event based http server for nodejs
This is an important security release. We recommend upgrading immediately.
Would have been better as a minor or patch level release but the change actually requires a major release because it has the potential to break the way that users are interacting with query parameters. As such this is a major release.
The main change here is that query params are now all stripped of html and then any html entities are converted before the events for routes are triggered. So you will now be interacting with sanitized query params.
This new behavior can be turned off with the config.security.unsafeQuery flag being set to true. This should only be done if you are correctly handling this or the query params aren't used in a way that would allow for exploitation.
This is a big one but a small one.
The API is pretty much unchanged except for the addition of Performance Headers for timing and performance measurement in the browser.
The bigger change is a shift off of mocha and chai and on to ava. While it doesn't get us to parallel yet it is a step in that direction. For now there are 28 tests that break with out the serial flag. Over time we hope to get that to 0 and turn it on in parallel for improved performance.
Also upgraded a variety of dependencies to latest. Check the changelog/history.md file for details on that.
Big thanks to @geritol and @lazycoder9 for their contribution to making testing better in this release!
Largest change was removing a duplicate node_modules folder that was added during testing. Should be low to no risk in upgrading.
The minor release is mainly focused on the amount of core routing code that got refactored in the process of reducing the complexity of the routing functions.
The API changes a little with the addition of a path key in the connection that holds the parsed path. This isn't part of the public/supported API yet but will become so in the future.
Note: The new version of harken that is used here breaks existing connectionstubs from the CLI tools... so make sure you are on monument-cli 3.1.0 or greater. And if you are on an existing project make sure you grab the new one from a new project spun up with the CLI tools.
this version is deprecated and re-released as 3.1.0
This is a lame major... since all it does is change the API for setting up a server in a breaking way. But yeah it changes it in a breaking way so time to bump the version.
If you were not using the returned server object for anything then you should be fine. If you are there is a note in the readme about listening for an event to get the server. server:started is the event and you will get back a settings object which contains the server.
Other then that there is very very little in this change. Probably won't really effect anyone.
This is a very small minor release that only warranted minor status because of the expanded API.
It adds statsd support to monument use node-statsd and configuration is through a new statsd key in the config object. Options available are outlined in the readme (host, port, prefix, suffix, cacheDns) and can also be found in the node-statsd repository.
Out of the box we report timing infor for every request and the status code for every request.
We also updated all deps to latest and everything still worked so that was good :-)
Updates all of our dependencies to latest. Nothing breaking, no real observed changes in behavior.
Minor release time!
Starting with this release brötli compression is supported for both static and dynamic requests. It is amazingly tight compression that beats out gzip and deflate. To keep it snappy we are using a wrapper around the c implementation instead of a pure js implementation.
Brötli does have one quirk, that it is only supported by browsers over https. So make sure you have https setup if you are going to use it. monument itself doesn't care, meaning that you could have monument speaking http behind an https load balancer and it will still serve up brötli if the browser supports it. But if you are running the https right off of monument make sure that you are passing in the https module to server in the config object. It should also work with http2 or spdy which require certificates as well.
This release also adds a couple of binary dependencies that improve the performance of the ws library. See the ws docs for more details about that.
There is now a route declaration API so that you can easily add and remove route handlers to the server while it is running. This is awesome! Not only does it provide a code-over-config option for creating route handlers it also makes it possible to create and destroy them as needed.
For more information check out the documentation.