@ladjs/shared-config - npm Package Compare versions

Comparing version 9.1.2 to 9.1.3

index.js

@@ -1,7 +0,7 @@
-const fs = require('fs');
-const process = require('process');
-const util = require('util');
-
+const fs = require('node:fs');
+const process = require('node:process');
+const util = require('node:util');
 const dayjs = require('dayjs-with-plugins');
 const isSANB = require('is-string-and-not-blank');
+const semver = require('semver');
 const { boolean } = require('boolean');
@@ -19,3 +19,3 @@
 
-  const keys = ['KEY', 'CERT', 'CA'];
+  const keys = ['KEY', 'CERT', 'CA', 'DHPARAM'];
   const validKeys = keys.filter((key) =>
@@ -26,6 +26,16 @@ isSANB(process.env[`${prefix}_SSL_${key}_PATH`])
     ssl = { allowHTTP1: true };
+    // node v18.16.0+ supports "auto" property for dhparam
+    // for perfect forward secrecy (a custom dhparam could be added for ECDHE")
+    if (semver.gte(process.version, 'v18.16.0')) ssl.dhparam = 'auto'; // will be overridden if custom passed in loop below
     for (const key of validKeys) {
-      ssl[key.toLowerCase()] = fs.readFileSync(
-        process.env[`${prefix}_SSL_${key}_PATH`]
-      );
+      if (
+        key === 'DHPARAM' &&
+        process.env[`${prefix}_SSL_${key}_PATH`].toLowerCase() === 'auto'
+      ) {
+        ssl.dhparam = 'auto';
+      } else {
+        ssl[key.toLowerCase()] = fs.readFileSync(
+          process.env[`${prefix}_SSL_${key}_PATH`]
+        );
+      }
     }
@@ -76,5 +86,5 @@ }
             id: (ctx) => ctx.ip,
-            prefix: process.env[`${prefix}_RATELIMIT_PREFIX`]
-              ? process.env[`${prefix}_RATELIMIT_PREFIX`]
-              : `${prefix}_limit_${env}`.toLowerCase(),
+            prefix:
+              process.env[`${prefix}_RATELIMIT_PREFIX`] ||
+              `${prefix}_limit_${env}`.toLowerCase(),
             // whitelist/blacklist parsing inspired by `dotenv-parse-variables`
@@ -112,14 +122,8 @@ allowlist: process.env[`${prefix}_RATELIMIT_WHITELIST`]
     redis: {
-      username: process.env[`${prefix}_REDIS_USERNAME`]
-        ? process.env[`${prefix}_REDIS_USERNAME`]
-        : null,
+      username: process.env[`${prefix}_REDIS_USERNAME`] || null,
       port: process.env[`${prefix}_REDIS_PORT`]
         ? Number.parseInt(process.env[`${prefix}_REDIS_PORT`], 10)
         : 6379,
-      host: process.env[`${prefix}_REDIS_HOST`]
-        ? process.env[`${prefix}_REDIS_HOST`]
-        : 'localhost',
-      password: process.env[`${prefix}_REDIS_PASSWORD`]
-        ? process.env[`${prefix}_REDIS_PASSWORD`]
-        : null,
+      host: process.env[`${prefix}_REDIS_HOST`] || 'localhost',
+      password: process.env[`${prefix}_REDIS_PASSWORD`] || null,
       showFriendlyErrorStack: boolean(
@@ -126,0 +130,0 @@ process.env[`${prefix}_REDIS_SHOW_FRIENDLY_ERROR_STACK`]

package.json

 {
   "name": "@ladjs/shared-config",
   "description": "Shared configuration for Lad's API and Web servers",
-  "version": "9.1.2",
+  "version": "9.1.3",
   "author": "Nick Baugh <[e-mail]> (http://niftylettuce.com/)",
@@ -15,20 +15,21 @@ "bugs": {
     "boolean": "^3.2.0",
-    "dayjs": "^1.11.3",
-    "dayjs-with-plugins": "^1.0.2",
-    "is-string-and-not-blank": "^0.0.2"
+    "dayjs": "^1.11.10",
+    "dayjs-with-plugins": "^1.0.3",
+    "is-string-and-not-blank": "^0.0.2",
+    "semver": "^7.5.4"
   },
   "devDependencies": {
-    "@commitlint/cli": "^17.0.1",
-    "@commitlint/config-conventional": "^17.0.0",
-    "ava": "^4.2.0",
+    "@commitlint/cli": "^17.8.0",
+    "@commitlint/config-conventional": "^17.8.0",
+    "ava": "^5.3.1",
     "cross-env": "^7.0.3",
-    "eslint": "^8.16.0",
-    "eslint-config-xo-lass": "^1.0.6",
+    "eslint": "^8.51.0",
+    "eslint-config-xo-lass": "^2.0.1",
     "fixpack": "^4.0.0",
-    "husky": "^8.0.1",
-    "lint-staged": "^12.4.3",
+    "husky": "^8.0.3",
+    "lint-staged": "^15.0.2",
     "nyc": "^15.1.0",
-    "remark-cli": "^10.0.1",
-    "remark-preset-github": "^4.0.1",
-    "xo": "^0.49.0"
+    "remark-cli": "11",
+    "remark-preset-github": "^4.0.4",
+    "xo": "^0.56.0"
   },
@@ -35,0 +36,0 @@ "engines": {

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

10272

3.16%

Lines of code

154

3.36%

Number of low supply chain risk alerts

31

-11.43%

Worsened metrics

Dependency count

5

25%

Dependency changes

• + Added

  semver@^7.5.4

• + Added

  semver@7.7.4
  (transitive)

• Updated

  dayjs@^1.11.10

• Updated

  dayjs-with-plugins@^1.0.3