@hocuspocus/server - npm Package Compare versions

Comparing version 4.0.0-rc.0 to 4.0.0-rc.1

package.json

 {
 	"name": "@hocuspocus/server",
 	"description": "plug & play collaboration backend",
-	"version": "4.0.0-rc.0",
+	"version": "4.0.0-rc.1",
 	"homepage": "https://hocuspocus.dev",
@@ -32,3 +32,3 @@ "keywords": [
 	"dependencies": {
-		"@hocuspocus/common": "^4.0.0-rc.0",
+		"@hocuspocus/common": "^4.0.0-rc.1",
 		"async-lock": "^1.3.1",
@@ -47,3 +47,3 @@ "async-mutex": "^0.5.0",
 	},
-	"gitHead": "3fe6c023877badd74d3ea3e50019b73660e028a4",
+	"gitHead": "730ac02724fcc44bbbfcc5849df4b0cafb996450",
 	"repository": {
@@ -50,0 +50,0 @@ "url": "https://github.com/ueberdosis/hocuspocus"

src/Hocuspocus.ts

 import crypto from "node:crypto";
-import { ResetConnection, awarenessStatesToArray } from "@hocuspocus/common";
-import { Doc } from "yjs";
-import { applyUpdate, encodeStateAsUpdate } from "yjs";
-import meta from "../package.json" assert { type: "json" };
+import { awarenessStatesToArray, ResetConnection, SkipFurtherHooksError } from "@hocuspocus/common";
+import { applyUpdate, Doc, encodeStateAsUpdate } from "yjs";
+import meta from "../package.json" with { type: "json" };
+
 import { ClientConnection } from "./ClientConnection.ts";
@@ -12,2 +12,3 @@ import { DirectConnection } from "./DirectConnection.ts";
 	AwarenessUpdate,
+	beforeBroadcastStatelessPayload,
 	Configuration,
@@ -17,7 +18,6 @@ ConnectionConfiguration,
 	HookPayloadByName,
-	WebSocketLike,
-	beforeBroadcastStatelessPayload,
 	onChangePayload,
 	onDisconnectPayload,
 	onStoreDocumentPayload,
+	WebSocketLike,
 } from "./types.ts";
@@ -175,6 +175,3 @@ import { isTransactionOrigin, shouldSkipStoreHooks } from "./types.ts";
 			const debounceId = `onStoreDocument-${document.name}`;
-			if (
-				!document.isLoading &&
-				this.debouncer.isDebounced(debounceId)
-			) {
+			if (!document.isLoading && this.debouncer.isDebounced(debounceId)) {
 				this.debouncer.executeNow(debounceId);
@@ -329,2 +326,6 @@ }
 	): Promise<Document> {
+		if (!documentName.trim()) {
+			throw new Error("Document name must not be empty");
+		}
+
 		const existingLoadingDoc = this.loadingDocuments.get(documentName);
@@ -479,13 +480,24 @@
 				} catch (error: any) {
-					console.error("Caught error during storeDocumentHooks", error);
-					if (error?.message) {
-						throw error;
+					if (error instanceof SkipFurtherHooksError) {
+						// Another extension handled this — proceed to unload
+						setTimeout(() => {
+							if (this.shouldUnloadDocument(document)) {
+								this.unloadDocument(document);
+							}
+						}, 0);
+						return;
 					}
-				} finally {
-					setTimeout(() => {
-						if (this.shouldUnloadDocument(document)) {
-							this.unloadDocument(document);
-						}
-					}, 0);
+
+					console.error(
+						"Caught error during storeDocumentHooks. Document stays in memory to avoid data loss",
+						error,
+					);
+					return;
 				}
+
+				setTimeout(() => {
+					if (this.shouldUnloadDocument(document)) {
+						this.unloadDocument(document);
+					}
+				}, 0);
 			},
@@ -492,0 +504,0 @@ immediately ? 0 : this.configuration.debounce,

src/MessageReceiver.ts

@@ -58,8 +58,2 @@ import { AuthMessageType } from "@hocuspocus/common";
 					} else if (connection) {
-						// TODO: We should log this, shouldn't we?
-						// this.logger.log({
-						//   direction: 'out',
-						//   type: MessageType.Awareness,
-						//   category: 'Update',
-						// })
 						connection.send(message.toUint8Array());
@@ -179,5 +173,5 @@ }
 						// no new changes in update
-						const ackMessage = new OutgoingMessage(messageAddress).writeSyncStatus(
-							true,
-						);
+						const ackMessage = new OutgoingMessage(
+							messageAddress,
+						).writeSyncStatus(true);
 
@@ -187,5 +181,5 @@ connection.send(ackMessage.toUint8Array());
 						// new changes in update that we can't apply, because readOnly
-						const ackMessage = new OutgoingMessage(messageAddress).writeSyncStatus(
-							false,
-						);
+						const ackMessage = new OutgoingMessage(
+							messageAddress,
+						).writeSyncStatus(false);
 
@@ -192,0 +186,0 @@ connection.send(ackMessage.toUint8Array());

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1381569

0.1%

Lines of code

16643

0.08%

Number of low supply chain risk alerts

41

-2.38%

Dependency changes

• Updated

  @hocuspocus/common@^4.0.0-rc.1