fulmine.js 5.19.0 → 5.19.2

package/README.md

@@ -32,7 +32,7 @@ See [Migrating](#migrating) for what it handles and what it deliberately does no
 
 [![npm version](https://img.shields.io/npm/v/fulmine.js)](https://www.npmjs.com/package/fulmine.js)
 [![Node.js 22 | 24 | 26](https://img.shields.io/badge/Node.js-22%20%7C%2024%20%7C%2026-green)](https://nodejs.org)
-[![HTTP Arena](https://img.shields.io/endpoint?url=https://www.http-arena.com/badge/fulmine/h1.json)](https://www.http-arena.com/#tuned=0)
+[![HTTP Arena](https://img.shields.io/endpoint?url=https://www.http-arena.com/badge/fulmine.js/h1.json)](https://www.http-arena.com/#tuned=0)
 [![Coverage Status](https://coveralls.io/repos/github/nigrosimone/fulmine.js/badge.svg?branch=main)](https://coveralls.io/github/nigrosimone/fulmine.js?branch=main)
 [![CodeQL](https://github.com/nigrosimone/fulmine.js/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/nigrosimone/fulmine.js/actions/workflows/codeql.yml)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/nigrosimone/fulmine.js/badge)](https://scorecard.dev/viewer/?uri=github.com/nigrosimone/fulmine.js)
@@ -624,6 +624,8 @@ app.listen(3000, () => console.log(`worker ${process.pid} listening`));
 
 Anything held per process is now held per worker: an in-memory cache, a rate-limit counter, a session store or a `Map` of connected sockets is not shared, and needs Redis or something like it to be. `app.close()` in the primary stops the workers, and a `SIGTERM` or `SIGINT` that reaches only the primary, which is what a container sends, is passed on to them. Runnable: [`examples/cluster.js`](./examples/cluster.js).
 
+10. `app.set("connection headers", false)` stops `Connection: keep-alive` and `Keep-Alive: timeout=10` going out on every response. Express sends both, so Fulmine sends both by default. An HTTP/1.1 connection stays open without being told, so to an HTTP/1.1 client the two headers say nothing it does not know already, and they cost 46 bytes and two header writes per response. A request that asked for `Connection: close` still gets `Connection: close`, and the connection is closed. Turn it off for an API behind a proxy or serving HTTP/1.1 clients; keep the default where a client or a proxy relies on the header to keep the connection open. Worth 2% to 3.5% here on a route that is not compiled, plus the bytes.
+
 ## WebSockets
 
 `app.ws()` registers a WebSocket route, served by µWS itself. The upgrade never reaches node, so `server.on("upgrade")` and the libraries built on it have nothing to hear; this is the replacement.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.19.0",
+    "version": "5.19.2",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "exports": {
@@ -119,9 +119,9 @@
         "@commitlint/cli": "^21.2.1",
         "@commitlint/config-conventional": "^21.2.0",
         "@eslint/js": "^10.0.1",
-        "@nestjs/common": "^11.2.1",
-        "@nestjs/core": "^11.2.1",
-        "@nestjs/platform-express": "^11.2.1",
+        "@nestjs/common": "^12.0.1",
+        "@nestjs/core": "^12.0.1",
+        "@nestjs/platform-express": "^12.0.1",
         "@release-it/conventional-changelog": "^12.0.0",
         "@types/accepts": "^1.3.7",
         "@types/bytes": "^3.1.5",
@@ -182,7 +182,7 @@
         "pako": "^3.0.1",
         "passport": "^0.7.0",
         "passport-local": "^1.0.0",
-        "pkg-pr-new": "^0.0.87",
+        "pkg-pr-new": "^0.0.88",
         "prettier": "^3.9.6",
         "pug": "^3.0.4",
         "reflect-metadata": "^0.2.2",
@@ -198,6 +198,8 @@
         "swagger-ui-express": "^5.0.1",
         "swig": "^1.4.2",
         "tsd": "^0.33.0",
+        "typescript": "^6.0.3",
+        "typescript7": "npm:typescript@^7.0.2",
         "vhost": "^3.0.2"
     },
     "contributors": [

