
Security News
Next.js Patches Critical Middleware Vulnerability (CVE-2025-29927)
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
[](https://github.com/prisma-labs/bema/actions/workflows/trunk.yml)
🐎 Delightful benchmarking for Node.js
npm add bema
Bema is a framework for writing benchamrks. It focused on your workflow of writing and maintain benchmarks over time. Under the hood it uses Benchmark.js as its engine but layers many features on top. Conceptually you can roughly think of it to benchmarks what
jest
is to tests. It was initially developed at Prisma
for internal bencmarking needs and continues to be used today. Its features and roadmap are driven firstly
by Prisma's needs however community contributions are generally welcome too!
jest
had ts-jest
builtin)Useful for complex benchmarks. For example imagine you are testing a set of ORMs with completely different APIs but you want to ensure the data they are querying against the database always returns the exact same set of data otherwise your benchmarks aren't actually comparing apples-to-apples. Bema helps you build confidence around this use-case by having an integrated sanity check step you can opt-into.
The following gives a taste of bema but there are many other features and more advanced topics that are not covered yet in this guide.
// benchmarks/simple.bench.ts
// Bema exports a singleton so you can get to work quickly.
import bema from 'bema'
// Save a reference to the created+configured group so that you can
// define multiple benchmarks later down in the module.
const simple = bema
// Create groups of benchmarks. This allows you to share configuration across multiple benchmarks
// and affects their default presentation in downstream reporting.
.group('Simple')
// Define custom paramters. Benchmarks are named by their accumulated paramters.
.paramter('name')
// Let's add two to show it off down below.
.paramter('thing')
// A middleware system. You get access to upstream context and can augment
// however you want for downstream parts! Also, your additions here will be statically visible
// downstream thanks to TypeScript!
.use((ctx) => ({
...ctx,
newThing: true,
}))
// Sugar over the middleware system to quickly attach data to the context.
.useData({ text: 'bar' })
simple
// Create a new benchmark
.case({
name: 'just-text',
thing: true,
})
// Add a provider only for this benchmark (doesn't affect the group)
.use(foobar)
// Your actual benchmark implementation. All code in here will be timed in a
// statistically significant way (via Benchmark.js)
.run((ctx) => {
console.log(ctx.text)
})
simple
// Create another benchmark
.case({
name: 'interpolated-text',
thing: false,
})
.run(async (ctx) => {
console.log(`%s`, ctx.text)
})
npx bema
On Paka (work in progress)
FAQs
[](https://github.com/prisma-labs/bema/actions/workflows/trunk.yml)
The npm package bema receives a total of 14 weekly downloads. As such, bema popularity was classified as not popular.
We found that bema demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
Security News
A survey of 500 cybersecurity pros reveals high pay isn't enough—lack of growth and flexibility is driving attrition and risking organizational security.
Product
Socket, the leader in open source security, is now available on Google Cloud Marketplace for simplified procurement and enhanced protection against supply chain attacks.