express - npm Package Compare versions

Comparing version 3.19.2 to 3.20.0

History.md

@@ -0,1 +1,29 @@
+3.20.0 / 2015-02-18
+===================
+
+  * Fix `"trust proxy"` setting to inherit when app is mounted
+  * Generate `ETag`s for all request responses
+    - No longer restricted to only responses for `GET` and `HEAD` requests
+  * Use `content-type` to parse `Content-Type` headers
+  * deps: connect@2.29.0
+    - Use `content-type` to parse `Content-Type` headers
+    - deps: body-parser@~1.12.0
+    - deps: compression@~1.4.1
+    - deps: connect-timeout@~1.6.0
+    - deps: cookie-parser@~1.3.4
+    - deps: cookie-signature@1.0.6
+    - deps: csurf@~1.7.0
+    - deps: errorhandler@~1.3.4
+    - deps: express-session@~1.10.3
+    - deps: http-errors@~1.3.1
+    - deps: response-time@~2.3.0
+    - deps: serve-index@~1.6.2
+    - deps: serve-static@~1.9.1
+    - deps: type-is@~1.6.0
+  * deps: cookie-signature@1.0.6
+  * deps: send@0.12.1
+    - Always read the stat size from the file
+    - Fix mutating passed-in `options`
+    - deps: mime@1.3.4
+
 3.19.2 / 2015-02-01
@@ -2,0 +30,0 @@ ===================

lib/application.js

@@ -0,3 +1,12 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
+ * @api private
  */
@@ -25,2 +34,9 @@
 /**
+ * Variable for trust proxy inheritance back-compat
+ * @api private
+ */
+
+var trustProxyDefaultSymbol = '@@symbol:trust_proxy_default';
+
+/**
  * Initialize the server.
@@ -57,2 +73,8 @@ *
 
+  // trust proxy inherit back-compat
+  Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+    configurable: true,
+    value: true
+  });
+
   debug('booting in %s mode', env);
@@ -64,4 +86,11 @@
 
-  // inherit protos
-  this.on('mount', function(parent){
+  this.on('mount', function onmount(parent) {
+    // inherit trust proxy
+    if (this.settings[trustProxyDefaultSymbol] === true
+      && typeof parent.settings['trust proxy fn'] === 'function') {
+      delete this.settings['trust proxy'];
+      delete this.settings['trust proxy fn'];
+    }
+
+    // inherit protos
     this.request.__proto__ = parent.request;
@@ -277,2 +306,9 @@ this.response.__proto__ = parent.response;
       this.set('trust proxy fn', compileTrust(val));
+
+      // trust proxy inherit back-compat
+      Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+        configurable: true,
+        value: false
+      });
+
       break;
@@ -279,0 +315,0 @@ }

lib/response.js

@@ -0,3 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
+ * @api private
  */
@@ -89,3 +97,2 @@
   var req = this.req;
-  var head = 'HEAD' == req.method;
   var type;
@@ -157,8 +164,8 @@ var encoding;
 
-  // ETag support
-  var etag = len !== undefined && app.get('etag fn');
-  if (etag && ('GET' === req.method || 'HEAD' === req.method)) {
-    if (!this.get('ETag')) {
-      etag = etag(body, encoding);
-      etag && this.set('ETag', etag);
+  // populate ETag
+  var etag;
+  var generateETag = len !== undefined && app.get('etag fn');
+  if (typeof generateETag === 'function' && !this.get('ETag')) {
+    if ((etag = generateETag(body, encoding))) {
+      this.set('ETag', etag);
     }
@@ -178,4 +185,9 @@ }
 
-  // respond
-  this.end((head ? null : body), encoding);
+  if (req.method === 'HEAD') {
+    // skip body for HEAD
+    this.end();
+  } else {
+    // respond
+    this.end(body, encoding);
+  }
 
