http2 - npm Package Compare versions

Comparing version 3.3.2 to 3.3.3

HISTORY.md

 Version history
 ===============
 
+### 3.3.3 (2016-04-21) ###
+
+* Bugfixes from pull requests (https://github.com/molnarg/node-http2/search?q=milestone%3Av3.3.3&type=Issues&utf8=%E2%9C%93)
+
 ### 3.3.2 (2016-01-11) ###
@@ -5,0 +9,0 @@

lib/http.js

@@ -158,3 +158,2 @@ // Public API
   'proxy-connection',
-  'te',
   'transfer-encoding',
@@ -266,3 +265,7 @@ 'upgrade'
     if (name[0] !== ':') {
-      this.headers[name] = headers[name];
+      if (name === 'set-cookie' && !Array.isArray(headers[name])) {
+        this.headers[name] = [headers[name]];
+      } else {
+        this.headers[name] = headers[name];
+      }
     }
@@ -295,8 +298,9 @@ }
   // * An HTTP/2.0 request or response MUST NOT include any of the following header fields:
-  //   Connection, Host, Keep-Alive, Proxy-Connection, TE, Transfer-Encoding, and Upgrade. A server
+  //   Connection, Host, Keep-Alive, Proxy-Connection, Transfer-Encoding, and Upgrade. A server
   //   MUST treat the presence of any of these header fields as a stream error of type
   //   PROTOCOL_ERROR.
+  //  If the TE header is present, it's only valid value is 'trailers'
   for (var i = 0; i < deprecatedHeaders.length; i++) {
     var key = deprecatedHeaders[i];
-    if (key in headers) {
+    if (key in headers || (key === 'te' && headers[key] !== 'trailers')) {
       this._log.error({ key: key, value: headers[key] }, 'Deprecated header found');
@@ -509,3 +513,3 @@ this.stream.reset('PROTOCOL_ERROR');
     request.remotePort = socket.remotePort;
-    request.connection = request.socket = socket;
+    request.connection = request.socket = response.socket = socket;
 
@@ -543,2 +547,4 @@ request.once('ready', self.emit.bind(self, 'request', request, response));
   this._server.listen.apply(this._server, arguments);
+
+  return this._server;
 };
@@ -578,5 +584,5 @@
   if ((event === 'upgrade') || (event === 'timeout')) {
-    this._server.on(event, listener && listener.bind(this));
+    return this._server.on(event, listener && listener.bind(this));
   } else {
-    EventEmitter.prototype.on.call(this, event, listener);
+    return EventEmitter.prototype.on.call(this, event, listener);
   }
@@ -592,2 +598,6 @@ };
 
+Server.prototype.address = function address() {
+  return this._server.address()
+};
+
 function createServerRaw(options, requestListener) {
@@ -745,2 +755,6 @@ if (typeof options === 'function') {
 
+OutgoingResponse.prototype._implicitHeader = function() {
+  this._implicitHeaders();
+};
+
 OutgoingResponse.prototype.write = function write() {
@@ -861,2 +875,3 @@ this._implicitHeaders();
   EventEmitter.call(this);
+  this.setMaxListeners(0);
 
@@ -1015,2 +1030,11 @@ options = util._extend({}, options);
 
+Agent.prototype.destroy = function(error) {
+  if (this._httpsAgent) {
+    this._httpsAgent.destroy();
+  }
+  for (var key in this.endpoints) {
+    this.endpoints[key].close(error);
+  }
+};
+
 function unbundleSocket(socket) {
@@ -1017,0 +1041,0 @@ socket.removeAllListeners('data');

lib/protocol/flow.js

@@ -326,3 +326,5 @@ var assert = require('assert');
     } else {
-      this.emit('window_update');
+      if (size != 0) {
+        this.emit('window_update');
+      }
     }
@@ -329,0 +331,0 @@ }

lib/protocol/stream.js

@@ -570,4 +570,5 @@ var assert = require('assert');
       if (PRIORITY || (sending && RST_STREAM) ||
+          (receiving && WINDOW_UPDATE) ||
           (receiving && this._closedByUs &&
-           (this._closedWithRst || WINDOW_UPDATE || RST_STREAM || ALTSVC))) {
+           (this._closedWithRst || RST_STREAM || ALTSVC))) {
         /* No state change */
@@ -574,0 +575,0 @@ } else {

package.json

 {
   "name": "http2",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "description": "An HTTP/2 client and server implementation",
@@ -5,0 +5,0 @@ "main": "lib/index.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Number of low supply chain risk alerts

6

decreased by-40%

Number of medium supply chain risk alerts

3

decreased by-57.14%

Worsened metrics

Total package byte prevSize

250142

decreased by-22.09%

Lines of code

5096

decreased by-33.21%

No dependency changes