roster-server - npm Package Compare versions

Comparing version 2.3.12 to 2.3.14

index.js

@@ -261,9 +261,4 @@ const fs = require('fs');
         this.tlsMaxVersion = options.tlsMaxVersion ?? 'TLSv1.3';
-        this.disableWildcard = options.disableWildcard !== undefined
-            ? parseBooleanFlag(options.disableWildcard, false)
-            : parseBooleanFlag(process.env.ROSTER_DISABLE_WILDCARD, false);
-        const combineDefault = false;
-        this.combineWildcardCerts = options.combineWildcardCerts !== undefined
-            ? parseBooleanFlag(options.combineWildcardCerts, combineDefault)
-            : parseBooleanFlag(process.env.ROSTER_COMBINE_WILDCARD_CERTS, combineDefault);
+        this.disableWildcard = parseBooleanFlag(options.disableWildcard, false);
+        this.combineWildcardCerts = parseBooleanFlag(options.combineWildcardCerts, false);
         if (isBunRuntime && this.combineWildcardCerts) {
@@ -273,2 +268,4 @@ log.info('Bun runtime detected: combined wildcard certificates enabled (SNI bypass)');
 
+        this.skipLocalCheck = parseBooleanFlag(options.skipLocalCheck, true);
+
         const port = options.port === undefined ? 443 : options.port;
@@ -754,2 +751,4 @@ if (port === 80 && !this.local) {
             staging: this.staging,
+            skipDryRun: this.skipLocalCheck,
+            skipChallengeTest: this.skipLocalCheck,
             notify: (event, details) => {
@@ -756,0 +755,0 @@ const eventDomain = (() => {

package.json

 {
     "name": "roster-server",
-    "version": "2.3.12",
+    "version": "2.3.14",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
@@ -5,0 +5,0 @@ "main": "index.js",

test/roster-server.test.js

@@ -305,23 +305,9 @@ 'use strict';
         });
-        it('reads disableWildcard from env var', () => {
-            const previous = process.env.ROSTER_DISABLE_WILDCARD;
-            process.env.ROSTER_DISABLE_WILDCARD = '1';
-            try {
-                const roster = new Roster({ local: true });
-                assert.strictEqual(roster.disableWildcard, true);
-            } finally {
-                if (previous === undefined) delete process.env.ROSTER_DISABLE_WILDCARD;
-                else process.env.ROSTER_DISABLE_WILDCARD = previous;
-            }
+        it('enables disableWildcard from constructor option (truthy string)', () => {
+            const roster = new Roster({ local: true, disableWildcard: '1' });
+            assert.strictEqual(roster.disableWildcard, true);
         });
-        it('enables combined wildcard certs from env var', () => {
-            const previous = process.env.ROSTER_COMBINE_WILDCARD_CERTS;
-            process.env.ROSTER_COMBINE_WILDCARD_CERTS = '1';
-            try {
-                const roster = new Roster({ local: false });
-                assert.strictEqual(roster.combineWildcardCerts, true);
-            } finally {
-                if (previous === undefined) delete process.env.ROSTER_COMBINE_WILDCARD_CERTS;
-                else process.env.ROSTER_COMBINE_WILDCARD_CERTS = previous;
-            }
+        it('enables combined wildcard certs from constructor option', () => {
+            const roster = new Roster({ local: false, combineWildcardCerts: true });
+            assert.strictEqual(roster.combineWildcardCerts, true);
         });
@@ -328,0 +314,0 @@ it('defaults combineWildcardCerts to false', () => {

vendor/greenlock/greenlock.js

@@ -376,3 +376,5 @@ 'use strict';
             notify: greenlock._notify,
-            debug: greenlock._defaults.debug || args.debug
+            debug: greenlock._defaults.debug || args.debug,
+            skipDryRun: gconf.skipDryRun || false,
+            skipChallengeTest: gconf.skipChallengeTest || false
         });
@@ -379,0 +381,0 @@

docs/decisions/network-default-bind-hostname.md

----
-id: ac8ba0ra21
-type: decision
-title: Roster default IPv6 bind
-created: '2026-03-16 21:57:18'
----
-Changed Roster default bind hostname from 0.0.0.0 to :: in index.js constructor (`this.hostname = options.hostname ?? '::'`). This makes default listen IPv6-first. Existing explicit hostname option still overrides. Verified with full test suite: 74 passing.

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Number of low supply chain risk alerts

66

-13.16%

Worsened metrics

Total package byte prevSize

569511

-0.18%

Number of package files

105

-0.94%

Lines of code

9673

-0.14%

No dependency changes