package/src/cli.js

@@ -143,19 +143,42 @@ function collectFiles(dir) {
 }
 
 /**
- * The TypeScript compiler belonging to the project being migrated, or null when it has none.
+ * A reader for the .ts files of the project being migrated, or null when it has no TypeScript.
  *
  * acorn cannot read TypeScript, and shipping a parser that can would put megabytes into this
  * package for a command most people run once. A TypeScript project already has the compiler, so
  * it is resolved from there. A project without one is told its .ts files were left alone rather
  * than having them quietly skipped, which is what happened before they were looked at at all.
  *
+ * typescript 7 is the compiler rewritten in Go, and it publishes no JavaScript parser any more:
+ * require("typescript") gives back a version number and nothing else. Its scanner survives, on an
+ * ESM-only subpath that require() reads on every node this package supports, so 7 gets the token
+ * walk and 6 keeps the tree.
+ *
  * @param {string} target directory being migrated
- * @returns {any|null}
+ * @returns {((source: string, fileName: string, seen?: Set<string>) => {start: number, end: number}[])|null}
  */
 function loadTypeScript(target) {
+    /** @param {string} name */
+    const load = (name) => require(require.resolve(name, { paths: [target, process.cwd()] }));
+
     try {
-        return require(require.resolve("typescript", { paths: [target, process.cwd()] }));
+        const ts = load("typescript");
+        if (typeof ts.createSourceFile === "function") {
+            return (source, fileName, seen) => findSpecifiersTypeScript(source, fileName, ts, seen);
+        }
+    } catch {
+        return null;
+    }
+
+    try {
+        const { createScanner } = load("typescript/unstable/ast/scanner");
+        const { LanguageVariant, SyntaxKind } = load("typescript/unstable/ast");
+        // an unstable subpath, so the name the token loop stops on is checked here rather than read
+        // as undefined and scanned past the end of the file forever
+        if (SyntaxKind.EndOfFile === undefined) return null;
+        const ts = { createScanner, LanguageVariant, SyntaxKind };
+        return (source, fileName, seen) => findSpecifiersScanner(source, fileName, ts, seen);
     } catch {
         return null;
     }
@@ -222,6 +245,53 @@ function findSpecifiersTypeScript(source, fileName, ts, seen) {
     return found;
 }
 
+/**
+ * The same specifiers again, read from the token stream instead of from a tree. typescript 7 has
+ * no parser to give a tree, and its scanner already does the part that a search over the text gets
+ * wrong: comments, template literals and strings that only look like imports are not tokens here.
+ *
+ * @param {string} source
+ * @param {string} fileName decides whether JSX is allowed, as above
+ * @param {any} ts the scanner and the two enums loadTypeScript kept
+ * @param {Set<string>} [seen] as in findSpecifiers
+ * @returns {{start: number, end: number}[]}
+ */
+function findSpecifiersScanner(source, fileName, ts, seen) {
+    const kind = ts.SyntaxKind;
+    const scanner = ts.createScanner(
+        true,
+        fileName.endsWith(".tsx") ? ts.LanguageVariant.JSX : ts.LanguageVariant.Standard,
+        source
+    );
+
+    /** @type {{start: number, end: number}[]} */
+    const found = [];
+    // the three tokens before the one in hand, newest first
+    let back1 = -1;
+    let back2 = -1;
+    let back3 = -1;
+
+    for (let token = scanner.scan(); token !== kind.EndOfFile; token = scanner.scan()) {
+        // from "express", and import("express") or require("express") as a call. The dot rules out
+        // obj.require("express"), which is somebody else's require and not a module specifier
+        const isFrom = back1 === kind.FromKeyword;
+        const isRequire = back2 === kind.RequireKeyword && back3 !== kind.DotToken && back3 !== kind.QuestionDotToken;
+        const isCall = back1 === kind.OpenParenToken && (back2 === kind.ImportKeyword || isRequire);
+        if (token === kind.StringLiteral && (isFrom || isCall)) {
+            const text = scanner.getTokenValue();
+            if (text === FROM) {
+                found.push({ start: scanner.getTokenStart(), end: scanner.getTokenEnd() });
+            } else if (seen && BUILT_IN_INSTEAD[text]) {
+                seen.add(text);
+            }
+        }
+        back3 = back2;
+        back2 = back1;
+        back1 = token;
+    }
+    return found;
+}
+
 /**
  * The string literals naming the module, found through the parser rather than by searching the
  * text. "express" appears inside express-session, inside comments and inside strings that are not
@@ -874,7 +944,7 @@ Options:
 
     // resolved once, and only if there is anything to use it on
     const hasTypeScriptFiles = files.some((file) => TYPESCRIPT_EXTENSIONS.has(path.extname(file)));
-    const ts = hasTypeScriptFiles ? loadTypeScript(target) : null;
+    const readTypeScript = hasTypeScriptFiles ? loadTypeScript(target) : null;
 
     for (const file of files) {
         const source = fs.readFileSync(file, "utf8");
@@ -883,14 +953,15 @@ Options:
         if (!source.includes(FROM) && !Object.keys(BUILT_IN_INSTEAD).some((name) => source.includes(name))) continue;
 
         const isTypeScript = TYPESCRIPT_EXTENSIONS.has(path.extname(file));
-        if (isTypeScript && !ts) {
+        if (isTypeScript && !readTypeScript) {
             needTypeScript.push(path.relative(target, file));
             continue;
         }
 
-        const specifiers = isTypeScript
-            ? findSpecifiersTypeScript(source, file, ts, builtInInstead)
-            : findSpecifiers(source, builtInInstead);
+        const specifiers =
+            isTypeScript && readTypeScript
+                ? readTypeScript(source, file, builtInInstead)
+                : findSpecifiers(source, builtInInstead);
         if (specifiers === null) {
             unparsed.push(path.relative(target, file));
             continue;