jsql-neo 6.5.7 → 6.5.9

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.5.7** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.5.9** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)
@@ -188,3 +188,6 @@ Apache-2.0 License — contributions welcome!
 - **GitHub:** [vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo)
 - **Issues:** [Open an issue](https://github.com/vexify-org/JSQL-neo/issues)
 - **PRs:** Fork → branch → PR — thank you!
+- **Contributing:** [CONTRIBUTING.md](CONTRIBUTING.md)
+- **Code of Conduct:** [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
+- **Security:** [SECURITY.md](SECURITY.md) — please report vulnerabilities privately

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.5.7 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.5.9 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/btree.js

@@ -173,7 +173,7 @@ class BTree {
                 const s = k === undefined || k === null ? '' : String(k);
                 // 不能假设键按字典序排序（数字键按数值序），必须检查所有键
                 if (s.startsWith(p)) {
-                    result.push(...node.values[i]);
+                    for (const __e of node.values[i]) result.push(__e);
                 }
             }
             node = node.next;
@@ -193,7 +193,7 @@ class BTree {
                 const k = node.keys[i];
                 if (k > max) return result;
                 if (k >= min) {
-                    result.push(...node.values[i]);
+                    for (const __e of node.values[i]) result.push(__e);
                 }
             }
             node = node.next;
@@ -209,7 +209,7 @@ class BTree {
         let node = this._findLeaf(min);
         while (node) {
             for (let i = 0; i < node.keys.length; i++) {
-                if (node.keys[i] > min) result.push(...node.values[i]);
+                if (node.keys[i] > min) for (const __e of node.values[i]) result.push(__e);
             }
             node = node.next;
         }
@@ -221,7 +221,7 @@ class BTree {
         let node = this._findLeaf(min);
         while (node) {
             for (let i = 0; i < node.keys.length; i++) {
-                if (node.keys[i] >= min) result.push(...node.values[i]);
+                if (node.keys[i] >= min) for (const __e of node.values[i]) result.push(__e);
             }
             node = node.next;
         }
@@ -237,7 +237,7 @@ class BTree {
         while (!node.leaf) node = node.children[0];
         while (node) {
             for (let i = 0; i < node.keys.length; i++) {
-                if (node.keys[i] < max) result.push(...node.values[i]);
+                if (node.keys[i] < max) for (const __e of node.values[i]) result.push(__e);
                 else return result;
             }
             node = node.next;
@@ -251,7 +251,7 @@ class BTree {
         while (!node.leaf) node = node.children[0];
         while (node) {
             for (let i = 0; i < node.keys.length; i++) {
-                if (node.keys[i] <= max) result.push(...node.values[i]);
+                if (node.keys[i] <= max) for (const __e of node.values[i]) result.push(__e);
                 else return result;
             }
             node = node.next;
@@ -408,9 +408,9 @@ class BTree {
             left.keys.push(midKey);
             left.values.push(midVal);
         }
-        left.keys.push(...right.keys);
-        left.values.push(...right.values);
-        if (!left.leaf) left.children.push(...right.children);
+        for (const __e of right.keys) left.keys.push(__e);
+        for (const __e of right.values) left.values.push(__e);
+        if (!left.leaf) for (const __e of right.children) left.children.push(__e);
         if (left.leaf) left.next = right.next;
 
         parent.keys.splice(index, 1);

package/lib/cache.js

@@ -152,7 +152,7 @@ class Cache {
       throw new Error('WRONGTYPE Operation against a key holding the wrong kind of value');
     }
     if (!list) { list = []; this._getData().set(k, list); }
-    list.push(...values.map(String));
+    for (const __e of values.map(String)) list.push(__e);
     this._dirty = true;
     return list.length;
   }

package/lib/database.js

@@ -566,7 +566,7 @@ class Database {
                         case 'insert': {
                             const t = op.table && this._tables[op.table];
                             if (!t || !Array.isArray(op.rows) || op.rows.length === 0) { failed++; break; }
-                            t._rows.push(...op.rows);
+                            for (const __e of op.rows) t._rows.push(__e);
                             touched.add(t);
                             replayed++;
                             break;

