fulmine.js 5.1.8 → 5.1.9

package/README.md

@@ -25,6 +25,7 @@ See [Migrating](#migrating) for what it handles and what it deliberately does no
 
 [![npm version](https://img.shields.io/npm/v/fulmine.js)](https://www.npmjs.com/package/fulmine.js)
 [![Node.js >= 22.0.0](https://img.shields.io/badge/Node.js-%3E=22.0.0-green)](https://nodejs.org)
+[![Coverage Status](https://coveralls.io/repos/github/nigrosimone/fulmine.js/badge.svg?branch=main)](https://coveralls.io/github/nigrosimone/fulmine.js?branch=main)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](./LICENSE)
 
 ## Why this exists
@@ -55,7 +56,7 @@ to run it yourself.
 
 Numbers produced by a project about itself deserve suspicion, so Fulmine also stands in public arenas, run by their own rigs under their own rules:
 
-- **[HttpArena](https://www.http-arena.com/#sort=rps:-1&q=Js)** (the link lands filtered on the JavaScript entries): first among the JavaScript entries and second overall across every language on the board. The saved run measures 7.64 million pipelined requests per second, 1.12 million on the json profile, 457 thousand on compressed json and 222 thousand on the Postgres profile.
+- **[HttpArena](https://www.http-arena.com/#sort=rps:-1&q=Js)** (the link lands filtered on the JavaScript entries): first among the JavaScript entries, across fifteen subscribed profiles. The saved runs measure 24.3 million WebSocket echoes per second pipelined and 3.77 million one-at-a-time (past Bun's own dedicated WebSocket entry), 7.3 million pipelined HTTP requests per second, 1.12 million on the json profile with 1.04 million of that surviving TLS, 457 thousand on compressed json, and 359 thousand on the Postgres CRUD profile, within ten percent of the leading Rust and C# entries there.
 - **[web-frameworks](https://github.com/the-benchmarker/web-frameworks)**: entry merged, numbers arrive with their next published round.
 
 More to come as their maintainers take the entries in.
@@ -226,9 +227,10 @@ which runs the same file against Express and against Fulmine and compares the ou
 
 ## HTTP/3
 
-HTTP/3 is supported. To use:
+There is an `http3: true` option, inherited from Ultimate Express, that asks µWebSockets.js for its experimental HTTP/3 app. **It is guarded off with the currently pinned µWS build**: asking for it throws a clear error, because the underlying `H3App` segfaults during construction on Linux, verified with µWS alone before a single request is served. On Windows the listener does come up, but nothing answers over QUIC that we could verify, and shipping an option that works on no deployable platform helps nobody. A skipped canary test probes `H3App` on every CI run and will turn red the day µWS ships working QUIC in its prebuilt binaries, which is when the guard goes and this section changes.
 
 ```js
+// what it would look like, once µWS's H3 support actually works
 const app = express({
     http3: true,
     uwsOptions: {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.1.8",
+    "version": "5.1.9",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "bin": {
@@ -13,7 +13,7 @@
         "test:types": "tsd --files tests/types/*.test-d.ts",
         "test:express": "node tools/express-suite.js",
         "benchmark:compare": "node benchmark/run.js",
-        "cover": "npm run cover:unit && npm run cover:report",
+        "cover": "npm run cover:full && npm run cover:report",
         "cover:unit": "nyc --silent npm run test",
         "cover:report": "nyc report --reporter=html",
         "lint": "eslint .",
@@ -25,7 +25,9 @@
         "typecheck": "tsc -p tsconfig.typecheck.json",
         "benchmark:ab": "node benchmark/ab.js",
         "benchmark:profile": "node benchmark/profile.js",
-        "release:local": "node tools/release-local.js"
+        "release:local": "node tools/release-local.js",
+        "cover:full": "nyc --silent npm run test && nyc --silent --no-clean npm run test:unit && nyc --silent --no-clean npm run test:express && nyc report",
+        "cover:check": "nyc check-coverage --statements 93 --branches 88 --functions 92 --lines 93"
     },
     "engines": {
         "node": ">=22"

package/src/application.js

@@ -15,10 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// H3App, DeclarativeResponse and _cfg all exist at runtime but are missing from the
-// declaration file the package ships, so the module is read through a loose alias
 const uWS = require("uWebSockets.js");
-const uWSAny = /** @type {any} */ (uWS);
 const Router = require("./router.js");
 const {
     removeDuplicateSlashes,
@@ -102,10 +99,14 @@ class Application extends Router {
         if (settings.uwsApp) {
             this.uwsApp = settings.uwsApp;
         } else if (settings.http3) {
-            if (!settings.uwsOptions.key_file_name || !settings.uwsOptions.cert_file_name) {
-                throw new Error("uwsOptions.key_file_name and uwsOptions.cert_file_name are required for HTTP/3");
-            }
-            this.uwsApp = uWSAny.H3App(settings.uwsOptions);
+            // uWS.H3App exists in the pinned build but its QUIC stack does not: the constructor
+            // segfaults on Linux and hangs forever on Windows before serving a single request,
+            // verified 2026-08-05 with uWS alone. A clear throw beats a native crash; this
+            // branch goes back to H3App once uNetworking ships working QUIC in the prebuilts.
+            throw new Error(
+                "http3 is not usable with the pinned uWebSockets.js build: its H3App crashes " +
+                    "during construction. Track uNetworking/uWebSockets.js for working QUIC support."
+            );
         } else if (settings.uwsOptions.key_file_name && settings.uwsOptions.cert_file_name) {
             this.uwsApp = uWS.SSLApp(settings.uwsOptions);
         } else {

package/src/declarative.js

@@ -606,6 +606,13 @@ module.exports = function compileDeclarative(cb, app) {
             }
         }
 
+        // a handler that never sends is not a response: Express leaves the request waiting, so
+        // compiling the empty shape would answer a bare 200 where the ordinary path answers
+        // nothing at all. It has to fall back instead.
+        if (!sendUsed && !sendStatusUsed) {
+            return false;
+        }
+
         let decRes = new uWSAny.DeclarativeResponse();
 
         if (statusCode !== 200) {

package/src/usage.js

@@ -76,7 +76,13 @@ function callbackUsage(fn) {
 
 /** @param {Function} fn @returns {number} */
 function analyze(fn) {
-    let code = fn.toString();
+    // toString is application-controlled and may throw or answer anything: unreadable is unknown
+    let code;
+    try {
+        code = String(fn.toString());
+    } catch {
+        return UNKNOWN;
+    }
     if (code.startsWith("function") || code.startsWith("async function")) {
         code = code.replace(/function *\(/, "function __cb(");
     }