@upstash/qstash - npm Package Compare versions

Comparing version 2.1.11 to 2.2.0-canary

dist/nextjs.d.ts

@@ -22,3 +22,5 @@ import { NextApiHandler } from 'next';
 declare function verifySignatureEdge(handler: (req: NextRequest, nfe?: NextFetchEvent) => NextResponse | Promise<NextResponse>, config?: VerifySignatureConfig): (req: NextRequest, nfe: NextFetchEvent) => Promise<NextResponse<unknown>>;
+type VerifySignatureAppRouterResponse = NextResponse | Promise<NextResponse>;
+declare function verifySignatureAppRouter(handler: ((req: Request) => VerifySignatureAppRouterResponse) | ((req: NextRequest) => VerifySignatureAppRouterResponse), config?: VerifySignatureConfig): (req: NextRequest | Request) => Promise<NextResponse<unknown>>;
 
-export { VerifySignatureConfig, verifySignature, verifySignatureEdge };
+export { VerifySignatureConfig, verifySignature, verifySignatureAppRouter, verifySignatureEdge };

dist/nextjs.js

@@ -116,18 +116,50 @@ "use strict";Object.defineProperty(exports, "__esModule", {value: true});
     }
-    let parsedBody = void 0;
-    try {
-      if (req.headers.get("content-type") === "application/json") {
-        parsedBody = JSON.parse(body);
-      } else {
-        parsedBody = body;
-      }
-    } catch (e) {
-      parsedBody = body;
-    }
     return handler(reqClone, nfe);
   });
 }
+function verifySignatureAppRouter(handler, config) {
+  var _a, _b;
+  const currentSigningKey = (_a = config == null ? void 0 : config.currentSigningKey) != null ? _a : process.env.QSTASH_CURRENT_SIGNING_KEY;
+  if (!currentSigningKey) {
+    throw new Error(
+      "currentSigningKey is required, either in the config or as env variable QSTASH_CURRENT_SIGNING_KEY"
+    );
+  }
+  const nextSigningKey = (_b = config == null ? void 0 : config.nextSigningKey) != null ? _b : process.env.QSTASH_NEXT_SIGNING_KEY;
+  if (!nextSigningKey) {
+    throw new Error(
+      "nextSigningKey is required, either in the config or as env variable QSTASH_NEXT_SIGNING_KEY"
+    );
+  }
+  const receiver = new (0, _chunkEROSIHWEjs.Receiver)({
+    currentSigningKey,
+    nextSigningKey
+  });
+  return (req) => _chunkEROSIHWEjs.__async.call(void 0, this, null, function* () {
+    const reqClone = req.clone();
+    const signature = req.headers.get("upstash-signature");
+    if (!signature) {
+      return new (0, _server.NextResponse)(new TextEncoder().encode("`Upstash-Signature` header is missing"), {
+        status: 403
+      });
+    }
+    if (typeof signature !== "string") {
+      throw new Error("`Upstash-Signature` header is not a string");
+    }
+    const body = yield req.text();
+    const isValid = yield receiver.verify({
+      signature,
+      body,
+      clockTolerance: config == null ? void 0 : config.clockTolerance
+    });
+    if (!isValid) {
+      return new (0, _server.NextResponse)(new TextEncoder().encode("invalid signature"), { status: 403 });
+    }
+    return handler(reqClone);
+  });
+}
 
 
 
-exports.verifySignature = verifySignature; exports.verifySignatureEdge = verifySignatureEdge;
+
+exports.verifySignature = verifySignature; exports.verifySignatureAppRouter = verifySignatureAppRouter; exports.verifySignatureEdge = verifySignatureEdge;

package.json

 {
   "name": "@upstash/qstash",
-  "version": "v2.1.11",
+  "version": "v2.2.0-canary",
   "description": "Official Typescript client for QStash",
@@ -29,6 +29,6 @@ "repository": {
   "devDependencies": {
-    "@types/crypto-js": "^4.1.1",
+    "@biomejs/biome": "^1.3.3",
+    "@types/crypto-js": "^4.2.0",
     "@types/node": "^20.5.7",
-    "next": "^13.4.19",
-    "rome": "12.1.3",
+    "next": "^14.0.2",
     "tsup": "^7.2.0",
@@ -38,3 +38,3 @@ "typescript": "^5.2.2"
   "dependencies": {
-    "crypto-js": "^4.1.1",
+    "crypto-js": "^4.2.0",
     "jose": "^4.14.4"
@@ -41,0 +41,0 @@ },

New alerts

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Fixed alerts

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

82217

increased by4.37%

Lines of code

1977

increased by3.4%

Worsened metrics

Number of low quality alerts

1

increased byInfinity%

Number of low supply chain risk alerts

12

increased by50%

Dependency changes

• Updatedcrypto-js@^4.2.0