package/lib/jsql_format.js

@@ -510,7 +510,7 @@ class JSQLFormat {
     t.schema = schema;
 
     const { rows: oldRows } = this.readTable(name);
-    oldRows.push(...rows);
+    for (const __e of rows) oldRows.push(__e);
     this.writeTable(name, schema, oldRows, pkField);
   }
 }

package/lib/mongo_server.js

@@ -151,6 +151,7 @@ class MongoServer {
     this.port = options.port ?? 27017;
     this.host = options.host || '127.0.0.1';
     this.dataDir = options.dataDir || null;
+    this.maxMessageSize = options.maxMessageSize || 48 * 1024 * 1024;
     this._engine = null;
     this._server = null;
     this._sockets = new Set();
@@ -201,6 +202,10 @@ class MongoServer {
     this._sockets.add(socket);
     socket.on('close', () => this._sockets.delete(socket));
     let buf = Buffer.isBuffer(existing) ? Buffer.from(existing) : Buffer.alloc(0);
+    if (buf.length > this.maxMessageSize) {
+      socket.destroy();
+      return;
+    }
     socket.on('error', () => {});
     let processing = false;
     let again = false;
@@ -211,7 +216,10 @@ class MongoServer {
         for (;;) {
           if (buf.length < 4) break;
           const len = buf.readInt32LE(0);
-          if (len < 16 || len > 48 * 1024 * 1024) break;
+          if (len < 16 || len > this.maxMessageSize) {
+            socket.destroy();
+            return;
+          }
           if (buf.length < len) break;
           const msg = buf.slice(0, len);
           buf = buf.slice(len);
@@ -227,6 +235,10 @@ class MongoServer {
       }
     };
     socket.on('data', (chunk) => {
+      if (buf.length + chunk.length > this.maxMessageSize * 2) {
+        socket.destroy();
+        return;
+      }
       buf = Buffer.concat([buf, chunk]);
       processLoop();
     });
@@ -635,10 +647,14 @@ class MongoServer {
                         doc[k] = vals.reduce((a, b) => a + b, 0) / vals.length;
                       } else if (v.$min !== undefined) {
                         const vals = grow.map(r => r[field]).filter(v => v != null);
-                        doc[k] = vals.length ? Math.min(...vals) : null;
+                        let best = null;
+                        for (const x of vals) if (best === null || x < best) best = x;
+                        doc[k] = best;
                       } else if (v.$max !== undefined) {
                         const vals = grow.map(r => r[field]).filter(v => v != null);
-                        doc[k] = vals.length ? Math.max(...vals) : null;
+                        let best = null;
+                        for (const x of vals) if (best === null || x > best) best = x;
+                        doc[k] = best;
                       } else if (v.$first !== undefined) {
                         doc[k] = grow[0] ? grow[0][field] : null;
                       } else if (v.$last !== undefined) {

package/lib/mysql_server.js

@@ -1297,11 +1297,14 @@ class MysqlServer {
           );
           friendly.code = 'EADDRINUSE';
           friendly.cause = err;
-          if (cb) cb(friendly);
-          else throw friendly;
-        } else if (cb) cb(err);
+          if (typeof this.options.onError === 'function') this.options.onError(friendly);
+          else if (cb) cb(friendly);
+          else console.error('[jsql-neo] mysql server error:', friendly.message);
+        } else if (typeof this.options.onError === 'function') this.options.onError(err);
+        else if (cb) cb(err);
+        else console.error('[jsql-neo] mysql server error:', err.message);
       });
-      this._server.listen(this.port, this.host, cb || (() => {}));
+      this._server.listen(this.port, this.host, cb ? () => cb() : undefined);
     }).catch(err => {
       if (cb) cb(err);
       else throw err;

package/lib/native_client.js

@@ -851,7 +851,7 @@ class JSQL {
     }
     if (!(await this._runHooks('beforeUpdate', [table, pairs]))) return;
     if (!this._opBuffer.update[table]) this._opBuffer.update[table] = [];
-    this._opBuffer.update[table].push(...pairs);
+    for (const __e of pairs) this._opBuffer.update[table].push(__e);
     this._scheduleOpFlush();
   }
 

