V3#2
Merged
Merged
Conversation
- native ES modules: type=module, exports map, explicit .js import
extensions, engines node >=22.12.0
- @imqueue/net updated to ^3.0.0 (ESM major); NOTE: package-lock.json is
intentionally not committed here — regenerate with npm install once
@imqueue/net@3.0.0 is published to the registry
- ioredis imported via named { Redis } binding (default import of the
module mock is not a constructor under node:test module mocking)
- TypeScript 7 (tsgo) with es2024 target, nodenext resolution,
verbatimModuleSyntax and explicit types: [node]
- tests migrated from mocha/chai/mock-require/nyc to node:test; ioredis
mock registered via mock.module preloaded with --import
- lint/format switched from eslint to oxlint + oxfmt; devDeps reduced
- version bumped to 3.0.0
Adds behavioral specs for safeNetworks bypass, isBanned(), middleware() pass-through and blocking, and json/text middleware error responses (status codes, content types and payload shape).
Adds a getClientIp option to HttpProtectOptions. It defaults to request-ip's getClientIp() (unchanged behaviour), but lets callers plug in a trust-aware resolver - e.g. one built on proxy-addr configured with known proxies - so forwarded headers cannot be spoofed to evade rate limits or poison the ban list when running behind untrusted proxies. - HttpProtect.getClientIp is resolved once in the constructor and used by verify(); request-ip stays the default dependency - tests cover the default resolver and a custom override (including that a spoofed x-forwarded-for is ignored when the override reads x-real-ip) - README: documented the option and fixed the stale manual-injection example (verify() takes the request, not a pre-extracted IP)
The migration commit had pre-set 3.0.0, which would make the usual 'npm version major' release flow skip to 4.0.0. Align back to the published 2.0.1 so the release flow itself produces 3.0.0 with its tag and commit.
The committed package-lock.json still pinned @imqueue/net to a local scratchpad tarball (file:/tmp/.../imqueue-net-3.0.0.tgz) used during the pre-publish migration, so 'npm ci' failed on CI with ENOENT. @imqueue/net 3.0.0 is now on the registry, so the lockfile resolves it from registry.npmjs.org and npm ci works.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.