msgpack5 6.0.2 → 6.1.0

package/.github/workflows/ci.yml

@@ -8,11 +8,19 @@ jobs:
       fail-fast: false
       matrix:
         os: [macOS-latest, windows-latest, ubuntu-latest]
-        node-version: [10, 12, 14, 16]
+        node-version: [10, 12, 14, 16, 18, 20, 22, 24, 26]
+        exclude:
+          # These releases do not provide binaries for current arm64 macOS runners.
+          - os: macOS-latest
+            node-version: 10
+          - os: macOS-latest
+            node-version: 12
+          - os: macOS-latest
+            node-version: 14
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install
@@ -23,8 +31,11 @@ jobs:
   automerge:
     needs: test
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - uses: fastify/github-action-merge-dependabot@v1
+      - uses: fastify/github-action-merge-dependabot@v3
         if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request' }}
         with:
           github-token: ${{secrets.github_token}}

package/AGENTS.md

@@ -0,0 +1,26 @@
+This file provides guidance to AI coding agents like Claude Code (claude.ai/code), Cursor AI, Codex, Gemini CLI, GitHub Copilot, and other AI coding assistants when working with code in this repository.
+
+# Development commands
+
+- Install dependencies: `npm install` (the repository has no lockfile).
+- Run lint and the complete Tape suite: `npm test`.
+- Run lint only: `./node_modules/.bin/standard`.
+- Run one test file: `node test/streams.js` (replace the path with any `test/*.js` file). This emits raw TAP and does not run lint.
+- Build both tracked browser bundles: `npm run build`. This runs Browserify for `dist/msgpack5.js`, then UglifyJS for `dist/msgpack5.min.js`.
+- Build only the unminified browser bundle: `npm run browserify`; minify the existing bundle: `npm run dist`.
+
+CI runs `npm test` on Node.js 10, 12, 14, 16, 18, 20, 22, 24, and 26. Node.js 10–14 run on Linux and Windows only because they do not provide binaries for current arm64 macOS runners; newer versions also run on macOS. Keep runtime code compatible with Node.js 10 unless the support matrix is intentionally changed.
+
+# Architecture
+
+- `index.js` is the CommonJS entry point and instance factory. Each `msgpack()` call creates private encoder and decoder extension registries, installs the timestamp codec, builds bound `encode`/`decode` functions, and exposes stream constructors plus the LevelUP encoding metadata.
+- `lib/encoder.js` recursively dispatches JavaScript values to MessagePack wire families and returns a sliced `Buffer` at the public boundary. Maps and plain objects take separate paths; options such as `forceFloat64`, `sortKeys`, `compatibilityMode`, and `preferMap` alter wire-format decisions.
+- `lib/decoder.js` is a recursive parser whose internal operations return `[value, consumedByteCount]` or `null` for incomplete input. Public `decode()` converts input to a `bl` BufferList, consumes exactly one value, and turns incomplete input into `IncompleteBufferError`.
+- `lib/streams.js` depends on that decoder contract: it accumulates chunks, retains incomplete frames, and repeatedly decodes concatenated frames. The exported constructors rely on being called as `pack.encoder()` / `pack.decoder()` so `this` is the msgpack instance. `wrap: true` is required when stream values may be `null`.
+- Extension encoders produce a buffer whose first byte is the signed extension type and whose remaining bytes are payload. `register()` adds this byte automatically; callers of the lower-level `registerEncoder()` must add it themselves and pair it with `registerDecoder()`. The built-in `lib/codecs/DateCodec.js` uses reserved type `-1`; `disableTimestampEncoding` disables only Date encoding, not decoding.
+- Map decoding produces a plain object only when every key is a string and `preferMap` is false; otherwise it produces a `Map`. The `protoAction` handling applies during the plain-object path.
+- `dist/` contains generated, committed standalone browser artifacts, not source. Regenerate both files with `npm run build` when source behavior exposed in the browser bundle changes.
+
+# Test organization
+
+Tests are Tape files grouped primarily by MessagePack wire type and size boundary. For encoder/decoder changes, preserve exact-byte assertions and cover both sides of affected boundaries; use the focused suites for extensions, timestamps, maps, prototype handling, and streaming when those cross-cutting paths change. `spec.md` is the checked-in MessagePack specification used by this implementation.

package/README.md

@@ -22,8 +22,13 @@ var msgpack = require('msgpack5')() // namespace our extensions
 
 msgpack.register(0x42, MyType, mytipeEncode, mytipeDecode)
 
-console.log(encode({ 'hello': 'world' }).toString('hex'))
+const hex = encode({ 'hello': 'world' }).toString('hex')
+console.log(hex)
 // 81a568656c6c6fa5776f726c64
+const obj = decode(Buffer.from(hex, 'hex'))
+console.log(obj)
+// { hello: 'world' }
+
 console.log(decode(encode({ 'hello': 'world' })))
 // { hello: 'world' }
 console.log(encode(a).toString('hex'))
@@ -111,7 +116,10 @@ options:
 - `compatibilityMode`, a boolean that enables "compatibility mode" which doesn't use bin format family and str 8 format. Defaults to false.
 - `disableTimestampEncoding`, a boolean that when set disables the encoding of Dates into the [timestamp extension type](https://github.com/msgpack/msgpack/blob/master/spec.md#timestamp-extension-type). Defaults to false.
 - `preferMap`, a boolean that forces all maps to be decoded to `Map`s rather than plain objects. This ensures that `decode(encode(new Map())) instanceof Map` and that iteration order is preserved. Defaults to false.
-- `protoAction`, a string which can be `error|ignore|remove` that determines what happens when decoding a plain object with a `__proto__` property which would cause prototype poisoning. `error` (default) throws an error, `remove` removes the property, `ignore` (not recommended) allows the property, thereby causing prototype poisoning on the decoded object.
+- `maxArrayLength`, a non-negative integer that limits the number of elements in a decoded array. Arrays over the limit throw a `RangeError`. Defaults to no limit beyond the MessagePack format maximum.
+- `maxMapLength`, a non-negative integer that limits the number of entries in a decoded map. Maps over the limit throw a `RangeError`. Defaults to no limit beyond the MessagePack format maximum.
+- `maxDepth`, a non-negative integer that limits how deeply arrays and maps can be nested when decoding. Defaults to 100.
+- `protoAction`, a string which can be `error|ignore|remove` that determines what happens when decoding a plain object with a `__proto__` property which would cause prototype poisoning. `error` (the default when omitted) throws an error, `remove` removes the property, `ignore` (not recommended) allows the property, thereby causing prototype poisoning on the decoded object. Any other value throws a `TypeError`.
 
 -------------------------------------------------------
 <a name="encode"></a>

package/SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 6.x.x   | :white_check_mark: |
+| 5.x.x   | :white_check_mark: |
+| 4.x.x   | :white_check_mark: |
+| 3.x.x   | :white_check_mark: |
+| 2.x.x   | :x:                |
+| 1.x.x   | :x:                |
+
+## Reporting a Vulnerability
+
+Please report all vulnerabilities to [https://github.com/mcollina/msgpack5/security](https://github.com/mcollina/msgpack5/security).