package/lib/native_target.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const fs = require('fs');
+const { execFileSync } = require('child_process');
+
+const MIN_NAPI_VERSION = 6;
+
+function detectLibc(platform = process.platform) {
+  if (platform !== 'linux') return null;
+  try {
+    const report = process.report && typeof process.report.getReport === 'function'
+      ? process.report.getReport()
+      : null;
+    if (report && report.header && report.header.glibcVersionRuntime) return 'gnu';
+  } catch (_) { /* ignore */ }
+  try {
+    if (fs.existsSync('/etc/alpine-release')) return 'musl';
+  } catch (_) { /* ignore */ }
+  try {
+    const out = execFileSync('ldd', ['--version'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (/musl/i.test(out)) return 'musl';
+    if (/glibc|GNU libc/i.test(out)) return 'gnu';
+  } catch (_) { /* ignore */ }
+  return 'gnu';
+}
+
+function nativeTargetSuffix(platform = process.platform, arch = process.arch, libc = detectLibc(platform)) {
+  const p = platform === 'win32' ? 'win32' : platform === 'darwin' ? 'darwin' : 'linux';
+  const a = arch === 'x64' ? 'x64' : arch === 'arm64' ? 'arm64' : arch;
+  if (p === 'linux') return `${p}-${a}-${libc === 'musl' ? 'musl' : 'gnu'}`;
+  if (p === 'darwin') return `${p}-${a}`;
+  return `${p}-${a}-msvc`;
+}
+
+function nativeNapiVersion() {
+  const v = Number(process.versions && process.versions.napi);
+  return Number.isFinite(v) ? v : 0;
+}
+
+function supportsNativeNapi() {
+  return nativeNapiVersion() >= MIN_NAPI_VERSION;
+}
+
+module.exports = {
+  MIN_NAPI_VERSION,
+  detectLibc,
+  nativeTargetSuffix,
+  nativeNapiVersion,
+  supportsNativeNapi,
+};

package/lib/nedb_compat.js

@@ -170,7 +170,7 @@ function applyModifier(doc, update) {
       for (const [k, v] of Object.entries(payload)) {
         const cur = getPath(doc, k);
         const arr = Array.isArray(cur) ? cur : [];
-        if (v && typeof v === 'object' && v.$each) arr.push(...v.$each);
+        if (v && typeof v === 'object' && v.$each) for (const __e of v.$each) arr.push(__e);
         else arr.push(v);
         setPath(doc, k, arr);
       }

package/lib/pg_server.js

@@ -845,11 +845,12 @@ class PgServer {
       this._sockets.add(socket);
       new PgConnection(socket, this);
     });
-    this._server.listen(this.port, this.host, cb || (() => {}));
     this._server.on('error', (err) => {
       if (this.options.onError) this.options.onError(err);
-      else throw err;
+      else if (cb) cb(err);
+      else console.error('[jsql-neo] pg server error:', err.message);
     });
+    this._server.listen(this.port, this.host, cb ? () => cb() : undefined);
     return this;
   }
 

package/lib/query.js

@@ -706,7 +706,7 @@ class Query {
             const result = [];
             for (const group of Object.values(groups)) {
                 this._applyWindowToGroup(group, fn, field, dir);
-                result.push(...group);
+                for (const __e of group) result.push(__e);
             }
             return result;
         }

package/lib/redis_server.js

@@ -335,7 +335,7 @@ class RedisServer {
         if (cmd === 'LPUSH') {
           for (const val of args.slice(1)) list.unshift(val);
         } else {
-          list.push(...args.slice(1));
+          for (const __e of args.slice(1)) list.push(__e);
         }
         this.db.set(args[0], { type: 'list', val: list, ttl: v ? v.ttl : null });
         this._scheduleSnapshot();

