![Maven Central Adds Sigstore Signature Validation](https://cdn.sanity.io/images/cgdhsj6q/production/7da3bc8a946cfb5df15d7fcf49767faedc72b483-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
@mongodb-js/zstd
Advanced tools
[![CI](https://github.com/mongodb-js/zstd/actions/workflows/test.yml/badge.svg)](https://github.com/mongodb-js/zstd/actions/workflows/test.yml)
Zstandard compression library for Node.js
npm install @mongodb-js/zstd
Releases are created automatically and signed using the Node team's GPG key. This applies to the git tag as well as all release packages provided as part of a GitHub release. To verify the provided packages, download the key and import it using gpg:
gpg --import node-driver.asc
The GitHub release contains a detached signature file for the NPM package (named
mongodb-js-zstd-X.Y.Z.tgz.sig
).
The following command returns the link npm package.
npm view @mongodb-js/zstd@vX.Y.Z dist.tarball
Using the result of the above command, a curl
command can return the official npm package for the release.
To verify the integrity of the downloaded package, run the following command:
gpg --verify mongodb-js-zstd-X.Y.Z.tgz.sig mongodb-js-zstd-X.Y.Z.tgz
[!Note] No verification is done when using npm to install the package. The contents of the Github tarball and npm's tarball are identical.
To verify the native .node
packages, follow the same steps as above using mongodb-js-zstd-X.Y.Z-platform.tgz
and the corresponding .sig
file.
Only the following version combinations with the MongoDB Node.js Driver are considered stable.
@mongodb-js/zstd@1.x | @mongodb-js/zstd@2.x | |
---|---|---|
mongodb@>=6.12 | ✓ ^1.1.0 | ^2.0.0 |
mongodb@<6.12 | ✓ ^1.1.0 | N/A |
mongodb@5.x | ✓ | N/A |
mongodb@4.x | ✓ | N/A |
mongodb@3.x | N/A | N/A |
Below are the platforms that are available as prebuilds on each github release.
prebuild-install
downloads these automatically depending on the platform you are running npm install on.
export function compress(buffer: Buffer | ArrayBuffer | Uint8Array, level: number): Promise<Buffer>;
export function decompress(buffer: Buffer): Promise<Buffer>;
Think you’ve found a bug? Want to see a new feature in @mongodb-js/zstd
? Please open a
case in our issue management tool, JIRA:
For issues with, questions about, or feedback for the library, please look into our support channels. Please do not email any of the driver developers directly with issues or questions - you're more likely to get an answer on the MongoDB Community Forums.
Change history can be found in HISTORY.md
.
import { compress, decompress } from '@mongodb-js/zstd';
(async () => {
const buffer = Buffer.from('test');
const compressed = await compress(buffer, 10);
const decompressed = await decompress(compressed);
})();
First, install and build the zstd library:
npm run install-zstd
Then build the bindings:
npm run prebuild
Then test:
npm test
FAQs
[![CI](https://github.com/mongodb-js/zstd/actions/workflows/test.yml/badge.svg)](https://github.com/mongodb-js/zstd/actions/workflows/test.yml)
We found that @mongodb-js/zstd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 35 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.