Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
An HTTP/2 server implementation for node.js, developed as a Google Summer of Code project.
I post weekly status updates on my blog. Short version: the first version of the public API is in place, server push is not exposed yet, prioritization and ALPN support is not yet done. Main missing items will be tracked in the issue tracker under the label feature.
Using npm:
npm install http2
The API is very similar to the standard node.js HTTPS API. The goal is the perfect API compatibility, with additional HTTP2 related extensions (like server push). Currently, basic operations work, server push is not yet exposed to the public API. See the examples for more info.
Using as a server:
var http2 = require('http2');
var options = {
key: fs.readFileSync('./example/localhost.key'),
cert: fs.readFileSync('./example/localhost.crt')
};
http2.createServer(options, function(request, response) {
response.end('Hello world!');
}).listen(8080);
Using as a client:
var http2 = require('http2');
var request = http2.request({
method: 'get',
host: 'gabor.molnar.es',
port: 8080,
url: '/',
rejectUnauthorized: false
});
request.end();
request.on('response', function(response) {
response.pipe(process.stdout);
});
An example server (serving up static files from its own directory) and client are available in the example directory. Running the server:
$ node ./example/server.js
Listening on localhost:8080, serving up files from ./example
An example client is also available. Downloading the server's source code from the server (the downloaded content gets pumped out to the standard error output):
$ node ./example/client.js 'http://localhost:8080/server.js' 2>/tmp/server.js
There's a few library you will need to have installed to do anything described in the following
sections. After installing node-http2, run npm install
in its directory to install development
dependencies.
Used libraries:
The developer documentation is located in the doc
directory. The docs are usually updated only
before releasing a new version. To regenerate them manually, run npm run-script prepublish
.
There's a hosted version which is located here.
It's easy, just run npm test
. The tests are written in BDD style, so they are a good starting
point to understand the code.
To generate a code coverage report, run npm test --coverage
. Code coverage summary as of version
0.0.6:
Statements : 91.18% ( 775/850 )
Branches : 84.69% ( 249/294 )
Functions : 88.03% ( 103/117 )
Lines : 91.18% ( 775/850 )
There's a hosted version of the detailed (line-by-line) coverage report here.
Logging is turned off by default. To turn it on, set the HTTP2_LOG
environment variable to
fatal
, error
, warn
, info
, debug
or trace
(the logging level). Log output is in JSON
format, and can be pretty printed using the [bunyan][7] command line tool.
For example, running the test client with debug level logging output:
HTTP2_LOG=debug node ./example/client.js 'http://localhost:8080/server.js' 2>/tmp/server.js | bunyan
The MIT License
Copyright (C) 2013 Gábor Molnár gabor@molnar.es
FAQs
An HTTP/2 client and server implementation
The npm package http2 receives a total of 37,855 weekly downloads. As such, http2 popularity was classified as popular.
We found that http2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.