package/lib/sql.js

@@ -4114,13 +4114,25 @@ function applyScalarFunction(fnNode, row, ctx) {
       }
       function depth(obj) {
         if (typeof obj !== 'object' || obj === null) return 0;
-        if (Array.isArray(obj)) {
-          if (obj.length === 0) return 1;
-          return 1 + Math.max(...obj.map(depth));
+        let max = 0;
+        const stack = [{ o: obj, d: 1 }];
+        while (stack.length) {
+          const { o, d } = stack.pop();
+          if (typeof o !== 'object' || o === null) continue;
+          if (d > max) max = d;
+          if (Array.isArray(o)) {
+            for (const x of o) {
+              if (x && typeof x === 'object') stack.push({ o: x, d: d + 1 });
+            }
+          } else {
+            const ks = Object.keys(o);
+            for (const k of ks) {
+              const x = o[k];
+              if (x && typeof x === 'object') stack.push({ o: x, d: d + 1 });
+            }
+          }
         }
-        const keys = Object.keys(obj);
-        if (keys.length === 0) return 1;
-        return 1 + Math.max(...keys.map(k => depth(obj[k])));
+        return max;
       }
       return depth(data);
     }
@@ -5915,7 +5927,7 @@ class SQLExecutor {
   _rollupRow(groupReps) {
     const all = [];
     for (const rep of groupReps) {
-      if (rep._group) all.push(...rep._group);
+      if (rep._group) for (const __e of rep._group) all.push(__e);
       else all.push(rep);
     }
     const out = {};
@@ -5979,8 +5991,12 @@ class SQLExecutor {
       const numeric = (v) => typeof v === 'number' ||
         (typeof v === 'string' && String(v).trim() !== '' && Number.isFinite(Number(v)));
       if (vs.every(numeric)) {
-        const nums = vs.map(v => Number(v));
-        return fn === 'MIN' ? Math.min(...nums) : Math.max(...nums);
+        let best = Number(vs[0]);
+        for (let i = 1; i < vs.length; i++) {
+          const n = Number(vs[i]);
+          if (fn === 'MIN' ? n < best : n > best) best = n;
+        }
+        return best;
       }
       let best = vs[0];
       for (const v of vs.slice(1)) {

package/lib/tui.js

@@ -72,7 +72,9 @@ function renderTable(headers, rows, maxWidth) {
   for (const w of widths) total += w + 3;
   if (total > maxCol && widths.length > 1) {
     let overshoot = total - maxCol;
-    let i = widths.indexOf(Math.max(...widths));
+    let maxW = widths[0];
+    for (const w of widths) if (w > maxW) maxW = w;
+    let i = widths.indexOf(maxW);
     while (overshoot > 0) {
       if (i === -1 || widths[i] <= 3) break;
       const cut = Math.min(widths[i] - 3, overshoot);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.5.7",
+  "version": "6.5.9",
   "description": "JSQL-NEO \u2014 Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",

package/postinstall.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const http = require('http');
 const https = require('https');
+const { detectLibc, nativeTargetSuffix, nativeNapiVersion, supportsNativeNapi, MIN_NAPI_VERSION } = require('./lib/native_target');
 
 const ROOT = __dirname;
 const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
@@ -69,13 +70,12 @@ const REPO = (pkg.repository && pkg.repository.url)
   ? pkg.repository.url.replace(/\.git$/, '').replace(/^.*github\.com\//i, '')
   : 'vexify-org/JSQL-neo';
 
-// 与 .github/workflows/build-native.yml 中发布的资产命名保持一致
-function nativeTargetSuffix(platform = process.platform, arch = process.arch) {
-  const p = platform === 'win32' ? 'win32' : platform === 'darwin' ? 'darwin' : 'linux';
-  const a = arch === 'x64' ? 'x64' : arch === 'arm64' ? 'arm64' : arch;
-  if (p === 'linux') return `${p}-${a}-gnu`;
-  if (p === 'darwin') return `${p}-${a}`;
-  return `${p}-${a}-msvc`;
+function sameOrigin(a, b) {
+  try { return new URL(a).origin === new URL(b).origin; } catch (_) { return false; }
+}
+
+function safeRedirect(next) {
+  return /^https?:/i.test(String(next || ''));
 }
 
