mirrors/node-rs
0
0 Fork 0
mirror of https://github.com/napi-rs/node-rs.git synced 2026-10-28 19:14:34 +08:00
Code Activity
1,250 Commits 17 Branches 296 Tags
@node-rs/jieba@2.0.4
Commit Graph
3 Commits
Author SHA1 Message Date
LongYinanandDevin fe73c75332 feat!: redesign bcrypt API while preserving stored hash verification (#1207) 
* feat!: redesign bcrypt creation API and narrow Argon2 verification options

* chore: keep major API changes scoped to bcrypt

* fix(bcrypt): preserve Node 10 and 12 runtime compatibility

* fix(bcrypt): support cancellation without global AbortController

* fix(bcrypt): polish the 2.0 API and packaging before release

- Settle the public Promise before removing the abort listener, and remove
  it with the same options, so throwing or capture-flag EventTargets cannot
  hang a call or leak the listener.
- Keep signal.reason as a non-enumerable AbortError cause, so callers can
  tell a TimeoutError or custom reason apart.
- Throw TypeError for option values of the wrong type and keep RangeError
  for out-of-range or malformed values.
- Copy only the 72 password bytes bcrypt reads for async work, and wipe
  those copies on drop; replace the unreachable!() salt branch.
- Declare package exports so internal files cannot be deep-imported.
- Stop declaring the WASI package as an optional dependency, so installs do
  not pull it and a missing native binary fails loudly.
- Leave the version bump to the release step, add the 2.0.0 changelog, and
  preapprove this repo's own @node-rs/* packages.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* test(bcrypt): keep the event loop alive while waiting for AbortSignal.timeout

AbortSignal.timeout() uses a timer that does not keep the event loop
alive, and the controlled backend has no native work that would. The
test passed only when other tests kept the worker busy, and failed with
"Promise returned by test never resolved" on the Linux and WASI jobs.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* chore: resolve bcrypt-previous from the registry

With the bcrypt workspace back at 1.10.9, yarn's transparent workspaces
link bcrypt-previous (npm:@node-rs/bcrypt@1.10.9) to the workspace
itself whenever the lockfile is regenerated, so the previous-release
tests would compare the new code with itself. No workspace depends on
another, so only the workspace: protocol needs to link workspaces.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* chore(bcrypt): regenerate bindings with @napi-rs/cli 3.10.5

main moved @napi-rs/cli from 3.9.0 to 3.10.5. Regenerate the bcrypt
loaders and type declarations from native and wasm32-wasip1-threads
builds so the committed files match what the release build produces.
binding.js still parses as ES2019 for Node 10 and 12.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(bcrypt): keep custom signal errors from breaking settled or aborted calls

A signal whose removeEventListener throws made a successful call raise an
unhandled rejection, which exits modern Node, and on abort it skipped the
native cancellation. A signal whose reason getter throws stopped the abort
listener before it settled, so the call stayed pending or resolved after
the abort. Ignore cleanup failures once the call has settled, and read the
optional reason defensively.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* feat(bcrypt): add parseOptions and Node-style error codes for 2.0

Bundle two more contract changes into the 2.0 break so the error and
rehash-on-login story is complete at release:

- Thrown errors carry Node-style codes: TypeError ERR_INVALID_ARG_TYPE,
  RangeError ERR_OUT_OF_RANGE (including native InvalidArg translations),
  and AbortError ABORT_ERR, matching Node's own AbortError.
- parseOptions(hash) returns { version, cost } through the verifier's
  parser (bcrypt::HashParts), so every hash verify accepts is parseable,
  including +4 costs and imported 2x labels; hashes verify always rejects
  throw RangeError. Mirrors argon2's parseOptions in this repo.
- AbortSignalLike.removeEventListener declares the options argument the
  adapter actually passes.
- Drop unused blowfish and quickcheck dependencies from the bcrypt crate
  and the workspace.

