1",
+    "@express-rate-limit/tsconfig": "1.0.2",
+    "@jest/globals": "30.0.4",
+    "@types/express": "5.0.3",
+    "@types/jest": "30.0.0",
+    "@types/node": "24.0.14",
+    "@types/supertest": "6.0.3",
+    "del-cli": "6.0.0",
+    "dts-bundle-generator": "8.0.1",
+    "esbuild": "0.25.6",
+    "express": "5.1.0",
+    "husky": "9.1.7",
+    "jest": "30.0.4",
+    "lint-staged": "16.1.2",
+    "mintlify": "4.2.15",
+    "npm-run-all": "4.1.5",
+    "prettier": "3.6.2",
+    "ratelimit-header-parser": "0.1.0",
+    "supertest": "7.1.3",
+    "ts-jest": "29.4.0",
+    "ts-node": "10.9.2",
+    "typescript": "5.8.3"
+  },
+  "prettier": "@express-rate-limit/prettier",
+  "lint-staged": {
+    "*.{js,ts,json}": "biome check --write",
+    "*.{md,yaml}": "prettier --write"
+  },
+  "scripts": {
+    "clean": "del-cli dist/ coverage/ *.log *.tmp *.bak *.tgz",
+    "build:cjs": "esbuild --packages=external --platform=node --bundle --target=es2022 --format=cjs --outfile=dist/index.cjs --footer:js=\"module.exports = Object.assign(rateLimit, module.exports);\" source/index.ts",
+    "build:esm": "esbuild --packages=external --platform=node --bundle --target=es2022 --format=esm --outfile=dist/index.mjs source/index.ts",
+    "build:types": "dts-bundle-generator --out-file=dist/index.d.ts source/index.ts && cp dist/index.d.ts dist/index.d.cts && cp dist/index.d.ts dist/index.d.mts",
+    "compile": "run-s clean build:*",
+    "docs": "cd docs && mintlify dev",
+    "lint:code": "biome check",
+    "lint:docs": "prettier --check docs/ *.md",
+    "lint": "run-s lint:*",
+    "format:code": "biome check --write",
+    "format:docs": "prettier --write docs/ *.md",
+    "format": "run-s format:*",
+    "test:lib": "jest",
+    "test:ext": "cd test/external/ && bash run-all-tests",
+    "test": "run-s lint test:lib",
+    "pre-commit": "lint-staged"
+  }
+}