 function download(url, dest, headers, redirects = 0) {
@@ -89,7 +89,11 @@ function download(url, dest, headers, redirects = 0) {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
         res.resume();
         const next = new URL(res.headers.location, url).toString();
-        download(next, dest, headers, redirects + 1).then(resolve, reject);
+        if (!safeRedirect(next)) {
+          reject(new Error(`invalid redirect target for ${url}`));
+          return;
+        }
+        download(next, dest, sameOrigin(next, url) ? headers : undefined, redirects + 1).then(resolve, reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -145,7 +149,11 @@ function fetchText(url, headers, redirects = 0) {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
         res.resume();
         const next = new URL(res.headers.location, url).toString();
-        fetchText(next, headers, redirects + 1).then(resolve, reject);
+        if (!safeRedirect(next)) {
+          reject(new Error(`invalid redirect target for ${url}`));
+          return;
+        }
+        fetchText(next, sameOrigin(next, url) ? headers : undefined, redirects + 1).then(resolve, reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -262,7 +270,15 @@ function tryLoadNative() {
 }
 
 async function downloadAndVerify() {
-  const asset = `jsql-neo-native.${nativeTargetSuffix()}.node`;
+  if (!supportsNativeNapi()) {
+    console.warn(
+      `[jsql-neo] Node ${process.versions.node} provides N-API ${nativeNapiVersion() || 'unknown'}, ` +
+      `but the native module requires N-API >= ${MIN_NAPI_VERSION}; skipping native download.`
+    );
+    return false;
+  }
+  const libc = detectLibc();
+  const asset = process.env.JSQL_NATIVE_ASSET || `jsql-neo-native.${nativeTargetSuffix(process.platform, process.arch, libc)}.node`;
   const raw = `https://github.com/${REPO}/releases/download/${TAG}/${asset}`;
 
   let expected = null;
@@ -274,11 +290,18 @@ async function downloadAndVerify() {
 
   const allowUnverified = process.env.JSQL_ALLOW_UNVERIFIED_NATIVE === '1';
   if (!expected && !allowUnverified) {
-    // fail closed：拿不到 SHA256SUMS 就不下载，绝不 require 未经校验的二进制
-    console.warn(
-      '[jsql-neo] no SHA256SUMS available for this release; refusing to download an unverified native module.\n' +
-      '[jsql-neo] set JSQL_NATIVE_SHA256=<64-hex> to pin a checksum, or JSQL_ALLOW_UNVERIFIED_NATIVE=1 to override (unsafe).'
-    );
+    if (libc === 'musl') {
+      console.warn(
+        `[jsql-neo] musl libc detected but this release has no native asset for ${asset}; ` +
+        'falling back to the WASM/JS engine. Set JSQL_NATIVE_ASSET to a compatible musl build if available.'
+      );
+    } else {
+      // fail closed：拿不到 SHA256SUMS 就不下载，绝不 require 未经校验的二进制
+      console.warn(
+        '[jsql-neo] no SHA256SUMS available for this release; refusing to download an unverified native module.\n' +
+        '[jsql-neo] set JSQL_NATIVE_SHA256=<64-hex> to pin a checksum, or JSQL_ALLOW_UNVERIFIED_NATIVE=1 to override (unsafe).'
+      );
+    }
     return false;
   }
   if (!expected) {
@@ -323,6 +346,13 @@ async function ensureNativeNode() {
     console.log('[jsql-neo] native module ready: native/jsql-neo-native.node');
     return;
   }
+  if (!supportsNativeNapi()) {
+    console.warn(
+      `[jsql-neo] Node ${process.versions.node} provides N-API ${nativeNapiVersion() || 'unknown'}, ` +
+      `but the native module requires N-API >= ${MIN_NAPI_VERSION}; using the WASM/JS engine.`
+    );
+    return;
+  }
   if (await downloadAndVerify()) return;
   buildNativeFromSource();
 }