@@ -182,0 +194,0 @@ return this;

lib/utils.js

@@ -0,10 +1,17 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
 
 /**
  * Module dependencies.
+ * @api private
  */
 
+var contentType = require('content-type');
 var etag = require('etag');
 var mime = require('connect').mime;
 var proxyaddr = require('proxy-addr');
-var typer = require('media-typer');
 
@@ -396,7 +403,9 @@ /**
 
-exports.setCharset = function(type, charset){
-  if (!type || !charset) return type;
+exports.setCharset = function setCharset(type, charset) {
+  if (!type || !charset) {
+    return type;
+  }
 
   // parse type
-  var parsed = typer.parse(type);
+  var parsed = contentType.parse(type);
 
@@ -407,3 +416,3 @@ // set charset
   // format type
-  return typer.format(parsed);
+  return contentType.format(parsed);
 };

package.json

 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.19.2",
+  "version": "3.20.0",
   "author": "TJ Holowaychuk <[e-mail]>",
@@ -30,6 +30,7 @@ "contributors": [
     "basic-auth": "1.0.0",
-    "connect": "2.28.3",
+    "connect": "2.29.0",
     "content-disposition": "0.5.0",
+    "content-type": "~1.0.1",
     "commander": "2.6.0",
-    "cookie-signature": "1.0.5",
+    "cookie-signature": "1.0.6",
     "debug": "~2.1.1",
@@ -40,3 +41,2 @@ "depd": "~1.0.0",
     "fresh": "0.2.4",
-    "media-typer": "0.3.0",
     "methods": "~1.1.1",
@@ -47,3 +47,3 @@ "mkdirp": "0.5.0",
     "range-parser": "~1.0.2",
-    "send": "0.11.1",
+    "send": "0.12.1",
     "utils-merge": "1.0.0",
@@ -60,3 +60,3 @@ "vary": "~1.0.0",
     "mocha": "~2.1.0",
-    "should": "~4.6.2",
+    "should": "~5.0.0",
     "supertest": "~0.15.0",
@@ -63,0 +63,0 @@ "hjs": "~0.0.6"

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

147228

increased by1.63%

Lines of code

2618

increased by1.91%

Number of low supply chain risk alerts

4

decreased by-20%

Dependency changes

• + Addedcontent-type@~1.0.1

• + Addedbody-parser@1.12.4(transitive)

• + Addedbytes@2.1.0(transitive)

• + Addedcompression@1.4.4(transitive)

• + Addedconnect@2.29.0(transitive)

• + Addedconnect-timeout@1.6.2(transitive)

• + Addedcontent-type@1.0.5(transitive)

• + Addedcsurf@1.7.0(transitive)

• + Addeddepd@1.1.2(transitive)

• + Addediconv-lite@0.4.8(transitive)

• + Addedmime@1.3.4(transitive)

• + Addedqs@2.4.2(transitive)

• + Addedraw-body@2.0.2(transitive)

• + Addedresponse-time@2.3.2(transitive)

• + Addedsend@0.12.10.12.3(transitive)

• + Addedserve-static@1.9.3(transitive)

• + Addedtype-is@1.6.18(transitive)

• - Removedmedia-typer@0.3.0

• - Removedbody-parser@1.10.2(transitive)

• - Removedcompression@1.3.1(transitive)

• - Removedconnect@2.28.3(transitive)

• - Removedconnect-timeout@1.5.0(transitive)

• - Removedcookie-signature@1.0.5(transitive)

• - Removedcsurf@1.6.6(transitive)

• - Removedhttp-errors@1.2.8(transitive)

• - Removediconv-lite@0.4.6(transitive)

• - Removedmime@1.2.11(transitive)

• - Removedraw-body@1.3.2(transitive)

• - Removedresponse-time@2.2.0(transitive)

• - Removedsend@0.11.1(transitive)

• - Removedserve-static@1.8.1(transitive)

• - Removedtype-is@1.5.7(transitive)

• Updatedconnect@2.29.0

• Updatedcookie-signature@1.0.6

• Updatedsend@0.12.1