Native and wasm32-wasip1-threads bindings are regenerated. api.cjs still
parses as ES2019 for Node 10 and 12.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(bcrypt): tidy parseOptions review nits

- Use one options type for add/removeEventListener on AbortSignalLike,
  matching the comment that the same object is passed to both.
- Give parseOptions its own arity message; it never had positional
  options to drop.
- Cover the 60-byte non-ASCII parser branch in the test, which the
  previous 61-byte input missed.
- Mention in the README that parseOptions throws for hashes verify
  always rejects.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* feat(bcrypt): give the backend contract error a code

A stale platform package now fails at import time with
code ERR_BCRYPT_INCOMPATIBLE_BINARY, so every error the package throws
sits inside the documented ErrorCode contract.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* feat(bcrypt): switch hashing backend to bcrypt-rust

Replace the bcrypt 0.19 dependency with bcrypt-rust 1.0, keeping the crate
name so imports stay valid. The new crate is a drop-in for every API used
here except one deliberate difference: its HashParts parser is strict and
rejects the noncanonical '+4' cost spelling the old backend accepted.

Verify and parseOptions now use a lenient parser that mirrors the old
backend byte-for-byte (60 ASCII bytes, 2a/2b/2x/2y markers, u32::parse for
cost), then hand the canonicalized hash to bcrypt::verify so the cost gate
and constant-time compare stay in the library.

~20% faster than the C++ backend on hash and verify.

* bench: make benchmark comparisons 1:1 and migrate argon2 to tinybench

bcrypt: uniform call signatures via per-impl adapters, a fixed salt so the
hash suite measures hashing only, a real sync compare for verify (it
previously timed an unawaited async call with a hash inside the loop), one
cost across suites, all five implementations in every suite, and a compact
sorted table with latency, rme, ops/s, and a ratio to the baseline.

argon2: replace the hand-rolled performance.now() harness with tinybench
fixed-iteration runs, keep the per-iteration tag assertion and the
native-sync / native-async / js-wasm grouping, and adopt the same report
format.

* bench: narrow tinybench TaskResult before reading stats

TaskResult is a discriminated union; latency/throughput exist only on
completed and aborted-with-statistics. CI type-checks benchmark files
through packages/argon2/tsconfig.json, unlike oxnode which strips types.

* perf(bcrypt): fast-path genSaltSync options; note wasm salt overhead in bench comment

genSaltSync previously ran every call through options() + creation(),
allocating a fresh Object.create(null) copy even for {} and {cost}. Now
undefined uses a frozen empty options object and reusable options shapes
validate in place — identical error paths preserved for non-plain or
extra-key objects. Saves ~200ns of JS wrapper overhead per call.

* deps: bump bcrypt-rust to 1.0.1

Picks up the crypt_blowfish fused-round kernel shape
(Brooooooklyn/bcrypt-rust@f65cd90): bcrypt() at cost 10 on x86_64
drops ~19% (138.2ms -> 112.6ms vs vendored C at 108.7ms); arm64
unchanged.

* perf(bcrypt): cut genSaltSync overhead; pool OS entropy per thread

genSaltSync now serves 16-byte salts from a 256-byte thread-local pool
refilled by SysRng (direct getrandom), amortizing one syscall over 16
salts without any userspace PRNG in between. The salt string is built
without format! machinery and the bcrypt base64 engine is constructed
once in a LazyLock instead of per call.

api.cjs gains a specialized fast path for the {cost,version} shapes:
getOwnPropertyNames/getOwnPropertySymbols cover the same key space as
Reflect.ownKeys at half the cost, the sync() closure is inlined, and
anything the fast path cannot prove valid funnels into a shared full-
validation path so error types, codes, and messages stay identical.

x86_64 sandbox (30k-iteration amortized loop, best of reps):
  @node-rs/bcrypt ~380-560ns vs wasm OpenBSD ~550-730ns
  per-call min: 210-250ns vs 320-370ns; bench.js min 290ns vs 860ns.

* deps: bump bcrypt-rust to 1.0.2

Picks up the xor_late asm boundary (Brooooooklyn/bcrypt-rust#8): LLVM no
longer reassociates the fused round into two serial xors after the S-box
loads. On x86_64 EPYC the raw kernel now beats crypt_blowfish C
(~54.6ms vs ~54.9ms at cost 10) and JS hashSync/verifySync beat node
bcrypt (C++); arm64/wasm32 untouched via cfg fallback. CodSpeed: -4% on
all single-hash benches.

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 23:33:58 +08:00
renovate[bot] cfa1f9b90e chore(deps): update rust crate jieba-rs to 0.11 (#1213) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-16 19:57:21 +00:00
LongYinan f8d6b3eb8c fix: record and lock Rust release dependencies (#1206) 
* fix: record and lock Rust release dependencies

* chore: group Cargo lockfile maintenance
 2026-09-10 12:02:39 +08:00