
Research
Node.js Fixes AsyncLocalStorage Crash Bug That Could Take Down Production Servers
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.
ioA minimal, yet flexible I/O for browser and Node with promises. A thin wrapper on top of XMLHttpRequest, and fetch(), with numerous callbacks to simplify and automate all aspects of I/O especially using JSON as an envelope, including to add more transports, and I/O orchestration plugin services.
It can run on Node using a specialized transport: heya-io-node. It greatly simplifies I/O on Node by leveraging enhanced features of heya-io in the server environment.
The following services are included:
io.cache — a transparent application-level cache (supports sessionStorage and
localStorage out of the box).io.bundle — a transparent service to bundle requests into one package passing it to a server, and unbundling a result.
It requires a simple server counterpart. heya-bundler is a reference implementation for node.js/express.js.io.track — a simple plugin to track I/O requests to eliminate duplicates, register an interest without initiating I/O requests, and much more.io.mock — a way to mock I/O requests without writing a special server courtesy of Mike Wilcox. Very useful for rapid prototyping and writing tests.io.bust — a simple plugin to generate a randomized query value to bust browser's cache.io.retry — a plugin to retry unreliable services or watch changes over time.The following additional transports are provided:
io.fetch() — replaces XHR with fetch()-based transport.io.jsonp() — JSON-P requests.io.load() — generates <script> tags to include JavaScript files.Utilities:
url() — uses ES6 tagged literals to form properly sanitized URLs.As is heya-io uses the standard Promise.
Given that not all browsers provide it, heya-io can be used with any then-able, but it was especially tested with implementations provided by heya-async:
FastDeferred and Deferred.
With those modules an extended API is supported: I/O progress reports, and cancellation of I/O requests.
Plain vanilla GET:
heya.io.get('http://example.com/hello').then(function (value) {
console.log(value);
});
heya.io.get('/hello', {to: 'world', times: 5}).then(function (value) {
// GET /hello?to=world×=5
console.log(value);
});
POST a form (can include files or any other form elements):
var formElement = document.querySelector('form');
heya.io.post('/form', new FormData(formElement));
Some other verbs (REST example):
function done() { console.log('done'); }
heya.io.post('/things', {name: 'Bob', age: 42}).then(done);
heya.io.put('/things/5', {name: 'Alice', age: 33}).then(done);
heya.io.patch('/things/7', {age: 14}).then(done);
heya.io.remove('/things/3').then(done);
Modern browsers:
const doIO = async query => {
const result = await heya.io.get('/hello', {q: query});
await heya.io.post('/things', {name: 'Bob', age: 42, friendly: result});
}
Other transports:
// let's make a JSON-P call:
heya.io.jsonp('/planets', {query: 'name'}).then(function (values) {
// GET /planets?query=name
console.log('We have ' + values.length + ' planets:', values);
});
Mock:
// set up a mock handler
heya.io.mock('/a*', function (options, prep) {
console.log('Got call: ' + options.method + ' ' + prep.url);
return 42;
});
// let's make a call
heya.io.get('/a/x').then(function (value) {
console.log(value); // 42
});
// set up a redirect /b => /a/b
heya.io.mock('/b', function (options) {
return heya.io.get('/a/b', options.query || options.data || null);
});
// let's make another call
heya.io.get('/b', {q: 1}).then(function (value) {
console.log(value); // 42
});
Using url template to sanitize URLs (ES6):
const client = 'Bob & Jordan & Co';
heya.io.get(url`/api/${client}/details`).then(function (value) {
// GET /api/Bob%20%26%20Jordan%20%26%20Co/details
console.log(value);
});
See more examples in the cookbooks:
With npm:
npm install --save heya-io
With bower:
bower install --save heya-io
heya-io can be installed with npm or bower with files available from node_modules/ or bower_components/. By default, it uses AMD:
define(['heya-io'], function (io) {
io.get('/hello').then(function (value) {
console.log(value);
});
});
But it can be loaded with <script> tag from dist/:
<script src='node_modules/heya-io/dist/io.js'></script>
And used with globals like in examples above:
heya.io.get('/hello').then(function (value) {
console.log(value);
});
To support browsers without the standard Promise, you may want to use heya-async.
AMD:
define(['heya-io', 'heya-async/FastDeferred'], function (io, Deferred) {
// instrument
io.Deferred = Deferred;
// now we are ready for all browsers
io.get('/hello').then(function (value) {
console.log(value);
});
});
Globals:
<script src='node_modules/heya-io/dist/io.js'></script>
<script src='node_modules/heya-async/dist/Micro.js'></script>
<script src='node_modules/heya-async/dist/FastDeferred.js'></script>
// instrument
heya.io.Deferred = heya.async.FastDeferred;
// now we are ready for all browsers
heya.io.get('/hello').then(function (value) {
console.log(value);
});
See How to include for more details.
All documentation can be found in project's wiki.
In order to run tests in a browser of your choice, so you can debug interactively, start the test server:
npm start
Then open this URL in a browser: http://localhost:3000/tests/tests.html It will show a blank screen, but the output will appear in the console of your developer tools.
The server runs indefinitely, and can be stopped by Ctrl+C.
retry to the UMD loader so it can be used in Node directly.retry service.retry service.retry service. Thx Jason Vanderslice!AbortRequest.options.onDownloadProgress() and options.onUploadProgress().options.onProgress() and tests on Firefox Puppeteer.ignoreBadStatus flag when returnXHR.getHeaders() behaves like on Node, empty object queries are supported.io.getData(xhr) and io.getHeaders(xhr).processFailure could be skipped.url tagged literals (an ES6 feature).BSD or AFL — your choice.
FAQs
Intelligent I/O for browsers and Node.
We found that heya-io demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.

Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.